Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
22-04-2024 06:06
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
41de983b173011ea0f81bc18257927ea
-
SHA1
48b40eadc6eca603b8adc15bc38a0b5b9450e56a
-
SHA256
1db7148b47d7219aa4587138b491a4b4bb41c7d95bfc0bdd152fdd6f1d774edb
-
SHA512
4efe78911125a02dea2a1e5112ae5869773b95862a104c9a97b4953a9a723898a56638f25cbb8508219896ffee9d5ae5d15d9dd1eb8790c2f28bfea1209a3525
-
SSDEEP
49152:yvyI22SsaNYfdPBldt698dBcjHBK8wDMfVEoGdATHHB72eh2NT:yvf22SsaNYfdPBldt6+dBcjHBK8wT
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.40.129:4782
19c3bb2c-1a75-4589-b738-25f9f15ec087
-
encryption_key
9BD7B5AD8335EC9A1AB45A1EB5FC9CA0CBA10236
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3508-0-0x0000000000EB0000-0x00000000011D4000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Client.exepid process 4832 Client.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3640 schtasks.exe 204 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Client-built.exeClient.exedescription pid process Token: SeDebugPrivilege 3508 Client-built.exe Token: SeDebugPrivilege 4832 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 4832 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Client-built.exeClient.exedescription pid process target process PID 3508 wrote to memory of 3640 3508 Client-built.exe schtasks.exe PID 3508 wrote to memory of 3640 3508 Client-built.exe schtasks.exe PID 3508 wrote to memory of 4832 3508 Client-built.exe Client.exe PID 3508 wrote to memory of 4832 3508 Client-built.exe Client.exe PID 4832 wrote to memory of 204 4832 Client.exe schtasks.exe PID 4832 wrote to memory of 204 4832 Client.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:3640 -
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:204
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD541de983b173011ea0f81bc18257927ea
SHA148b40eadc6eca603b8adc15bc38a0b5b9450e56a
SHA2561db7148b47d7219aa4587138b491a4b4bb41c7d95bfc0bdd152fdd6f1d774edb
SHA5124efe78911125a02dea2a1e5112ae5869773b95862a104c9a97b4953a9a723898a56638f25cbb8508219896ffee9d5ae5d15d9dd1eb8790c2f28bfea1209a3525