Analysis

  • max time kernel
    444s
  • max time network
    446s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2024, 04:54

General

  • Target

    Quasar v1.4.1/BouncyCastle.Crypto.dll

  • Size

    3.2MB

  • MD5

    0cf454b6ed4d9e46bc40306421e4b800

  • SHA1

    9611aa929d35cbd86b87e40b628f60d5177d2411

  • SHA256

    e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42

  • SHA512

    85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048

  • SSDEEP

    49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\BouncyCastle.Crypto.dll",#1
    1⤵
      PID:4980
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:4436
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4260

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

              Filesize

              16KB

              MD5

              a55dec6cfb08440f58a404b786ec34aa

              SHA1

              118d9bdf01362af0f1fa20c9cc3e4c249a71e3c9

              SHA256

              a57d12ad7bed1575efa818ac6ee391515110ac3dace974e16be9ac6bfa681c64

              SHA512

              3af17b6eb6ecc2801cc073a7b6f8003dd675c842347510a143f37ea910e9f89858be9543f301daa143b0a107480002f3e32a5da46cb9b7bbb9bac1cc1866b562

            • memory/4260-40-0x000002166A000000-0x000002166A001000-memory.dmp

              Filesize

              4KB

            • memory/4260-42-0x000002166A200000-0x000002166A201000-memory.dmp

              Filesize

              4KB

            • memory/4260-33-0x000002166A000000-0x000002166A001000-memory.dmp

              Filesize

              4KB

            • memory/4260-34-0x000002166A000000-0x000002166A001000-memory.dmp

              Filesize

              4KB

            • memory/4260-35-0x000002166A000000-0x000002166A001000-memory.dmp

              Filesize

              4KB

            • memory/4260-36-0x000002166A000000-0x000002166A001000-memory.dmp

              Filesize

              4KB

            • memory/4260-37-0x000002166A000000-0x000002166A001000-memory.dmp

              Filesize

              4KB

            • memory/4260-38-0x000002166A000000-0x000002166A001000-memory.dmp

              Filesize

              4KB

            • memory/4260-39-0x000002166A000000-0x000002166A001000-memory.dmp

              Filesize

              4KB

            • memory/4260-43-0x0000021668C20000-0x0000021668C21000-memory.dmp

              Filesize

              4KB

            • memory/4260-32-0x0000021668FD0000-0x0000021668FD1000-memory.dmp

              Filesize

              4KB

            • memory/4260-41-0x000002166A200000-0x000002166A201000-memory.dmp

              Filesize

              4KB

            • memory/4260-0-0x0000021660940000-0x0000021660950000-memory.dmp

              Filesize

              64KB

            • memory/4260-44-0x0000021668C10000-0x0000021668C11000-memory.dmp

              Filesize

              4KB

            • memory/4260-46-0x0000021668C20000-0x0000021668C21000-memory.dmp

              Filesize

              4KB

            • memory/4260-49-0x0000021668C10000-0x0000021668C11000-memory.dmp

              Filesize

              4KB

            • memory/4260-52-0x0000021668B50000-0x0000021668B51000-memory.dmp

              Filesize

              4KB

            • memory/4260-16-0x0000021660A40000-0x0000021660A50000-memory.dmp

              Filesize

              64KB

            • memory/4260-64-0x0000021668D50000-0x0000021668D51000-memory.dmp

              Filesize

              4KB

            • memory/4260-66-0x0000021668D60000-0x0000021668D61000-memory.dmp

              Filesize

              4KB

            • memory/4260-67-0x0000021668D60000-0x0000021668D61000-memory.dmp

              Filesize

              4KB

            • memory/4260-68-0x0000021668E70000-0x0000021668E71000-memory.dmp

              Filesize

              4KB