Analysis
- max time kernel
88s - max time network
88s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 09:38
Behavioral task
behavioral1
Sample
InfinityBETA.V2.exe
Resource
win7-20240508-en
windows7-x64
10 signatures
150 seconds
General
- Target InfinityBETA.V2.exe
- Size 3.1MB
- Sample240518-ll2dpadf32
- SHA256 4b857bc454edef7fa460fecb36f676fa38bab8b3304f3f07d12b9777fa0b68cb
- MD5 1b84762faebd8469f686f703cbaef7b9
- SHA1 41e135a8a2a9525e09a2303055430e36d95780cd
- SHA512 da9482a2ef6fbe659afff4c5a0d1911145bb93be47dd5a714e4e1c24802f1e9d9669f5a209665a7da752e56d2c82c41e48c5bd951d26a2cd763fc8a62d4e703c
- SSDEEP 49152:PvylL26AaNeWgPhlmVqvMQ7XSKO1RboGreTHHB72eh2NT:PvqL26AaNeWgPhlmVqkQ7XSKO1l
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
PoofNRico
C2
-
nahchris-49021.portmap.host:49021
Mutex
-
1a5d095f-2c59-4b3f-b053-5bd928b2e541
Attributes
-
encryption_key
ADBAB4BC16998E7E1913E54C27829FE47C72BE6D
-
install_name
PlutoBETAv2.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
DiscordUpdater.exe
-
subdirectory
PlutoBETAv2
Signatures
- Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/3208-1-0x00000000007F0000-0x0000000000B14000-memory.dmp family_quasar behavioral2/files/0x0007000000023400-5.dat family_quasar - Executes dropped EXE 1 IoCs
pid Process 752 PlutoBETAv2.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1716 schtasks.exe 3036 schtasks.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3208 InfinityBETA.V2.exe Token: SeDebugPrivilege 752 PlutoBETAv2.exe Token: SeDebugPrivilege 2336 taskmgr.exe Token: SeSystemProfilePrivilege 2336 taskmgr.exe Token: SeCreateGlobalPrivilege 2336 taskmgr.exe Token: SeBackupPrivilege 1016 svchost.exe Token: SeRestorePrivilege 1016 svchost.exe Token: SeSecurityPrivilege 1016 svchost.exe Token: SeTakeOwnershipPrivilege 1016 svchost.exe Token: 35 1016 svchost.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 752 PlutoBETAv2.exe 752 PlutoBETAv2.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 752 PlutoBETAv2.exe 752 PlutoBETAv2.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe 2336 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 752 PlutoBETAv2.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3208 wrote to memory of 1716 3208 InfinityBETA.V2.exe 83 PID 3208 wrote to memory of 1716 3208 InfinityBETA.V2.exe 83 PID 3208 wrote to memory of 752 3208 InfinityBETA.V2.exe 86 PID 3208 wrote to memory of 752 3208 InfinityBETA.V2.exe 86 PID 752 wrote to memory of 3036 752 PlutoBETAv2.exe 88 PID 752 wrote to memory of 3036 752 PlutoBETAv2.exe 88 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\InfinityBETA.V2.exe"C:\Users\Admin\AppData\Local\Temp\InfinityBETA.V2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "DiscordUpdater.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\PlutoBETAv2\PlutoBETAv2.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:1716
-
-
C:\Users\Admin\AppData\Roaming\PlutoBETAv2\PlutoBETAv2.exe"C:\Users\Admin\AppData\Roaming\PlutoBETAv2\PlutoBETAv2.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "DiscordUpdater.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\PlutoBETAv2\PlutoBETAv2.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:3036
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2336
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4888
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\PlutoBETAv2\PlutoBETAv2.exe
- Size 3.1MB
- SHA256 4b857bc454edef7fa460fecb36f676fa38bab8b3304f3f07d12b9777fa0b68cb
- MD5 1b84762faebd8469f686f703cbaef7b9
- SHA1 41e135a8a2a9525e09a2303055430e36d95780cd
- SHA512 da9482a2ef6fbe659afff4c5a0d1911145bb93be47dd5a714e4e1c24802f1e9d9669f5a209665a7da752e56d2c82c41e48c5bd951d26a2cd763fc8a62d4e703c
- SSDEEP 49152:PvylL26AaNeWgPhlmVqvMQ7XSKO1RboGreTHHB72eh2NT:PvqL26AaNeWgPhlmVqkQ7XSKO1l
- MD5 SHA1 SHA512 SSDEEP