Resubmissions
02-06-2024 23:32
240602-3jg1psbb8t 10Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 23:32
Behavioral task
behavioral1
Sample
e/Client-built.exe
Resource
win7-20240220-en
General
-
Target
e/Client-built.exe
-
Size
3.1MB
-
MD5
aa577b65aef014d53b006d781d104ef6
-
SHA1
318e06013bbfcfdd14f4e21aa2540f1f1dfe0039
-
SHA256
242351aa410188e74858d60f04973bf05071b98e82f6494d2ba1851d23fdf178
-
SHA512
45649bade97928524c7b1e6d456f7abe2036fe33775ac4308c786bd3a8d1ce68ce7ff12dbddb4c80b8d3c28324b13ec37e0ec72c856ce15c32e0724952deace5
-
SSDEEP
49152:Hv+lL26AaNeWgPhlmVqvMQ7XSKXXxNESEdk/iKLoGdYTHHB72eh2NT:HvuL26AaNeWgPhlmVqkQ7XSKnx80
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.1:4782
88.98.207.207:4782
6d19d2f9-1235-4b10-a1dd-486dc3edd052
-
encryption_key
12AE26995FE0F312DC3ADA3C8CD142053AD088CA
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2464-1-0x0000000000C80000-0x0000000000FA4000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client.exe family_quasar behavioral1/memory/2660-10-0x0000000000D70000-0x0000000001094000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Client.exepid process 2660 Client.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2080 schtasks.exe 2536 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Client-built.exeClient.exedescription pid process Token: SeDebugPrivilege 2464 Client-built.exe Token: SeDebugPrivilege 2660 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 2660 Client.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Client-built.exeClient.exedescription pid process target process PID 2464 wrote to memory of 2080 2464 Client-built.exe schtasks.exe PID 2464 wrote to memory of 2080 2464 Client-built.exe schtasks.exe PID 2464 wrote to memory of 2080 2464 Client-built.exe schtasks.exe PID 2464 wrote to memory of 2660 2464 Client-built.exe Client.exe PID 2464 wrote to memory of 2660 2464 Client-built.exe Client.exe PID 2464 wrote to memory of 2660 2464 Client-built.exe Client.exe PID 2660 wrote to memory of 2536 2660 Client.exe schtasks.exe PID 2660 wrote to memory of 2536 2660 Client.exe schtasks.exe PID 2660 wrote to memory of 2536 2660 Client.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\e\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
3.1MB
MD5aa577b65aef014d53b006d781d104ef6
SHA1318e06013bbfcfdd14f4e21aa2540f1f1dfe0039
SHA256242351aa410188e74858d60f04973bf05071b98e82f6494d2ba1851d23fdf178
SHA51245649bade97928524c7b1e6d456f7abe2036fe33775ac4308c786bd3a8d1ce68ce7ff12dbddb4c80b8d3c28324b13ec37e0ec72c856ce15c32e0724952deace5
-
memory/2464-0-0x000007FEF5893000-0x000007FEF5894000-memory.dmpFilesize
4KB
-
memory/2464-1-0x0000000000C80000-0x0000000000FA4000-memory.dmpFilesize
3.1MB
-
memory/2464-2-0x000007FEF5890000-0x000007FEF627C000-memory.dmpFilesize
9.9MB
-
memory/2464-9-0x000007FEF5890000-0x000007FEF627C000-memory.dmpFilesize
9.9MB
-
memory/2660-8-0x000007FEF5890000-0x000007FEF627C000-memory.dmpFilesize
9.9MB
-
memory/2660-10-0x0000000000D70000-0x0000000001094000-memory.dmpFilesize
3.1MB
-
memory/2660-11-0x000007FEF5890000-0x000007FEF627C000-memory.dmpFilesize
9.9MB
-
memory/2660-12-0x000007FEF5890000-0x000007FEF627C000-memory.dmpFilesize
9.9MB