Analysis
-
max time kernel
475s -
max time network
475s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
19-05-2024 20:58
Behavioral task
behavioral1
Sample
python-3.12.3-amd64_protected.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
python-3.12.3-amd64_protected.exe
Resource
win10v2004-20240508-en
General
-
Target
python-3.12.3-amd64_protected.exe
-
Size
8.6MB
-
MD5
328626049b23e7d5fbe12f9503853d53
-
SHA1
402ca69107944196f421a16ce3be363a0f4e991c
-
SHA256
96eb67eaf4d600885d149701f7b720f004a1646775a179e77e8706762405e921
-
SHA512
5425ef358018a66977e711bfa2a794c725bd153df5989cae52419115c981ce94cc15b6ae826c42d786aa3363151d9c051ae53407ab5e07fcc7365ef054b03c91
-
SSDEEP
196608:VGjSZs4BJq1Ey1FJrMwM/RAWOY+3uWjNyWte7c:VXZsI0F5MYYjWjM7c
Malware Config
Extracted
quasar
1.4.1
Python
5.39.43.50:1488
393fbc9d-531f-4025-b3f0-bed4d56f6ed3
-
encryption_key
1E01F0D74E189002EDB2FABC8EC064751C9D7A63
-
install_name
Python.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Python3
-
subdirectory
Python3
Signatures
-
Quasar payload 5 IoCs
Processes:
resource yara_rule behavioral3/memory/1352-6-0x0000000000400000-0x0000000001A14000-memory.dmp family_quasar behavioral3/memory/1352-7-0x0000000000400000-0x0000000001A14000-memory.dmp family_quasar behavioral3/memory/1352-18-0x0000000000400000-0x0000000001A14000-memory.dmp family_quasar behavioral3/memory/3952-22-0x0000000000400000-0x0000000001A14000-memory.dmp family_quasar behavioral3/memory/3952-23-0x0000000000400000-0x0000000001A14000-memory.dmp family_quasar -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
python-3.12.3-amd64_protected.exePython.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ python-3.12.3-amd64_protected.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Python.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
python-3.12.3-amd64_protected.exePython.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion python-3.12.3-amd64_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion python-3.12.3-amd64_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Python.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Python.exe -
Executes dropped EXE 1 IoCs
Processes:
Python.exepid process 3952 Python.exe -
Processes:
resource yara_rule behavioral3/memory/1352-6-0x0000000000400000-0x0000000001A14000-memory.dmp themida behavioral3/memory/1352-7-0x0000000000400000-0x0000000001A14000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Python3\Python.exe themida behavioral3/memory/1352-18-0x0000000000400000-0x0000000001A14000-memory.dmp themida behavioral3/memory/3952-22-0x0000000000400000-0x0000000001A14000-memory.dmp themida behavioral3/memory/3952-23-0x0000000000400000-0x0000000001A14000-memory.dmp themida -
Processes:
Python.exepython-3.12.3-amd64_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Python.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA python-3.12.3-amd64_protected.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
python-3.12.3-amd64_protected.exePython.exepid process 1352 python-3.12.3-amd64_protected.exe 3952 Python.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1728 schtasks.exe 3644 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
python-3.12.3-amd64_protected.exePython.exepid process 1352 python-3.12.3-amd64_protected.exe 1352 python-3.12.3-amd64_protected.exe 3952 Python.exe 3952 Python.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
python-3.12.3-amd64_protected.exePython.exedescription pid process Token: SeDebugPrivilege 1352 python-3.12.3-amd64_protected.exe Token: SeDebugPrivilege 3952 Python.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Python.exepid process 3952 Python.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
python-3.12.3-amd64_protected.exePython.exedescription pid process target process PID 1352 wrote to memory of 1728 1352 python-3.12.3-amd64_protected.exe schtasks.exe PID 1352 wrote to memory of 1728 1352 python-3.12.3-amd64_protected.exe schtasks.exe PID 1352 wrote to memory of 1728 1352 python-3.12.3-amd64_protected.exe schtasks.exe PID 1352 wrote to memory of 3952 1352 python-3.12.3-amd64_protected.exe Python.exe PID 1352 wrote to memory of 3952 1352 python-3.12.3-amd64_protected.exe Python.exe PID 1352 wrote to memory of 3952 1352 python-3.12.3-amd64_protected.exe Python.exe PID 3952 wrote to memory of 3644 3952 Python.exe schtasks.exe PID 3952 wrote to memory of 3644 3952 Python.exe schtasks.exe PID 3952 wrote to memory of 3644 3952 Python.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\python-3.12.3-amd64_protected.exe"C:\Users\Admin\AppData\Local\Temp\python-3.12.3-amd64_protected.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Python3" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Python3\Python.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:1728 -
C:\Users\Admin\AppData\Roaming\Python3\Python.exe"C:\Users\Admin\AppData\Roaming\Python3\Python.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Python3" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Python3\Python.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:3644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Python3\Python.exeFilesize
8.6MB
MD5328626049b23e7d5fbe12f9503853d53
SHA1402ca69107944196f421a16ce3be363a0f4e991c
SHA25696eb67eaf4d600885d149701f7b720f004a1646775a179e77e8706762405e921
SHA5125425ef358018a66977e711bfa2a794c725bd153df5989cae52419115c981ce94cc15b6ae826c42d786aa3363151d9c051ae53407ab5e07fcc7365ef054b03c91
-
memory/1352-18-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB
-
memory/1352-1-0x0000000077236000-0x0000000077237000-memory.dmpFilesize
4KB
-
memory/1352-0-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB
-
memory/1352-4-0x0000000077220000-0x0000000077310000-memory.dmpFilesize
960KB
-
memory/1352-6-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB
-
memory/1352-7-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB
-
memory/1352-8-0x0000000006140000-0x00000000066E6000-memory.dmpFilesize
5.6MB
-
memory/1352-9-0x0000000006040000-0x00000000060D2000-memory.dmpFilesize
584KB
-
memory/1352-10-0x00000000066F0000-0x00000000066FA000-memory.dmpFilesize
40KB
-
memory/1352-19-0x0000000077220000-0x0000000077310000-memory.dmpFilesize
960KB
-
memory/1352-3-0x0000000077220000-0x0000000077310000-memory.dmpFilesize
960KB
-
memory/1352-2-0x0000000077220000-0x0000000077310000-memory.dmpFilesize
960KB
-
memory/3952-38-0x0000000008BC0000-0x00000000090EC000-memory.dmpFilesize
5.2MB
-
memory/3952-22-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB
-
memory/3952-23-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB
-
memory/3952-24-0x0000000006ED0000-0x00000000074E8000-memory.dmpFilesize
6.1MB
-
memory/3952-25-0x0000000007660000-0x00000000076B0000-memory.dmpFilesize
320KB
-
memory/3952-26-0x0000000007860000-0x0000000007912000-memory.dmpFilesize
712KB
-
memory/3952-29-0x00000000083E0000-0x00000000083F2000-memory.dmpFilesize
72KB
-
memory/3952-30-0x0000000008400000-0x000000000843C000-memory.dmpFilesize
240KB
-
memory/3952-31-0x0000000008480000-0x00000000084E6000-memory.dmpFilesize
408KB
-
memory/3952-34-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB
-
memory/3952-17-0x0000000000400000-0x0000000001A14000-memory.dmpFilesize
22.1MB