Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/03/2024, 02:19
Behavioral task
behavioral1
Sample
c88caddc2a450135e7f7d36d8b9857628b96f97b67d782025b229034d34f9582.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c88caddc2a450135e7f7d36d8b9857628b96f97b67d782025b229034d34f9582.exe
Resource
win10v2004-20240226-en
General
-
Target
c88caddc2a450135e7f7d36d8b9857628b96f97b67d782025b229034d34f9582.exe
-
Size
3.1MB
-
MD5
c4497b459274cec0b9fd6e3ac6c67aaa
-
SHA1
1c8b8e42b8284b6dc2d2741850a9c01c07a5088f
-
SHA256
c88caddc2a450135e7f7d36d8b9857628b96f97b67d782025b229034d34f9582
-
SHA512
bf64fd7a95dedd703a04cf661b35ebaa343dd7b2e907d1de20d16bcb91259b76ba9f80a817d391487eb5c4f549658ba545673b3b3f26cc45e0a16fecfff01c24
-
SSDEEP
49152:Cvguf2NUaNmwzPWlvdaKM7ZxTwW3xbbRYLoGd7THHB72eh2NT:Cv/f2NUaNmwzPWlvdaB7ZxTwW3xQ
Malware Config
Extracted
quasar
1.4.1
50 installs
217.63.234.90:4444
217.63.234.90:1313
127.0.0.1:1313
ef23a66e-d8e1-48c7-a533-50e2b78bea4a
-
encryption_key
6B0D9CDFBF22251A89F554E059B7463C8CDE0F0C
-
install_name
svchost.exe
-
log_directory
Logs50spread
-
reconnect_delay
3000
-
startup_key
svchost.exe
-
subdirectory
SubDir
Signatures
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2376-0-0x00000000002B0000-0x00000000005D4000-memory.dmp family_quasar behavioral1/files/0x000d0000000122c7-6.dat family_quasar behavioral1/memory/2992-8-0x0000000000BF0000-0x0000000000F14000-memory.dmp family_quasar -
Detects Windows executables referencing non-Windows User-Agents 3 IoCs
resource yara_rule behavioral1/memory/2376-0-0x00000000002B0000-0x00000000005D4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/files/0x000d0000000122c7-6.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2992-8-0x0000000000BF0000-0x0000000000F14000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 3 IoCs
resource yara_rule behavioral1/memory/2376-0-0x00000000002B0000-0x00000000005D4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/files/0x000d0000000122c7-6.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2992-8-0x0000000000BF0000-0x0000000000F14000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables containing common artifacts observed in infostealers 3 IoCs
resource yara_rule behavioral1/memory/2376-0-0x00000000002B0000-0x00000000005D4000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/files/0x000d0000000122c7-6.dat INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2992-8-0x0000000000BF0000-0x0000000000F14000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer -
Executes dropped EXE 1 IoCs
pid Process 2992 svchost.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2940 schtasks.exe 2568 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2376 c88caddc2a450135e7f7d36d8b9857628b96f97b67d782025b229034d34f9582.exe Token: SeDebugPrivilege 2992 svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2940 2376 c88caddc2a450135e7f7d36d8b9857628b96f97b67d782025b229034d34f9582.exe 28 PID 2376 wrote to memory of 2940 2376 c88caddc2a450135e7f7d36d8b9857628b96f97b67d782025b229034d34f9582.exe 28 PID 2376 wrote to memory of 2940 2376 c88caddc2a450135e7f7d36d8b9857628b96f97b67d782025b229034d34f9582.exe 28 PID 2376 wrote to memory of 2992 2376 c88caddc2a450135e7f7d36d8b9857628b96f97b67d782025b229034d34f9582.exe 30 PID 2376 wrote to memory of 2992 2376 c88caddc2a450135e7f7d36d8b9857628b96f97b67d782025b229034d34f9582.exe 30 PID 2376 wrote to memory of 2992 2376 c88caddc2a450135e7f7d36d8b9857628b96f97b67d782025b229034d34f9582.exe 30 PID 2992 wrote to memory of 2568 2992 svchost.exe 31 PID 2992 wrote to memory of 2568 2992 svchost.exe 31 PID 2992 wrote to memory of 2568 2992 svchost.exe 31 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c88caddc2a450135e7f7d36d8b9857628b96f97b67d782025b229034d34f9582.exe"C:\Users\Admin\AppData\Local\Temp\c88caddc2a450135e7f7d36d8b9857628b96f97b67d782025b229034d34f9582.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:2940
-
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:2568
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5c4497b459274cec0b9fd6e3ac6c67aaa
SHA11c8b8e42b8284b6dc2d2741850a9c01c07a5088f
SHA256c88caddc2a450135e7f7d36d8b9857628b96f97b67d782025b229034d34f9582
SHA512bf64fd7a95dedd703a04cf661b35ebaa343dd7b2e907d1de20d16bcb91259b76ba9f80a817d391487eb5c4f549658ba545673b3b3f26cc45e0a16fecfff01c24