Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2024, 12:11
Behavioral task
behavioral1
Sample
agent64.exe
Resource
win7-20240221-en
General
-
Target
agent64.exe
-
Size
3.1MB
-
MD5
488550eeb4ae87c8f9510e04e222261d
-
SHA1
18c1785375af65ec82a161d13354656282412803
-
SHA256
6f4dd3d2ea6b1310b9c9e2063aba85396ea82e63f777a5dd5b42dac67c0ae630
-
SHA512
4ea8274a28e8ee68633b5ebd07e68916d80d9d807ee62c3700f9cfb5bd990ba6c88b8ac7bdac893964139ea9a949a2ee092334d45b48fbe590c1345ada594514
-
SSDEEP
49152:fvSI22SsaNYfdPBldt698dBcjHslRJ6sbR3LoGd5/THHB72eh2NT:fv/22SsaNYfdPBldt6+dBcjHslRJ62
Malware Config
Extracted
quasar
1.4.1
God
88.209.197.253:4782
5b9901b6-5e69-4eaa-a9f2-55ce43b72785
-
encryption_key
CEAEA9FD2F3E18352164BB4D9A6F56EFF5E2D896
-
install_name
COM Surrogate.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Update
-
subdirectory
System32
Signatures
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/3332-0-0x0000000000BD0000-0x0000000000EF4000-memory.dmp family_quasar behavioral2/files/0x000300000001e5e0-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 812 COM Surrogate.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1448 schtasks.exe 4504 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3332 agent64.exe Token: SeDebugPrivilege 812 COM Surrogate.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 812 COM Surrogate.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3332 wrote to memory of 1448 3332 agent64.exe 86 PID 3332 wrote to memory of 1448 3332 agent64.exe 86 PID 3332 wrote to memory of 812 3332 agent64.exe 88 PID 3332 wrote to memory of 812 3332 agent64.exe 88 PID 812 wrote to memory of 4504 812 COM Surrogate.exe 91 PID 812 wrote to memory of 4504 812 COM Surrogate.exe 91 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\agent64.exe"C:\Users\Admin\AppData\Local\Temp\agent64.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\System32\COM Surrogate.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:1448
-
-
C:\Users\Admin\AppData\Roaming\System32\COM Surrogate.exe"C:\Users\Admin\AppData\Roaming\System32\COM Surrogate.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\System32\COM Surrogate.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:4504
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5488550eeb4ae87c8f9510e04e222261d
SHA118c1785375af65ec82a161d13354656282412803
SHA2566f4dd3d2ea6b1310b9c9e2063aba85396ea82e63f777a5dd5b42dac67c0ae630
SHA5124ea8274a28e8ee68633b5ebd07e68916d80d9d807ee62c3700f9cfb5bd990ba6c88b8ac7bdac893964139ea9a949a2ee092334d45b48fbe590c1345ada594514