Analysis
-
max time kernel
35s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22-04-2024 18:04
Static task
static1
General
-
Target
thesigma.exe
-
Size
1.6MB
-
MD5
7689437063c4eb4aab919fd25de6702d
-
SHA1
36252a4df082fef51b2a1ab07f771e17860986d1
-
SHA256
440271ab4c5959d7679fe00e6b223bcb8401a869e72d464cde8f880ff62f58da
-
SHA512
13b874366ae7c25ba70f79cc3bd36af8668f3a0c750696c149a8cc15ee6cb850b002612ee519188910884b391b41667f1b072dac2d7a3a44a265f25201c22145
-
SSDEEP
24576:0IjFRSPYlrMKgc6bN5WV63pDWWb6ohTLzeUtfjldLNvyvI:1jDaYlrM/NhLfdLNMI
Malware Config
Extracted
quasar
3.1.5
Slave
nugget1234-38628.portmap.host:38628
$Sxr-AYc4tpo0KefMRW4CpM
-
encryption_key
O77hjXYiXiE656Wt67Lm
-
install_name
System.exe
-
log_directory
Logs
-
reconnect_delay
1000
-
startup_key
WindowsAudioHelper
-
subdirectory
Windows
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\kysss.exe family_quasar behavioral1/memory/4628-43-0x0000000000D40000-0x0000000000DAC000-memory.dmp family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
thesigma.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation thesigma.exe -
Executes dropped EXE 2 IoCs
Processes:
SeroR0X1.exekysss.exepid process 3196 SeroR0X1.exe 4628 kysss.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
taskmgr.exepid process 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
kysss.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 4628 kysss.exe Token: SeDebugPrivilege 3152 taskmgr.exe Token: SeSystemProfilePrivilege 3152 taskmgr.exe Token: SeCreateGlobalPrivilege 3152 taskmgr.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
Processes:
taskmgr.exepid process 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe -
Suspicious use of SendNotifyMessage 36 IoCs
Processes:
taskmgr.exepid process 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
thesigma.exekysss.exedescription pid process target process PID 3352 wrote to memory of 3196 3352 thesigma.exe SeroR0X1.exe PID 3352 wrote to memory of 3196 3352 thesigma.exe SeroR0X1.exe PID 3352 wrote to memory of 4628 3352 thesigma.exe kysss.exe PID 3352 wrote to memory of 4628 3352 thesigma.exe kysss.exe PID 3352 wrote to memory of 4628 3352 thesigma.exe kysss.exe PID 4628 wrote to memory of 4564 4628 kysss.exe schtasks.exe PID 4628 wrote to memory of 4564 4628 kysss.exe schtasks.exe PID 4628 wrote to memory of 4564 4628 kysss.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\thesigma.exe"C:\Users\Admin\AppData\Local\Temp\thesigma.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SeroR0X1.exe"C:\Users\Admin\AppData\Local\SeroR0X1.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\kysss.exe"C:\Users\Admin\kysss.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "WindowsAudioHelper" /sc ONLOGON /tr "C:\Users\Admin\kysss.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\SeroR0X1.exeFilesize
1.2MB
MD5344e503504ab85f745091fc9b84e6da4
SHA11fdcb8c74f8b4cb9d2783446681e64b8dd0dd14a
SHA256c5ded6fd8541173abf2aee16808c2444249d92ad0cb2ed832087dc5fa57e7885
SHA512c20c7df32aff991a5da0b8446dc7c91f833747be147deb2f1c6e991cac9519e5f0933996c420b3402123021fdf58cf0bcfaf8f0fc4a5b6205bd63d08548aa667
-
C:\Users\Admin\kysss.exeFilesize
410KB
MD567bb0deed2d9593f08f90381b84d2b57
SHA1452c8d9c37d77552636e643087d282dd05764fce
SHA256c88480ebfa75fa6e61f2bfd801ead4d30f6e6c462d2a7331010b2fc0c935ed8a
SHA512aca90ddfad451c31bb38aec9b7eefdd0d1460fc69b2dbe865d29d75eb7c7f59850634b37074bd7701e5c951f079ed72273bfb21879d3dea2e8dfa42481e1e51e
-
memory/3152-67-0x00000260D2DD0000-0x00000260D2DD1000-memory.dmpFilesize
4KB
-
memory/3152-66-0x00000260D2DD0000-0x00000260D2DD1000-memory.dmpFilesize
4KB
-
memory/3152-64-0x00000260D2DD0000-0x00000260D2DD1000-memory.dmpFilesize
4KB
-
memory/3152-65-0x00000260D2DD0000-0x00000260D2DD1000-memory.dmpFilesize
4KB
-
memory/3152-63-0x00000260D2DD0000-0x00000260D2DD1000-memory.dmpFilesize
4KB
-
memory/3152-62-0x00000260D2DD0000-0x00000260D2DD1000-memory.dmpFilesize
4KB
-
memory/3152-61-0x00000260D2DD0000-0x00000260D2DD1000-memory.dmpFilesize
4KB
-
memory/3152-55-0x00000260D2DD0000-0x00000260D2DD1000-memory.dmpFilesize
4KB
-
memory/3152-56-0x00000260D2DD0000-0x00000260D2DD1000-memory.dmpFilesize
4KB
-
memory/3152-57-0x00000260D2DD0000-0x00000260D2DD1000-memory.dmpFilesize
4KB
-
memory/3196-53-0x0000020C9A480000-0x0000020C9A629000-memory.dmpFilesize
1.7MB
-
memory/3196-42-0x0000020C9A160000-0x0000020C9A170000-memory.dmpFilesize
64KB
-
memory/3196-40-0x0000020CFFA20000-0x0000020CFFB5E000-memory.dmpFilesize
1.2MB
-
memory/3196-54-0x00007FFB61930000-0x00007FFB623F1000-memory.dmpFilesize
10.8MB
-
memory/3196-41-0x00007FFB61930000-0x00007FFB623F1000-memory.dmpFilesize
10.8MB
-
memory/4628-48-0x00000000056D0000-0x0000000005736000-memory.dmpFilesize
408KB
-
memory/4628-47-0x0000000005640000-0x0000000005650000-memory.dmpFilesize
64KB
-
memory/4628-46-0x0000000005770000-0x0000000005802000-memory.dmpFilesize
584KB
-
memory/4628-45-0x0000000073EC0000-0x0000000074670000-memory.dmpFilesize
7.7MB
-
memory/4628-44-0x0000000005C80000-0x0000000006224000-memory.dmpFilesize
5.6MB
-
memory/4628-51-0x0000000006BC0000-0x0000000006BCA000-memory.dmpFilesize
40KB
-
memory/4628-43-0x0000000000D40000-0x0000000000DAC000-memory.dmpFilesize
432KB
-
memory/4628-49-0x0000000005C10000-0x0000000005C22000-memory.dmpFilesize
72KB
-
memory/4628-50-0x0000000006A10000-0x0000000006A4C000-memory.dmpFilesize
240KB
-
memory/4628-70-0x0000000073EC0000-0x0000000074670000-memory.dmpFilesize
7.7MB
-
memory/4628-71-0x0000000005640000-0x0000000005650000-memory.dmpFilesize
64KB
-
memory/4628-72-0x0000000073EC0000-0x0000000074670000-memory.dmpFilesize
7.7MB