Analysis
-
max time kernel
139s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 15:19
General
-
Target
Uni.exe
-
Size
409KB
-
MD5
7544e8e688461810abd5387160692c95
-
SHA1
bb41e11803d0da2fb7f6e2068220ddd3faf347c7
-
SHA256
6da2005775980d44d0a6f9d8f12d7394e8d81abf96f444a6c4da54c2376430a0
-
SHA512
09ffe73cc108762af47e68fb9f72ab37051cda10aec048cd9cb86c65c68696622bd7e24c12b0c07ebc2e8a0620865fc9a35b2ef34d48c3d8522d57cd672ec287
-
SSDEEP
6144:MMfPp5S6M1Xy0gmfnF8V0dguFJSSvbaU01T/yUhAd5GbdQNJ:Bpg6M1i9mfnFUEgctoLILGbdQf
Malware Config
Extracted
quasar
3.1.5
SeroXen
panel-slave.gl.at.ply.gg:57059
$Sxr-rpL8EItHN3pqIQQVy2
-
encryption_key
p81Z0Zy4AcToBvsDk4Li
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
SeroXen
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4256-1-0x0000000000550000-0x00000000005BC000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Client.exepid process 4348 Client.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 ip-api.com -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeSCHTASKS.exepid process 1476 schtasks.exe 3260 schtasks.exe 2836 SCHTASKS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Uni.exeClient.exedescription pid process Token: SeDebugPrivilege 4256 Uni.exe Token: SeDebugPrivilege 4348 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 4348 Client.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Uni.exeClient.exedescription pid process target process PID 4256 wrote to memory of 3260 4256 Uni.exe schtasks.exe PID 4256 wrote to memory of 3260 4256 Uni.exe schtasks.exe PID 4256 wrote to memory of 3260 4256 Uni.exe schtasks.exe PID 4256 wrote to memory of 4348 4256 Uni.exe Client.exe PID 4256 wrote to memory of 4348 4256 Uni.exe Client.exe PID 4256 wrote to memory of 4348 4256 Uni.exe Client.exe PID 4256 wrote to memory of 2836 4256 Uni.exe SCHTASKS.exe PID 4256 wrote to memory of 2836 4256 Uni.exe SCHTASKS.exe PID 4256 wrote to memory of 2836 4256 Uni.exe SCHTASKS.exe PID 4348 wrote to memory of 1476 4348 Client.exe schtasks.exe PID 4348 wrote to memory of 1476 4348 Client.exe schtasks.exe PID 4348 wrote to memory of 1476 4348 Client.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Uni.exe"C:\Users\Admin\AppData\Local\Temp\Uni.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Uni.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:3260 -
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:1476 -
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Uni.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Uni.exe'" /sc onlogon /rl HIGHEST2⤵
- Creates scheduled task(s)
PID:2836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
409KB
MD57544e8e688461810abd5387160692c95
SHA1bb41e11803d0da2fb7f6e2068220ddd3faf347c7
SHA2566da2005775980d44d0a6f9d8f12d7394e8d81abf96f444a6c4da54c2376430a0
SHA51209ffe73cc108762af47e68fb9f72ab37051cda10aec048cd9cb86c65c68696622bd7e24c12b0c07ebc2e8a0620865fc9a35b2ef34d48c3d8522d57cd672ec287
-
memory/4256-6-0x0000000005CF0000-0x0000000005D02000-memory.dmpFilesize
72KB
-
memory/4256-1-0x0000000000550000-0x00000000005BC000-memory.dmpFilesize
432KB
-
memory/4256-3-0x0000000004FC0000-0x0000000005052000-memory.dmpFilesize
584KB
-
memory/4256-4-0x0000000075090000-0x0000000075840000-memory.dmpFilesize
7.7MB
-
memory/4256-5-0x0000000005070000-0x00000000050D6000-memory.dmpFilesize
408KB
-
memory/4256-0-0x000000007509E000-0x000000007509F000-memory.dmpFilesize
4KB
-
memory/4256-7-0x0000000006230000-0x000000000626C000-memory.dmpFilesize
240KB
-
memory/4256-2-0x0000000005620000-0x0000000005BC4000-memory.dmpFilesize
5.6MB
-
memory/4256-16-0x0000000075090000-0x0000000075840000-memory.dmpFilesize
7.7MB
-
memory/4348-14-0x0000000075090000-0x0000000075840000-memory.dmpFilesize
7.7MB
-
memory/4348-13-0x0000000075090000-0x0000000075840000-memory.dmpFilesize
7.7MB
-
memory/4348-17-0x0000000006950000-0x000000000695A000-memory.dmpFilesize
40KB
-
memory/4348-19-0x0000000075090000-0x0000000075840000-memory.dmpFilesize
7.7MB
-
memory/4348-20-0x0000000075090000-0x0000000075840000-memory.dmpFilesize
7.7MB