Analysis
-
max time kernel
90s -
max time network
194s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-05-2024 14:08
Behavioral task
behavioral1
Sample
Powershell.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Powershell.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Powershell.exe
Resource
win11-20240508-en
General
-
Target
Powershell.exe
-
Size
409KB
-
MD5
4286aedc2a233ab74deb2670fa484866
-
SHA1
860fdc6876a4948f5e352aa50910b9f13607c3fb
-
SHA256
149ef8e77fbe162157f8462892235211b9f926a3454d615ad4c59e854e48ec82
-
SHA512
fc3c7885a9f6af0a2d38375f1d256128a474a998c2359938955fff6e45d216dfa1942ccba2359b18f263219d95004b9e976524ef26c967c58cb29a7c6c93f097
-
SSDEEP
12288:UpsD64e1MDEArEiVTqkllSmxmeN1AKXiLNk2+XRnS:ksG4kMsaGkllvxvuKyZ1N
Malware Config
Extracted
quasar
3.1.5
SeroXen | v3.1.5 |
runderscore00-25501.portmap.host:25501
$Sxr-jy6vh8CtEJL5ceZuIb
-
encryption_key
JCa22tR8WnO00adn2TuE
-
install_name
$sxr-powershell.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
-
startup_key
Powershell
-
subdirectory
$sxr-seroxen2
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral3/memory/2120-1-0x0000000000E80000-0x0000000000EEC000-memory.dmp family_quasar -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Powershell.exedescription pid process Token: SeDebugPrivilege 2120 Powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Powershell.exepid process 2120 Powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Powershell.execmd.exedescription pid process target process PID 2120 wrote to memory of 948 2120 Powershell.exe cmd.exe PID 2120 wrote to memory of 948 2120 Powershell.exe cmd.exe PID 2120 wrote to memory of 948 2120 Powershell.exe cmd.exe PID 948 wrote to memory of 1224 948 cmd.exe chcp.com PID 948 wrote to memory of 1224 948 cmd.exe chcp.com PID 948 wrote to memory of 1224 948 cmd.exe chcp.com PID 948 wrote to memory of 3872 948 cmd.exe PING.EXE PID 948 wrote to memory of 3872 948 cmd.exe PING.EXE PID 948 wrote to memory of 3872 948 cmd.exe PING.EXE PID 2120 wrote to memory of 2384 2120 Powershell.exe SCHTASKS.exe PID 2120 wrote to memory of 2384 2120 Powershell.exe SCHTASKS.exe PID 2120 wrote to memory of 2384 2120 Powershell.exe SCHTASKS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Powershell.exe"C:\Users\Admin\AppData\Local\Temp\Powershell.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\L1KUprPdALvB.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Powershell.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Powershell.exe'" /sc onlogon /rl HIGHEST2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\L1KUprPdALvB.batFilesize
267B
MD5b3124f5b2d13f9d0fb0dca7b627a4886
SHA12362ef11bb5588ecc74abaf9e6c32428f5f7dfd1
SHA25641a0af3d45dea4c152c599b650175692b591347a2e919d77b6d7e16cda7b617c
SHA512824ae50b75f3b6d1b91cfaa92c10c6e6aede78f779d53c8e7282c4e9d9493b59392348d3bd3280017bfc14d4d47c93ee0f6b61097cf92b9c3ab07b383cd70d7b
-
C:\Users\Admin\AppData\Roaming\$sxr-Logs\05-29-~1Filesize
224B
MD5cb9dc9c86d8e9d93e66515042be690ba
SHA1fc5df9d77f18633a5c76883392c7f2dafb40d496
SHA2562607ce9021f0c7cfe4e8714430a1a9fe37108f8d957702332813ea444ed856d5
SHA512a4d343e44adea98af4f7097011837a9d58d4adf6a364708567e9fcc311dac14fc99b6e9790bca92959337f8eafcd2351db4dc90a4a47317c123a7b543a2fc401
-
memory/2120-6-0x00000000066C0000-0x00000000066D2000-memory.dmpFilesize
72KB
-
memory/2120-3-0x0000000005A30000-0x0000000005AC2000-memory.dmpFilesize
584KB
-
memory/2120-4-0x0000000074EF0000-0x00000000756A1000-memory.dmpFilesize
7.7MB
-
memory/2120-5-0x00000000059A0000-0x0000000005A06000-memory.dmpFilesize
408KB
-
memory/2120-0-0x0000000074EFE000-0x0000000074EFF000-memory.dmpFilesize
4KB
-
memory/2120-7-0x0000000006C10000-0x0000000006C4C000-memory.dmpFilesize
240KB
-
memory/2120-9-0x00000000070D0000-0x00000000070DA000-memory.dmpFilesize
40KB
-
memory/2120-10-0x0000000074EFE000-0x0000000074EFF000-memory.dmpFilesize
4KB
-
memory/2120-11-0x0000000074EF0000-0x00000000756A1000-memory.dmpFilesize
7.7MB
-
memory/2120-2-0x0000000005FE0000-0x0000000006586000-memory.dmpFilesize
5.6MB
-
memory/2120-17-0x0000000074EF0000-0x00000000756A1000-memory.dmpFilesize
7.7MB
-
memory/2120-1-0x0000000000E80000-0x0000000000EEC000-memory.dmpFilesize
432KB