Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 18:28
Behavioral task
behavioral1
Sample
SynapseXLauncher.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SynapseXLauncher.exe
Resource
win10v2004-20240426-en
General
-
Target
SynapseXLauncher.exe
-
Size
3.1MB
-
MD5
1a1fda92143e414b4d4153ab05dd1ce8
-
SHA1
33ac2b2d228a1ec93b0ea70ffadb436933b9a1e5
-
SHA256
f0160a1f7a39862e14063ac468957559656405f51d97ad56dc7cff9ad34da9f1
-
SHA512
70a9a6948f98f3bdc2c7b461634098347bdf683dec36fa92bd1ac652f72daf7fa01f842cbb8331f26c9c5f76907604f75f7c45b746bcfe8f395b3864f998f391
-
SSDEEP
49152:VvnI22SsaNYfdPBldt698dBcjHOaRJ6HbR3LoGddPkTHHB72eh2NT:VvI22SsaNYfdPBldt6+dBcjHOaRJ6Zd
Malware Config
Extracted
quasar
1.4.1
Windows Update
skbidiooiilet-31205.portmap.host:31205
7357b58d-e5d4-42be-8b74-db6eee6cde6d
-
encryption_key
6F721445F7E0B1CF58980D84A9D49F4458D4EFD9
-
install_name
Update.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
WindowsUpdate
-
subdirectory
Windows Update
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1248-1-0x0000000000C90000-0x0000000000FB4000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\Windows Update\Update.exe family_quasar behavioral1/memory/2520-10-0x0000000000150000-0x0000000000474000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Update.exepid process 2520 Update.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2020 schtasks.exe 2796 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SynapseXLauncher.exeUpdate.exedescription pid process Token: SeDebugPrivilege 1248 SynapseXLauncher.exe Token: SeDebugPrivilege 2520 Update.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
SynapseXLauncher.exeUpdate.exedescription pid process target process PID 1248 wrote to memory of 2020 1248 SynapseXLauncher.exe schtasks.exe PID 1248 wrote to memory of 2020 1248 SynapseXLauncher.exe schtasks.exe PID 1248 wrote to memory of 2020 1248 SynapseXLauncher.exe schtasks.exe PID 1248 wrote to memory of 2520 1248 SynapseXLauncher.exe Update.exe PID 1248 wrote to memory of 2520 1248 SynapseXLauncher.exe Update.exe PID 1248 wrote to memory of 2520 1248 SynapseXLauncher.exe Update.exe PID 2520 wrote to memory of 2796 2520 Update.exe schtasks.exe PID 2520 wrote to memory of 2796 2520 Update.exe schtasks.exe PID 2520 wrote to memory of 2796 2520 Update.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SynapseXLauncher.exe"C:\Users\Admin\AppData\Local\Temp\SynapseXLauncher.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Update\Update.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Windows Update\Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update\Update.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Update\Update.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Windows Update\Update.exeFilesize
3.1MB
MD51a1fda92143e414b4d4153ab05dd1ce8
SHA133ac2b2d228a1ec93b0ea70ffadb436933b9a1e5
SHA256f0160a1f7a39862e14063ac468957559656405f51d97ad56dc7cff9ad34da9f1
SHA51270a9a6948f98f3bdc2c7b461634098347bdf683dec36fa92bd1ac652f72daf7fa01f842cbb8331f26c9c5f76907604f75f7c45b746bcfe8f395b3864f998f391
-
memory/1248-0-0x000007FEF5CB3000-0x000007FEF5CB4000-memory.dmpFilesize
4KB
-
memory/1248-1-0x0000000000C90000-0x0000000000FB4000-memory.dmpFilesize
3.1MB
-
memory/1248-2-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmpFilesize
9.9MB
-
memory/1248-9-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmpFilesize
9.9MB
-
memory/2520-8-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmpFilesize
9.9MB
-
memory/2520-10-0x0000000000150000-0x0000000000474000-memory.dmpFilesize
3.1MB
-
memory/2520-11-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmpFilesize
9.9MB
-
memory/2520-12-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmpFilesize
9.9MB