Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
19-04-2024 22:32
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240412-en
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
491d53dcfb36c12d0077bbb926f24d02
-
SHA1
4e35320259495d99e3d9fbc03aeea39c93c3a051
-
SHA256
97cd6ad3a56efc266ba1860e2d1c5958094b988be74bd36e9499d22fdaed9c59
-
SHA512
7f9a8134032cb437278422d7f0ea123e68146fc5f6f3de693592b96620669eb36696625235fddbebae0949e9ddbbd4d8f694c61f16489a38322d90149f70553b
-
SSDEEP
49152:KvYt62XlaSFNWPjljiFa2RoUYIJkRJ6hbR3LoGdvTHHB72eh2NT:Kv062XlaSFNWPjljiFXRoUYIJkRJ6D
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.139:4782
e12e9d8f-f86f-4c20-aaa9-ca4ae3df9435
-
encryption_key
8A5C503C69142D8C1F9A30FB7AA52FB2729B3861
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4392-0-0x0000000000350000-0x0000000000674000-memory.dmp family_quasar C:\Windows\System32\SubDir\Client.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Client.exepid process 804 Client.exe -
Drops file in System32 directory 2 IoCs
Processes:
Client-built.exedescription ioc process File created C:\Windows\system32\SubDir\Client.exe Client-built.exe File opened for modification C:\Windows\system32\SubDir\Client.exe Client-built.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 212 schtasks.exe 2304 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Client-built.exeClient.exedescription pid process Token: SeDebugPrivilege 4392 Client-built.exe Token: SeDebugPrivilege 804 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 804 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Client-built.exeClient.exedescription pid process target process PID 4392 wrote to memory of 212 4392 Client-built.exe schtasks.exe PID 4392 wrote to memory of 212 4392 Client-built.exe schtasks.exe PID 4392 wrote to memory of 804 4392 Client-built.exe Client.exe PID 4392 wrote to memory of 804 4392 Client-built.exe Client.exe PID 804 wrote to memory of 2304 804 Client.exe schtasks.exe PID 804 wrote to memory of 2304 804 Client.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:212 -
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:2304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5491d53dcfb36c12d0077bbb926f24d02
SHA14e35320259495d99e3d9fbc03aeea39c93c3a051
SHA25697cd6ad3a56efc266ba1860e2d1c5958094b988be74bd36e9499d22fdaed9c59
SHA5127f9a8134032cb437278422d7f0ea123e68146fc5f6f3de693592b96620669eb36696625235fddbebae0949e9ddbbd4d8f694c61f16489a38322d90149f70553b