Analysis
- max time kernel
108s - max time network
111s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
30/03/2024, 17:44
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target Client-built.exe
- Size 3.1MB
- Sample240330-wbj2rsbe64
- SHA256 de4a1dd69239ae05aa3c20c13872f212c33c846658c54a85202284aa00226f5b
- MD5 3f79fe2786cdb2cfb280241a4981710b
- SHA1 43994b87ba3d7400cc5f9d50def16b4136afb78c
- SHA512 c3c947835c2dc69d858066940f4a3cf8c68d405809f93b8e7083afc5108e79abc6acfd088805f54f60a2201300c66eb40fc8b039f2392d3a9b147212e8c0e34b
- SSDEEP 49152:uvbI22SsaNYfdPBldt698dBcjHnyLQaEfebk/l4JoGdOhKTHHB72eh2NT:uvk22SsaNYfdPBldt6+dBcjHyLQ9CC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
8.tcp.eu.ngrok.io:25811
Mutex
-
b3c7fcd1-a61a-466e-800c-816f8c0aae37
Attributes
-
encryption_key
C5AB2B8BB0BD28D20931C259C0499227818F5667
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/3844-0-0x0000000000850000-0x0000000000B74000-memory.dmp family_quasar behavioral2/files/0x0007000000023211-5.dat family_quasar - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation Client.exe - Executes dropped EXE 2 IoCs
pid Process 2204 Client.exe 4384 Client.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 14 8.tcp.eu.ngrok.io - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\SubDir\Client.exe Client-built.exe File opened for modification C:\Windows\system32\SubDir\Client.exe Client-built.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 412 schtasks.exe 1020 schtasks.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "156" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3844 Client-built.exe Token: SeDebugPrivilege 2204 Client.exe Token: SeDebugPrivilege 2824 taskmgr.exe Token: SeSystemProfilePrivilege 2824 taskmgr.exe Token: SeCreateGlobalPrivilege 2824 taskmgr.exe Token: SeDebugPrivilege 4384 Client.exe Token: SeShutdownPrivilege 3916 shutdown.exe Token: SeRemoteShutdownPrivilege 3916 shutdown.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2204 Client.exe 2204 Client.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2204 Client.exe 2204 Client.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2204 Client.exe 2892 LogonUI.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3844 wrote to memory of 412 3844 Client-built.exe 87 PID 3844 wrote to memory of 412 3844 Client-built.exe 87 PID 3844 wrote to memory of 2204 3844 Client-built.exe 89 PID 3844 wrote to memory of 2204 3844 Client-built.exe 89 PID 2204 wrote to memory of 1020 2204 Client.exe 92 PID 2204 wrote to memory of 1020 2204 Client.exe 92 PID 2204 wrote to memory of 3916 2204 Client.exe 105 PID 2204 wrote to memory of 3916 2204 Client.exe 105 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:412
-
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:1020
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /s /t 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2824
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:376
-
C:\Windows\System32\SubDir\Client.exe"C:\Windows\System32\SubDir\Client.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3972055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
- Size 1KB
- SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
- MD5 baf55b95da4a601229647f25dad12878
- SHA1 abc16954ebfd213733c4493fc1910164d825cac8
- SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
- MD5 SHA1 SHA512
- Path C:\Windows\System32\SubDir\Client.exe
- Size 3.1MB
- SHA256 de4a1dd69239ae05aa3c20c13872f212c33c846658c54a85202284aa00226f5b
- MD5 3f79fe2786cdb2cfb280241a4981710b
- SHA1 43994b87ba3d7400cc5f9d50def16b4136afb78c
- SHA512 c3c947835c2dc69d858066940f4a3cf8c68d405809f93b8e7083afc5108e79abc6acfd088805f54f60a2201300c66eb40fc8b039f2392d3a9b147212e8c0e34b
- SSDEEP 49152:uvbI22SsaNYfdPBldt698dBcjHnyLQaEfebk/l4JoGdOhKTHHB72eh2NT:uvk22SsaNYfdPBldt6+dBcjHyLQ9CC
- MD5 SHA1 SHA512 SSDEEP