Analysis
- max time kernel
94s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system - submitted
26/04/2024, 00:30
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
General
- Target Client-built.exe
- Size 3.1MB
- Sample240426-atfleagd7v
- SHA256 e1bd4290607c1885cd99f16d0fd3112b2931e612a3fdc23602717c3db012dfee
- MD5 0c0a0bc051250b85c601d58c925b1f45
- SHA1 7d1370fdd44a132865f226b22b42a20c4172a0b8
- SHA512 fc33a361f49d7b483185faa6863700e1e9c0d6b6452f85ea204afd90ceaed33bce746175e963c75f53ab7d82bc2ac078d044e6264207d55b8bdc805cc8c2d6e4
- SSDEEP 49152:jvvhBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkaUtmxmzqsoGdXTHHB72eh2NT:jvft2d5aKCuVPzlEmVQ0wvwfUtmg
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
OFODAO
C2
-
189.113.231.124:4782
-
10.0.2.15:4782
Mutex
-
4a726bec-d78d-49e4-b453-cb5acd0797e1
Attributes
-
encryption_key
7B9DD822D12312D739AA1F129C097ADB0902AA19
-
install_name
Alliance-AIM.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/4328-0-0x0000000000450000-0x0000000000774000-memory.dmp family_quasar behavioral2/files/0x0008000000023421-8.dat family_quasar - Executes dropped EXE 1 IoCs
pid Process 3728 Alliance-AIM.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\system32\SubDir\Alliance-AIM.exe Client-built.exe File opened for modification C:\Windows\system32\SubDir\Alliance-AIM.exe Client-built.exe File opened for modification C:\Windows\system32\SubDir Client-built.exe File opened for modification C:\Windows\system32\SubDir\Alliance-AIM.exe Alliance-AIM.exe File opened for modification C:\Windows\system32\SubDir Alliance-AIM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 6 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 8 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4328 Client-built.exe Token: SeDebugPrivilege 3728 Alliance-AIM.exe Token: SeDebugPrivilege 8 taskmgr.exe Token: SeSystemProfilePrivilege 8 taskmgr.exe Token: SeCreateGlobalPrivilege 8 taskmgr.exe Token: 33 8 taskmgr.exe Token: SeIncBasePriorityPrivilege 8 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3728 Alliance-AIM.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3728 Alliance-AIM.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe 8 taskmgr.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4328 wrote to memory of 3728 4328 Client-built.exe 88 PID 4328 wrote to memory of 3728 4328 Client-built.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\system32\SubDir\Alliance-AIM.exe"C:\Windows\system32\SubDir\Alliance-AIM.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3728
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2348
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:8
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\system32\SubDir\Alliance-AIM.exe
- Size 3.1MB
- SHA256 e1bd4290607c1885cd99f16d0fd3112b2931e612a3fdc23602717c3db012dfee
- MD5 0c0a0bc051250b85c601d58c925b1f45
- SHA1 7d1370fdd44a132865f226b22b42a20c4172a0b8
- SHA512 fc33a361f49d7b483185faa6863700e1e9c0d6b6452f85ea204afd90ceaed33bce746175e963c75f53ab7d82bc2ac078d044e6264207d55b8bdc805cc8c2d6e4
- SSDEEP 49152:jvvhBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkaUtmxmzqsoGdXTHHB72eh2NT:jvft2d5aKCuVPzlEmVQ0wvwfUtmg
- MD5 SHA1 SHA512 SSDEEP