Analysis
-
max time kernel
36s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 20:58
Behavioral task
behavioral1
Sample
python-3.12.3-amd64_protected.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
python-3.12.3-amd64_protected.exe
Resource
win10v2004-20240508-en
General
-
Target
python-3.12.3-amd64_protected.exe
-
Size
8.6MB
-
MD5
328626049b23e7d5fbe12f9503853d53
-
SHA1
402ca69107944196f421a16ce3be363a0f4e991c
-
SHA256
96eb67eaf4d600885d149701f7b720f004a1646775a179e77e8706762405e921
-
SHA512
5425ef358018a66977e711bfa2a794c725bd153df5989cae52419115c981ce94cc15b6ae826c42d786aa3363151d9c051ae53407ab5e07fcc7365ef054b03c91
-
SSDEEP
196608:VGjSZs4BJq1Ey1FJrMwM/RAWOY+3uWjNyWte7c:VXZsI0F5MYYjWjM7c
Malware Config
Extracted
quasar
1.4.1
Python
5.39.43.50:1488
393fbc9d-531f-4025-b3f0-bed4d56f6ed3
-
encryption_key
1E01F0D74E189002EDB2FABC8EC064751C9D7A63
-
install_name
Python.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Python3
-
subdirectory
Python3
Signatures
-
Quasar payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3032-11-0x0000000000400000-0x0000000001A14000-memory.dmp family_quasar behavioral2/memory/3032-12-0x0000000000400000-0x0000000001A14000-memory.dmp family_quasar behavioral2/memory/3032-24-0x0000000000400000-0x0000000001A14000-memory.dmp family_quasar behavioral2/memory/1324-27-0x0000000000400000-0x0000000001A14000-memory.dmp family_quasar behavioral2/memory/1324-28-0x0000000000400000-0x0000000001A14000-memory.dmp family_quasar -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
python-3.12.3-amd64_protected.exePython.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ python-3.12.3-amd64_protected.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Python.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
python-3.12.3-amd64_protected.exePython.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion python-3.12.3-amd64_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion python-3.12.3-amd64_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Python.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Python.exe -
Executes dropped EXE 1 IoCs
Processes:
Python.exepid process 1324 Python.exe -
Processes:
resource yara_rule behavioral2/memory/3032-11-0x0000000000400000-0x0000000001A14000-memory.dmp themida behavioral2/memory/3032-12-0x0000000000400000-0x0000000001A14000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Python3\Python.exe themida behavioral2/memory/3032-24-0x0000000000400000-0x0000000001A14000-memory.dmp themida behavioral2/memory/1324-27-0x0000000000400000-0x0000000001A14000-memory.dmp themida behavioral2/memory/1324-28-0x0000000000400000-0x0000000001A14000-memory.dmp themida -
Processes:
Python.exepython-3.12.3-amd64_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Python.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA python-3.12.3-amd64_protected.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
python-3.12.3-amd64_protected.exePython.exepid process 3032 python-3.12.3-amd64_protected.exe 1324 Python.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1968 schtasks.exe 1836 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
python-3.12.3-amd64_protected.exePython.exepid process 3032 python-3.12.3-amd64_protected.exe 3032 python-3.12.3-amd64_protected.exe 1324 Python.exe 1324 Python.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
python-3.12.3-amd64_protected.exePython.exedescription pid process Token: SeDebugPrivilege 3032 python-3.12.3-amd64_protected.exe Token: SeDebugPrivilege 1324 Python.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Python.exepid process 1324 Python.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
python-3.12.3-amd64_protected.exePython.exedescription pid process target process PID 3032 wrote to memory of 1968 3032 python-3.12.3-amd64_protected.exe schtasks.exe PID 3032 wrote to memory of 1968 3032 python-3.12.3-amd64_protected.exe schtasks.exe PID 3032 wrote to memory of 1968 3032 python-3.12.3-amd64_protected.exe schtasks.exe PID 3032 wrote to memory of 1324 3032 python-3.12.3-amd64_protected.exe Python.exe PID 3032 wrote to memory of 1324 3032 python-3.12.3-amd64_protected.exe Python.exe PID 3032 wrote to memory of 1324 3032 python-3.12.3-amd64_protected.exe Python.exe PID 1324 wrote to memory of 1836 1324 Python.exe schtasks.exe PID 1324 wrote to memory of 1836 1324 Python.exe schtasks.exe PID 1324 wrote to memory of 1836 1324 Python.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\python-3.12.3-amd64_protected.exe"C:\Users\Admin\AppData\Local\Temp\python-3.12.3-amd64_protected.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Python3" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Python3\Python.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Python3\Python.exe"C:\Users\Admin\AppData\Roaming\Python3\Python.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Python3" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Python3\Python.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Python3\Python.exeFilesize
8.6MB
MD5328626049b23e7d5fbe12f9503853d53
SHA1402ca69107944196f421a16ce3be363a0f4e991c
SHA25696eb67eaf4d600885d149701f7b720f004a1646775a179e77e8706762405e921
SHA5125425ef358018a66977e711bfa2a794c725bd153df5989cae52419115c981ce94cc15b6ae826c42d786aa3363151d9c051ae53407ab5e07fcc7365ef054b03c91
-
memory/1324-39-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB
-
memory/1324-36-0x0000000008390000-0x00000000083F6000-memory.dmpFilesize
408KB
-
memory/1324-35-0x0000000008330000-0x000000000836C000-memory.dmpFilesize
240KB
-
memory/1324-34-0x0000000008310000-0x0000000008322000-memory.dmpFilesize
72KB
-
memory/1324-31-0x00000000077A0000-0x0000000007852000-memory.dmpFilesize
712KB
-
memory/1324-30-0x00000000075A0000-0x00000000075F0000-memory.dmpFilesize
320KB
-
memory/1324-29-0x0000000006E10000-0x0000000007428000-memory.dmpFilesize
6.1MB
-
memory/1324-28-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB
-
memory/1324-27-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB
-
memory/1324-23-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB
-
memory/3032-7-0x00000000757C0000-0x00000000758B0000-memory.dmpFilesize
960KB
-
memory/3032-8-0x00000000757C0000-0x00000000758B0000-memory.dmpFilesize
960KB
-
memory/3032-14-0x0000000006680000-0x0000000006712000-memory.dmpFilesize
584KB
-
memory/3032-15-0x0000000006770000-0x000000000677A000-memory.dmpFilesize
40KB
-
memory/3032-12-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB
-
memory/3032-22-0x00000000757C0000-0x00000000758B0000-memory.dmpFilesize
960KB
-
memory/3032-11-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB
-
memory/3032-24-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB
-
memory/3032-9-0x00000000757C0000-0x00000000758B0000-memory.dmpFilesize
960KB
-
memory/3032-13-0x0000000006070000-0x0000000006614000-memory.dmpFilesize
5.6MB
-
memory/3032-0-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB
-
memory/3032-6-0x00000000757C0000-0x00000000758B0000-memory.dmpFilesize
960KB
-
memory/3032-5-0x00000000757C0000-0x00000000758B0000-memory.dmpFilesize
960KB
-
memory/3032-2-0x00000000757C0000-0x00000000758B0000-memory.dmpFilesize
960KB
-
memory/3032-1-0x00000000757E0000-0x00000000757E1000-memory.dmpFilesize
4KB
-
memory/3032-4-0x00000000757C0000-0x00000000758B0000-memory.dmpFilesize
960KB
-
memory/3032-3-0x00000000757C0000-0x00000000758B0000-memory.dmpFilesize
960KB