Analysis
-
max time kernel
1795s -
max time network
1799s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 02:13
Behavioral task
behavioral1
Sample
Viber.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Viber.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Viber.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
Viber.exe
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
Viber.exe
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral6
Sample
Viber.exe
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral7
Sample
Viber.exe
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral8
Sample
Viber.exe
Resource
debian9-mipsel-20240226-en
General
-
Target
Viber.exe
-
Size
3.3MB
-
MD5
9863fe2c29f2deb8b301f8180acdedf1
-
SHA1
105a2679bdf370905368427b16cb15d79c41a4da
-
SHA256
2ab4ac728381ffef7b917c6e2f9fd45cdbb753238552484b33990d101f90105d
-
SHA512
bc4b7f07e9b5679c178287c4bee466425c039e5ef49a9fd7b1af7952f96c5445bcfe254f9c6c2d5acbe8feede1d64a4f9bad81ebcf312ab99f3aa8b32fee3f16
-
SSDEEP
49152:8vzI22SsaNYfdPBldt698dBcjHdhZe0SMfGvoGddHTHHB72eh2NT:8vM22SsaNYfdPBldt6+dBcjHd3e0GN
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.100.4:4782
ff281bf3-1641-40e1-b845-186b77f35b47
-
encryption_key
F8B799D52937CC435CCEC057E69F8914153CFD83
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral3/memory/4792-1-0x0000000000B20000-0x0000000000E7A000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Client.exepid process 4576 Client.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Viber.exeClient.exedescription pid process Token: SeDebugPrivilege 4792 Viber.exe Token: SeDebugPrivilege 4576 Client.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Client.exepid process 4576 Client.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Client.exepid process 4576 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 4576 Client.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Viber.exedescription pid process target process PID 4792 wrote to memory of 4576 4792 Viber.exe Client.exe PID 4792 wrote to memory of 4576 4792 Viber.exe Client.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Viber.exe"C:\Users\Admin\AppData\Local\Temp\Viber.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
3.3MB
MD59863fe2c29f2deb8b301f8180acdedf1
SHA1105a2679bdf370905368427b16cb15d79c41a4da
SHA2562ab4ac728381ffef7b917c6e2f9fd45cdbb753238552484b33990d101f90105d
SHA512bc4b7f07e9b5679c178287c4bee466425c039e5ef49a9fd7b1af7952f96c5445bcfe254f9c6c2d5acbe8feede1d64a4f9bad81ebcf312ab99f3aa8b32fee3f16
-
memory/4576-10-0x00007FFEB35E0000-0x00007FFEB40A1000-memory.dmpFilesize
10.8MB
-
memory/4576-11-0x00007FFEB35E0000-0x00007FFEB40A1000-memory.dmpFilesize
10.8MB
-
memory/4576-12-0x000000001BB00000-0x000000001BB50000-memory.dmpFilesize
320KB
-
memory/4576-13-0x000000001C190000-0x000000001C242000-memory.dmpFilesize
712KB
-
memory/4576-14-0x00007FFEB35E0000-0x00007FFEB40A1000-memory.dmpFilesize
10.8MB
-
memory/4792-0-0x00007FFEB35E3000-0x00007FFEB35E5000-memory.dmpFilesize
8KB
-
memory/4792-1-0x0000000000B20000-0x0000000000E7A000-memory.dmpFilesize
3.4MB
-
memory/4792-2-0x00007FFEB35E0000-0x00007FFEB40A1000-memory.dmpFilesize
10.8MB
-
memory/4792-9-0x00007FFEB35E0000-0x00007FFEB40A1000-memory.dmpFilesize
10.8MB