Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-04-2024 11:07
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240221-en
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
3f8eed5b849f82d1d648309d4dff4259
-
SHA1
84afa96423792de3ec490807adf9ed91f3dbe941
-
SHA256
eaa750c492fa799eb0b19e7d13a265c5091593d8b6c90a7c50b50c8c84469dad
-
SHA512
ec4e36ec67e6fc355bfec6d5d197c8a35e9d0a3ca2dd412ce90687a42e3776cd8cf910da3d7af1834b808fc76d3569ad81e63e3f1d5d469966db7d318b572ba9
-
SSDEEP
49152:CvvY52fyaSZOrPWluWBuGG5g5hAfDobRcLoGd3FWTHHB72eh2NT:CvA52fyaSZOrPWluWBDG5g5hAfDL
Malware Config
Extracted
quasar
1.4.1
Office04
Quasar:4782
9b67176b-b611-43bb-9088-e3361aae729e
-
encryption_key
8E11C43A418F21B478F3A8A93EDFD963316D550B
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
File Explorer
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3052-0-0x0000000001080000-0x00000000013A4000-memory.dmp family_quasar -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Client-built.exedescription pid process Token: SeDebugPrivilege 3052 Client-built.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Client-built.exedescription pid process target process PID 3052 wrote to memory of 2440 3052 Client-built.exe schtasks.exe PID 3052 wrote to memory of 2440 3052 Client-built.exe schtasks.exe PID 3052 wrote to memory of 2440 3052 Client-built.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "File Explorer" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:2440