Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
13-04-2024 19:15
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240412-en
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
61a794936ec8a32416ab054556f6270e
-
SHA1
08f16c442752f65c04b8452642fd7b6102314fb0
-
SHA256
796d5a37143cb32778bab8b2210e35c22d75bfaf2368323b0d2400ace4ded468
-
SHA512
8000d3dfca0ef4daca77ad968af0c0ff496de9da59ffa5168479b0dcbd792ce5f1ea620cf0ff51d2bff1613383c3a3feeeccf1e07af963c199cb1d10e4d37988
-
SSDEEP
49152:zv+lL26AaNeWgPhlmVqvMQ7XSKjDyr3MfNLoGd6ITTHHB72eh2NT:zvuL26AaNeWgPhlmVqkQ7XSKjDyrE
Malware Config
Extracted
quasar
1.4.1
Office04
LunasLove-64385.portmap.host:64285
29d7a2a1-3a57-4435-8407-1e32b7f510e7
-
encryption_key
717F000FA98487F20ACB7C82618D076F1B6DB848
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3964-0-0x0000000000820000-0x0000000000B44000-memory.dmp family_quasar -
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 4100 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Client-built.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 3964 Client-built.exe Token: SeDebugPrivilege 4100 taskmgr.exe Token: SeSystemProfilePrivilege 4100 taskmgr.exe Token: SeCreateGlobalPrivilege 4100 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Client-built.exedescription pid process target process PID 3964 wrote to memory of 4548 3964 Client-built.exe schtasks.exe PID 3964 wrote to memory of 4548 3964 Client-built.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:4548
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4100