Analysis

  • max time kernel
    450s
  • max time network
    451s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2024, 04:54

General

  • Target

    Quasar v1.4.1/Gma.System.MouseKeyHook.dll

  • Size

    56KB

  • MD5

    bfb3bd1cb571360435100bfa6ed2b997

  • SHA1

    1325e8dd76180a165117e04da4ee4a020e996880

  • SHA256

    a67a424013544c8270c12633e2e1e287cd5cf0b3f2e81e8d8204b37a03da59ef

  • SHA512

    ae5a88a9e86b9e64b8c289213f814586dfa5fe5e0cc21bdbc3e48c36d81fa9e763c6e78f24e40df07696228270ad72f408846125e61e33cae867ef8ff88a3c15

  • SSDEEP

    768:qYnDJGdu2oE3d7ltSl+Y8sCcm8Doi/L0CPw87qquEZ+r3FhuiFJ8G:VncoU48/AzPwYpNZ6rXJ8G

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\Gma.System.MouseKeyHook.dll",#1
    1⤵
      PID:3780
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:5076
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2628

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2628-0-0x0000024C0A640000-0x0000024C0A650000-memory.dmp

              Filesize

              64KB

            • memory/2628-16-0x0000024C0A740000-0x0000024C0A750000-memory.dmp

              Filesize

              64KB

            • memory/2628-32-0x0000024C12A20000-0x0000024C12A21000-memory.dmp

              Filesize

              4KB

            • memory/2628-34-0x0000024C12A50000-0x0000024C12A51000-memory.dmp

              Filesize

              4KB

            • memory/2628-35-0x0000024C12A50000-0x0000024C12A51000-memory.dmp

              Filesize

              4KB

            • memory/2628-36-0x0000024C12B60000-0x0000024C12B61000-memory.dmp

              Filesize

              4KB