Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
19-05-2024 16:44
General
-
Target
setup.exe
-
Size
3.1MB
-
MD5
85f1c33bca15aed885f2a211c7a16ace
-
SHA1
4ca79b4c8e8d6a3e7023d94f98c8c4d53e363934
-
SHA256
f6cb09e109a5cbcd9286b293464ee0fa8ca4a846ccc59b0dfa53c114d74b1093
-
SHA512
c319cc1cbd39bc1508288f357c4f7fd9fa907fa5d4377f6b7b9e37e3a76e91fcbf62d989b27019a47c95ee51895a794fb5eb5c6c19a639e2636d4eb8f22f6651
-
SSDEEP
49152:WvyI22SsaNYfdPBldt698dBcjHRmDkE2HNk/+FVoGdvVTHHB72eh2NT:Wvf22SsaNYfdPBldt6+dBcjHRmD2X
Malware Config
Extracted
quasar
1.4.1
Office04
86.9.95.137:4782
d09b8b98-ea9c-49d4-bfd3-04dda7a80cde
-
encryption_key
F26B2A96E9FB88BAB8A8E7F9F9A1630733DE7809
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
windows defender
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4516-1-0x0000000000030000-0x0000000000354000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Client.exepid process 3148 Client.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3996 schtasks.exe 248 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
setup.exeClient.exedescription pid process Token: SeDebugPrivilege 4516 setup.exe Token: SeDebugPrivilege 3148 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 3148 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
setup.exeClient.exedescription pid process target process PID 4516 wrote to memory of 3996 4516 setup.exe schtasks.exe PID 4516 wrote to memory of 3996 4516 setup.exe schtasks.exe PID 4516 wrote to memory of 3148 4516 setup.exe Client.exe PID 4516 wrote to memory of 3148 4516 setup.exe Client.exe PID 3148 wrote to memory of 248 3148 Client.exe schtasks.exe PID 3148 wrote to memory of 248 3148 Client.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
3.1MB
MD585f1c33bca15aed885f2a211c7a16ace
SHA14ca79b4c8e8d6a3e7023d94f98c8c4d53e363934
SHA256f6cb09e109a5cbcd9286b293464ee0fa8ca4a846ccc59b0dfa53c114d74b1093
SHA512c319cc1cbd39bc1508288f357c4f7fd9fa907fa5d4377f6b7b9e37e3a76e91fcbf62d989b27019a47c95ee51895a794fb5eb5c6c19a639e2636d4eb8f22f6651
-
memory/3148-10-0x00007FF991AE0000-0x00007FF9925A2000-memory.dmpFilesize
10.8MB
-
memory/3148-11-0x00007FF991AE0000-0x00007FF9925A2000-memory.dmpFilesize
10.8MB
-
memory/3148-12-0x000000001BB90000-0x000000001BBE0000-memory.dmpFilesize
320KB
-
memory/3148-13-0x000000001BCA0000-0x000000001BD52000-memory.dmpFilesize
712KB
-
memory/3148-14-0x00007FF991AE0000-0x00007FF9925A2000-memory.dmpFilesize
10.8MB
-
memory/4516-0-0x00007FF991AE3000-0x00007FF991AE5000-memory.dmpFilesize
8KB
-
memory/4516-1-0x0000000000030000-0x0000000000354000-memory.dmpFilesize
3.1MB
-
memory/4516-2-0x00007FF991AE0000-0x00007FF9925A2000-memory.dmpFilesize
10.8MB
-
memory/4516-9-0x00007FF991AE0000-0x00007FF9925A2000-memory.dmpFilesize
10.8MB