Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23-03-2024 23:01
Behavioral task
behavioral1
Sample
Client-deobf.exe
Resource
win7-20240220-en
General
-
Target
Client-deobf.exe
-
Size
3.1MB
-
MD5
d7471180a1a335178c8062f57e2238f2
-
SHA1
f3e821ce5d1769feb271408746dbccb39e17a9ec
-
SHA256
520d3a1acd104bda412c4b6b118b2c4177fa5ae9c0294c18d8d81a5c604e946f
-
SHA512
420eef19289b550a2cdac7227e6c82ceff3e570bd2d37dadcd617804d16492913ecd7acef84d7962e1b081fe701bc3f609728e765a1829b8f597092c51dc6a84
-
SSDEEP
49152:H9taZ7HYaFI1ITamlivhumFgWdFxUhxGqTHHB72eh2NT:H9tapHYaFI1ITamliJumFg0x
Malware Config
Extracted
quasar
1.4.1
Slave
140.238.91.110:34353
25ab9d56-6ef2-47d3-99aa-2142fbcd41fa
-
encryption_key
8E710985199C6BF86CCE90DA92448A36E2F45F51
-
install_name
XWormV5.6.exe
-
log_directory
WindowsUPDLogs
-
reconnect_delay
3000
-
startup_key
Windows BIOS Update Checker
-
subdirectory
SubDir
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2932-0-0x0000000001390000-0x00000000016AE000-memory.dmp family_quasar C:\Windows\System32\SubDir\XWormV5.6.exe family_quasar behavioral1/memory/2608-8-0x0000000001250000-0x000000000156E000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
XWormV5.6.exepid process 2608 XWormV5.6.exe -
Drops file in System32 directory 5 IoCs
Processes:
XWormV5.6.exeClient-deobf.exedescription ioc process File opened for modification C:\Windows\system32\SubDir XWormV5.6.exe File created C:\Windows\system32\SubDir\XWormV5.6.exe Client-deobf.exe File opened for modification C:\Windows\system32\SubDir\XWormV5.6.exe Client-deobf.exe File opened for modification C:\Windows\system32\SubDir Client-deobf.exe File opened for modification C:\Windows\system32\SubDir\XWormV5.6.exe XWormV5.6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1932 schtasks.exe 2028 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Client-deobf.exeXWormV5.6.exedescription pid process Token: SeDebugPrivilege 2932 Client-deobf.exe Token: SeDebugPrivilege 2608 XWormV5.6.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
XWormV5.6.exepid process 2608 XWormV5.6.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
XWormV5.6.exepid process 2608 XWormV5.6.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
XWormV5.6.exepid process 2608 XWormV5.6.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Client-deobf.exeXWormV5.6.exedescription pid process target process PID 2932 wrote to memory of 1932 2932 Client-deobf.exe schtasks.exe PID 2932 wrote to memory of 1932 2932 Client-deobf.exe schtasks.exe PID 2932 wrote to memory of 1932 2932 Client-deobf.exe schtasks.exe PID 2932 wrote to memory of 2608 2932 Client-deobf.exe XWormV5.6.exe PID 2932 wrote to memory of 2608 2932 Client-deobf.exe XWormV5.6.exe PID 2932 wrote to memory of 2608 2932 Client-deobf.exe XWormV5.6.exe PID 2608 wrote to memory of 2028 2608 XWormV5.6.exe schtasks.exe PID 2608 wrote to memory of 2028 2608 XWormV5.6.exe schtasks.exe PID 2608 wrote to memory of 2028 2608 XWormV5.6.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-deobf.exe"C:\Users\Admin\AppData\Local\Temp\Client-deobf.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows BIOS Update Checker" /sc ONLOGON /tr "C:\Windows\system32\SubDir\XWormV5.6.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\SubDir\XWormV5.6.exe"C:\Windows\system32\SubDir\XWormV5.6.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows BIOS Update Checker" /sc ONLOGON /tr "C:\Windows\system32\SubDir\XWormV5.6.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\System32\SubDir\XWormV5.6.exeFilesize
3.1MB
MD5d7471180a1a335178c8062f57e2238f2
SHA1f3e821ce5d1769feb271408746dbccb39e17a9ec
SHA256520d3a1acd104bda412c4b6b118b2c4177fa5ae9c0294c18d8d81a5c604e946f
SHA512420eef19289b550a2cdac7227e6c82ceff3e570bd2d37dadcd617804d16492913ecd7acef84d7962e1b081fe701bc3f609728e765a1829b8f597092c51dc6a84
-
memory/2608-9-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmpFilesize
9.9MB
-
memory/2608-8-0x0000000001250000-0x000000000156E000-memory.dmpFilesize
3.1MB
-
memory/2608-10-0x000000001B290000-0x000000001B310000-memory.dmpFilesize
512KB
-
memory/2608-12-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmpFilesize
9.9MB
-
memory/2608-13-0x000000001B290000-0x000000001B310000-memory.dmpFilesize
512KB
-
memory/2932-0-0x0000000001390000-0x00000000016AE000-memory.dmpFilesize
3.1MB
-
memory/2932-1-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmpFilesize
9.9MB
-
memory/2932-2-0x000000001B2F0000-0x000000001B370000-memory.dmpFilesize
512KB
-
memory/2932-11-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmpFilesize
9.9MB