Resubmissions
19-05-2024 20:07
240519-ywdftsff3z 10Analysis
-
max time kernel
2s -
max time network
3s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 20:07
Behavioral task
behavioral1
Sample
python-3.12.3-amd64.exe
Resource
win7-20240215-en
General
-
Target
python-3.12.3-amd64.exe
-
Size
3.1MB
-
MD5
73d6940261ca10935db227bc344dfc8f
-
SHA1
d98e8c5b877d69a1de46a1c9188358fe802fb056
-
SHA256
1b493ad1ab765e7f0509c8928a3466754f64ad5728f79139a66effcb38d5cb67
-
SHA512
1928e0702140694fc54cfae2e784a752650a5a92c7858c1bb460beca6e02fa7cf87e767793f04139abd9cf328a6eed56652de3c98c59e0f51d64ea6e6fd412a2
-
SSDEEP
49152:Cvkt62XlaSFNWPjljiFa2RoUYIPSRJ6ebR3LoGd7THHB72eh2NT:Cv462XlaSFNWPjljiFXRoUYIPSRJ6Y
Malware Config
Extracted
quasar
1.4.1
Python
5.39.43.50:1488
393fbc9d-531f-4025-b3f0-bed4d56f6ed3
-
encryption_key
1E01F0D74E189002EDB2FABC8EC064751C9D7A63
-
install_name
Python.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Python3
-
subdirectory
Python3
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2896-1-0x0000000000960000-0x0000000000C84000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\Python3\Python.exe family_quasar behavioral1/memory/2436-10-0x0000000000070000-0x0000000000394000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Python.exepid process 2436 Python.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2568 schtasks.exe 2592 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
python-3.12.3-amd64.exePython.exedescription pid process Token: SeDebugPrivilege 2896 python-3.12.3-amd64.exe Token: SeDebugPrivilege 2436 Python.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
python-3.12.3-amd64.exePython.exedescription pid process target process PID 2896 wrote to memory of 2568 2896 python-3.12.3-amd64.exe schtasks.exe PID 2896 wrote to memory of 2568 2896 python-3.12.3-amd64.exe schtasks.exe PID 2896 wrote to memory of 2568 2896 python-3.12.3-amd64.exe schtasks.exe PID 2896 wrote to memory of 2436 2896 python-3.12.3-amd64.exe Python.exe PID 2896 wrote to memory of 2436 2896 python-3.12.3-amd64.exe Python.exe PID 2896 wrote to memory of 2436 2896 python-3.12.3-amd64.exe Python.exe PID 2436 wrote to memory of 2592 2436 Python.exe schtasks.exe PID 2436 wrote to memory of 2592 2436 Python.exe schtasks.exe PID 2436 wrote to memory of 2592 2436 Python.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\python-3.12.3-amd64.exe"C:\Users\Admin\AppData\Local\Temp\python-3.12.3-amd64.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Python3" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Python3\Python.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Python3\Python.exe"C:\Users\Admin\AppData\Roaming\Python3\Python.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Python3" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Python3\Python.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Python3\Python.exeFilesize
3.1MB
MD573d6940261ca10935db227bc344dfc8f
SHA1d98e8c5b877d69a1de46a1c9188358fe802fb056
SHA2561b493ad1ab765e7f0509c8928a3466754f64ad5728f79139a66effcb38d5cb67
SHA5121928e0702140694fc54cfae2e784a752650a5a92c7858c1bb460beca6e02fa7cf87e767793f04139abd9cf328a6eed56652de3c98c59e0f51d64ea6e6fd412a2
-
memory/2436-9-0x000007FEF5F40000-0x000007FEF692C000-memory.dmpFilesize
9.9MB
-
memory/2436-10-0x0000000000070000-0x0000000000394000-memory.dmpFilesize
3.1MB
-
memory/2436-11-0x000007FEF5F40000-0x000007FEF692C000-memory.dmpFilesize
9.9MB
-
memory/2896-0-0x000007FEF5F43000-0x000007FEF5F44000-memory.dmpFilesize
4KB
-
memory/2896-1-0x0000000000960000-0x0000000000C84000-memory.dmpFilesize
3.1MB
-
memory/2896-2-0x000007FEF5F40000-0x000007FEF692C000-memory.dmpFilesize
9.9MB
-
memory/2896-8-0x000007FEF5F40000-0x000007FEF692C000-memory.dmpFilesize
9.9MB