Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22-04-2024 06:09
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
41de983b173011ea0f81bc18257927ea
-
SHA1
48b40eadc6eca603b8adc15bc38a0b5b9450e56a
-
SHA256
1db7148b47d7219aa4587138b491a4b4bb41c7d95bfc0bdd152fdd6f1d774edb
-
SHA512
4efe78911125a02dea2a1e5112ae5869773b95862a104c9a97b4953a9a723898a56638f25cbb8508219896ffee9d5ae5d15d9dd1eb8790c2f28bfea1209a3525
-
SSDEEP
49152:yvyI22SsaNYfdPBldt698dBcjHBK8wDMfVEoGdATHHB72eh2NT:yvf22SsaNYfdPBldt6+dBcjHBK8wT
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.40.129:4782
19c3bb2c-1a75-4589-b738-25f9f15ec087
-
encryption_key
9BD7B5AD8335EC9A1AB45A1EB5FC9CA0CBA10236
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/5020-0-0x0000000000B60000-0x0000000000E84000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Client.exepid process 560 Client.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2932 schtasks.exe 3844 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Client-built.exeClient.exedescription pid process Token: SeDebugPrivilege 5020 Client-built.exe Token: SeDebugPrivilege 560 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 560 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Client-built.exeClient.exedescription pid process target process PID 5020 wrote to memory of 2932 5020 Client-built.exe schtasks.exe PID 5020 wrote to memory of 2932 5020 Client-built.exe schtasks.exe PID 5020 wrote to memory of 560 5020 Client-built.exe Client.exe PID 5020 wrote to memory of 560 5020 Client-built.exe Client.exe PID 560 wrote to memory of 3844 560 Client.exe schtasks.exe PID 560 wrote to memory of 3844 560 Client.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:2932 -
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:3844
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD541de983b173011ea0f81bc18257927ea
SHA148b40eadc6eca603b8adc15bc38a0b5b9450e56a
SHA2561db7148b47d7219aa4587138b491a4b4bb41c7d95bfc0bdd152fdd6f1d774edb
SHA5124efe78911125a02dea2a1e5112ae5869773b95862a104c9a97b4953a9a723898a56638f25cbb8508219896ffee9d5ae5d15d9dd1eb8790c2f28bfea1209a3525