Analysis
-
max time kernel
41s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 09:32
Behavioral task
behavioral1
Sample
SynapseX.exe
Resource
win7-20240220-en
General
-
Target
SynapseX.exe
-
Size
3.1MB
-
MD5
674a2f40a3cfdeb19b4787406f9f947b
-
SHA1
2fb5232fe4c078a35270aca9dc57f7f8f69b0328
-
SHA256
790c606fd4e39779b55dacfaa684be5aea2cd3cebd9b26f089c3498399b4b757
-
SHA512
feab371f1cd8adbd45e560329f4353a91b176a9b5897bf803633ea9f13698a6c6b67c38466f0077f3c93ff0a06467bf43e32a5e1a4ee9d623878f6177d1c918c
-
SSDEEP
49152:3v6lL26AaNeWgPhlmVqvMQ7XSKWCS21J/LoGd+THHB72eh2NT:3viL26AaNeWgPhlmVqkQ7XSKWCSG
Malware Config
Extracted
quasar
1.4.1
Chase
Synapsedoggystyle-51191.portmap.host:51191
bfe1d049-722e-41ed-b777-d417eb22f6e7
-
encryption_key
33F77912B4CF70A0AD1E582014B5294301E27672
-
install_name
Synapase.exe
-
log_directory
Windows Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
document
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2480-1-0x00000000013B0000-0x00000000016D4000-memory.dmp family_quasar C:\Program Files\document\Synapase.exe family_quasar behavioral1/memory/2504-8-0x0000000000930000-0x0000000000C54000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Synapase.exepid process 2504 Synapase.exe -
Drops file in Program Files directory 5 IoCs
Processes:
SynapseX.exeSynapase.exedescription ioc process File opened for modification C:\Program Files\document SynapseX.exe File opened for modification C:\Program Files\document\Synapase.exe Synapase.exe File opened for modification C:\Program Files\document Synapase.exe File created C:\Program Files\document\Synapase.exe SynapseX.exe File opened for modification C:\Program Files\document\Synapase.exe SynapseX.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2492 schtasks.exe 2720 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
taskmgr.exepid process 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 2464 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SynapseX.exeSynapase.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 2480 SynapseX.exe Token: SeDebugPrivilege 2504 Synapase.exe Token: SeDebugPrivilege 2464 taskmgr.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
Processes:
taskmgr.exepid process 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe -
Suspicious use of SendNotifyMessage 47 IoCs
Processes:
taskmgr.exepid process 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe 2464 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Synapase.exepid process 2504 Synapase.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
SynapseX.exeSynapase.exedescription pid process target process PID 2480 wrote to memory of 2492 2480 SynapseX.exe schtasks.exe PID 2480 wrote to memory of 2492 2480 SynapseX.exe schtasks.exe PID 2480 wrote to memory of 2492 2480 SynapseX.exe schtasks.exe PID 2480 wrote to memory of 2504 2480 SynapseX.exe Synapase.exe PID 2480 wrote to memory of 2504 2480 SynapseX.exe Synapase.exe PID 2480 wrote to memory of 2504 2480 SynapseX.exe Synapase.exe PID 2504 wrote to memory of 2720 2504 Synapase.exe schtasks.exe PID 2504 wrote to memory of 2720 2504 Synapase.exe schtasks.exe PID 2504 wrote to memory of 2720 2504 Synapase.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SynapseX.exe"C:\Users\Admin\AppData\Local\Temp\SynapseX.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\document\Synapase.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Program Files\document\Synapase.exe"C:\Program Files\document\Synapase.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\document\Synapase.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\document\Synapase.exeFilesize
3.1MB
MD5674a2f40a3cfdeb19b4787406f9f947b
SHA12fb5232fe4c078a35270aca9dc57f7f8f69b0328
SHA256790c606fd4e39779b55dacfaa684be5aea2cd3cebd9b26f089c3498399b4b757
SHA512feab371f1cd8adbd45e560329f4353a91b176a9b5897bf803633ea9f13698a6c6b67c38466f0077f3c93ff0a06467bf43e32a5e1a4ee9d623878f6177d1c918c
-
memory/2464-14-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2464-13-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2480-0-0x000007FEF57F3000-0x000007FEF57F4000-memory.dmpFilesize
4KB
-
memory/2480-1-0x00000000013B0000-0x00000000016D4000-memory.dmpFilesize
3.1MB
-
memory/2480-2-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmpFilesize
9.9MB
-
memory/2480-9-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmpFilesize
9.9MB
-
memory/2504-8-0x0000000000930000-0x0000000000C54000-memory.dmpFilesize
3.1MB
-
memory/2504-10-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmpFilesize
9.9MB
-
memory/2504-11-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmpFilesize
9.9MB
-
memory/2504-15-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmpFilesize
9.9MB