Analysis
-
max time kernel
1198s -
max time network
1199s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-05-2024 00:51
Behavioral task
behavioral1
Sample
Unify.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Unify.exe
Resource
win10v2004-20240419-en
General
-
Target
Unify.exe
-
Size
409KB
-
MD5
54db32b9d5cab2c1dea1907cf4712b1d
-
SHA1
812f28828735a92effd2187e155d9ed3f0e915b3
-
SHA256
e7d8e1b13c833d49fcc46a03d34ff18b7c93bd86bd0764828fa68d3d9eed2bbe
-
SHA512
6a13febe964f3f639e7d017f58c2f6631c18bea5a1ac716efa49a1c5306ecd2708cf92f133a9fcd8dc22850e661522a98f23c0fb7cb09752bb96a6d50bb69163
-
SSDEEP
6144:0MP9p1kREG60olVji9QzNg/IiSjFqBFK6WbMN6Y44vZqJBWAb7yMTj:fpiREGJ2ji9QyAhK/N6gBqJBj7yMTj
Malware Config
Extracted
quasar
3.1.5
Slave
192.168.1.20:4782
localhost:4782
$Sxr-3vDee7FzoJnhqjuE3n
-
encryption_key
hwZQsCIcvotNKosjYueb
-
install_name
$srr-powershell.exe
-
log_directory
Logs
-
reconnect_delay
1000
-
startup_key
$srr-mstha
-
subdirectory
Windows
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2664-1-0x0000000000C80000-0x0000000000CEC000-memory.dmp family_quasar \Users\Admin\AppData\Roaming\Windows\$srr-powershell.exe family_quasar behavioral1/memory/2460-10-0x00000000000C0000-0x000000000012C000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
$srr-powershell.exepid process 2460 $srr-powershell.exe -
Loads dropped DLL 1 IoCs
Processes:
Unify.exepid process 2664 Unify.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ip-api.com -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeSCHTASKS.exeschtasks.exepid process 2448 schtasks.exe 2384 SCHTASKS.exe 2488 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Unify.exe$srr-powershell.exedescription pid process Token: SeDebugPrivilege 2664 Unify.exe Token: SeDebugPrivilege 2460 $srr-powershell.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Unify.exe$srr-powershell.exedescription pid process target process PID 2664 wrote to memory of 2488 2664 Unify.exe schtasks.exe PID 2664 wrote to memory of 2488 2664 Unify.exe schtasks.exe PID 2664 wrote to memory of 2488 2664 Unify.exe schtasks.exe PID 2664 wrote to memory of 2488 2664 Unify.exe schtasks.exe PID 2664 wrote to memory of 2460 2664 Unify.exe $srr-powershell.exe PID 2664 wrote to memory of 2460 2664 Unify.exe $srr-powershell.exe PID 2664 wrote to memory of 2460 2664 Unify.exe $srr-powershell.exe PID 2664 wrote to memory of 2460 2664 Unify.exe $srr-powershell.exe PID 2460 wrote to memory of 2448 2460 $srr-powershell.exe schtasks.exe PID 2460 wrote to memory of 2448 2460 $srr-powershell.exe schtasks.exe PID 2460 wrote to memory of 2448 2460 $srr-powershell.exe schtasks.exe PID 2460 wrote to memory of 2448 2460 $srr-powershell.exe schtasks.exe PID 2664 wrote to memory of 2384 2664 Unify.exe SCHTASKS.exe PID 2664 wrote to memory of 2384 2664 Unify.exe SCHTASKS.exe PID 2664 wrote to memory of 2384 2664 Unify.exe SCHTASKS.exe PID 2664 wrote to memory of 2384 2664 Unify.exe SCHTASKS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Unify.exe"C:\Users\Admin\AppData\Local\Temp\Unify.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "$srr-mstha" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Unify.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Windows\$srr-powershell.exe"C:\Users\Admin\AppData\Roaming\Windows\$srr-powershell.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "$srr-mstha" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\$srr-powershell.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Unify.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Unify.exe'" /sc onlogon /rl HIGHEST2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\Windows\$srr-powershell.exeFilesize
409KB
MD554db32b9d5cab2c1dea1907cf4712b1d
SHA1812f28828735a92effd2187e155d9ed3f0e915b3
SHA256e7d8e1b13c833d49fcc46a03d34ff18b7c93bd86bd0764828fa68d3d9eed2bbe
SHA5126a13febe964f3f639e7d017f58c2f6631c18bea5a1ac716efa49a1c5306ecd2708cf92f133a9fcd8dc22850e661522a98f23c0fb7cb09752bb96a6d50bb69163
-
memory/2460-10-0x00000000000C0000-0x000000000012C000-memory.dmpFilesize
432KB
-
memory/2460-11-0x0000000074DF0000-0x00000000754DE000-memory.dmpFilesize
6.9MB
-
memory/2460-12-0x0000000074DF0000-0x00000000754DE000-memory.dmpFilesize
6.9MB
-
memory/2460-14-0x0000000074DF0000-0x00000000754DE000-memory.dmpFilesize
6.9MB
-
memory/2664-0-0x0000000074DFE000-0x0000000074DFF000-memory.dmpFilesize
4KB
-
memory/2664-1-0x0000000000C80000-0x0000000000CEC000-memory.dmpFilesize
432KB
-
memory/2664-2-0x0000000074DF0000-0x00000000754DE000-memory.dmpFilesize
6.9MB
-
memory/2664-13-0x0000000074DF0000-0x00000000754DE000-memory.dmpFilesize
6.9MB