Analysis
-
max time kernel
48s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 09:32
Behavioral task
behavioral1
Sample
SynapseX.exe
Resource
win7-20240220-en
General
-
Target
SynapseX.exe
-
Size
3.1MB
-
MD5
674a2f40a3cfdeb19b4787406f9f947b
-
SHA1
2fb5232fe4c078a35270aca9dc57f7f8f69b0328
-
SHA256
790c606fd4e39779b55dacfaa684be5aea2cd3cebd9b26f089c3498399b4b757
-
SHA512
feab371f1cd8adbd45e560329f4353a91b176a9b5897bf803633ea9f13698a6c6b67c38466f0077f3c93ff0a06467bf43e32a5e1a4ee9d623878f6177d1c918c
-
SSDEEP
49152:3v6lL26AaNeWgPhlmVqvMQ7XSKWCS21J/LoGd+THHB72eh2NT:3viL26AaNeWgPhlmVqkQ7XSKWCSG
Malware Config
Extracted
quasar
1.4.1
Chase
Synapsedoggystyle-51191.portmap.host:51191
bfe1d049-722e-41ed-b777-d417eb22f6e7
-
encryption_key
33F77912B4CF70A0AD1E582014B5294301E27672
-
install_name
Synapase.exe
-
log_directory
Windows Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
document
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/320-1-0x00000000006F0000-0x0000000000A14000-memory.dmp family_quasar C:\Program Files\document\Synapase.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Synapase.exepid process 916 Synapase.exe -
Drops file in Program Files directory 5 IoCs
Processes:
SynapseX.exeSynapase.exedescription ioc process File created C:\Program Files\document\Synapase.exe SynapseX.exe File opened for modification C:\Program Files\document\Synapase.exe SynapseX.exe File opened for modification C:\Program Files\document SynapseX.exe File opened for modification C:\Program Files\document\Synapase.exe Synapase.exe File opened for modification C:\Program Files\document Synapase.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 828 schtasks.exe 2192 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SynapseX.exeSynapase.exedescription pid process Token: SeDebugPrivilege 320 SynapseX.exe Token: SeDebugPrivilege 916 Synapase.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Synapase.exepid process 916 Synapase.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
SynapseX.exeSynapase.exedescription pid process target process PID 320 wrote to memory of 828 320 SynapseX.exe schtasks.exe PID 320 wrote to memory of 828 320 SynapseX.exe schtasks.exe PID 320 wrote to memory of 916 320 SynapseX.exe Synapase.exe PID 320 wrote to memory of 916 320 SynapseX.exe Synapase.exe PID 916 wrote to memory of 2192 916 Synapase.exe schtasks.exe PID 916 wrote to memory of 2192 916 Synapase.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SynapseX.exe"C:\Users\Admin\AppData\Local\Temp\SynapseX.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\document\Synapase.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Program Files\document\Synapase.exe"C:\Program Files\document\Synapase.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\document\Synapase.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\document\Synapase.exeFilesize
3.1MB
MD5674a2f40a3cfdeb19b4787406f9f947b
SHA12fb5232fe4c078a35270aca9dc57f7f8f69b0328
SHA256790c606fd4e39779b55dacfaa684be5aea2cd3cebd9b26f089c3498399b4b757
SHA512feab371f1cd8adbd45e560329f4353a91b176a9b5897bf803633ea9f13698a6c6b67c38466f0077f3c93ff0a06467bf43e32a5e1a4ee9d623878f6177d1c918c
-
memory/320-0-0x00007FFEC4133000-0x00007FFEC4135000-memory.dmpFilesize
8KB
-
memory/320-1-0x00000000006F0000-0x0000000000A14000-memory.dmpFilesize
3.1MB
-
memory/320-2-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmpFilesize
10.8MB
-
memory/320-9-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmpFilesize
10.8MB
-
memory/916-10-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmpFilesize
10.8MB
-
memory/916-11-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmpFilesize
10.8MB
-
memory/916-12-0x000000001BB50000-0x000000001BBA0000-memory.dmpFilesize
320KB
-
memory/916-13-0x000000001BC60000-0x000000001BD12000-memory.dmpFilesize
712KB
-
memory/916-14-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmpFilesize
10.8MB