Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 11:06
Behavioral task
behavioral1
Sample
test.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
test.exe
-
Size
3.1MB
-
MD5
700acd73a0f2f3e9372fe0e60f95576f
-
SHA1
efc3b03207b3e5a999d772fd7c11fb5b69977ebc
-
SHA256
10dfcd3ab03dcecb05d6f4b28dbd7a4070341783b8f5453b9af3bc6b9b77a104
-
SHA512
a390e1b463d658beb17d9bc21e9e77f00e1dbe6dd0fc134ba682343d3a90c5a6535999aebafd1e2bad5bc319fa92072bb5efabff49878bd06d1cfee030a9db75
-
SSDEEP
49152:3vGlL26AaNeWgPhlmVqvMQ7XSKpJxNESE7k/iTLoGdoPTHHB72eh2NT:3vGL26AaNeWgPhlmVqkQ7XSKHx+f4
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
bin-inspections.gl.at.ply.gg:64055
Mutex
536deaa9-57d2-448a-ae01-b604426d7fa6
Attributes
-
encryption_key
DBB529B3F56F6D23695F8D7AC9BA28484A0D6D0F
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2232-1-0x0000000000A30000-0x0000000000D54000-memory.dmp family_quasar -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
test.exedescription pid process Token: SeDebugPrivilege 2232 test.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
test.exepid process 2232 test.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2232-0-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmpFilesize
4KB
-
memory/2232-1-0x0000000000A30000-0x0000000000D54000-memory.dmpFilesize
3.1MB
-
memory/2232-2-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmpFilesize
9.9MB
-
memory/2232-3-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmpFilesize
4KB
-
memory/2232-4-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmpFilesize
9.9MB