Analysis
-
max time kernel
300s -
max time network
307s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 18:08
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240226-en
General
-
Target
Client-built.exe
-
Size
348KB
-
MD5
3f99cb13866f63a572bfc49f56e49a21
-
SHA1
e968e6c46296389f04660d6811298025a5eef76f
-
SHA256
45259ac5a1fd635f5b2a41492f4156cc8476afd8e8764a9d61d3158599a75fd8
-
SHA512
042bca3a560803e9e3a1704a92278bbb63ffa3c7b7217eb7602a3c0a5b14d4ad71adb92423e937276df4f1e0a31c6c1ab51ef922e2c3d6ded9cded185edbffb2
-
SSDEEP
6144:ecEHwNHJsa2x0Kx4IKhIBbIVhpXZVn/DOxpxnKACXsK:nxpsalT5XVhpXHrOxrnLcsK
Malware Config
Extracted
quasar
1.3.0.0
Client
runderscore00-61208.portmap.host:61208
QSR_MUTEX_UyCo16EyzQLUNZiVH0
-
encryption_key
AaATXyVYZ9AKtrWxhyCz
-
install_name
Client.exe
-
log_directory
Keylogs
-
reconnect_delay
3000
-
startup_key
Powershell
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2112-1-0x0000000000650000-0x00000000006AE000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Client.exepid process 4472 Client.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 20 ip-api.com -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2760 schtasks.exe 3436 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Client-built.exeClient.exedescription pid process Token: SeDebugPrivilege 2112 Client-built.exe Token: SeDebugPrivilege 4472 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 4472 Client.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Client-built.exeClient.exedescription pid process target process PID 2112 wrote to memory of 2760 2112 Client-built.exe schtasks.exe PID 2112 wrote to memory of 2760 2112 Client-built.exe schtasks.exe PID 2112 wrote to memory of 2760 2112 Client-built.exe schtasks.exe PID 2112 wrote to memory of 4472 2112 Client-built.exe Client.exe PID 2112 wrote to memory of 4472 2112 Client-built.exe Client.exe PID 2112 wrote to memory of 4472 2112 Client-built.exe Client.exe PID 4472 wrote to memory of 3436 4472 Client.exe schtasks.exe PID 4472 wrote to memory of 3436 4472 Client.exe schtasks.exe PID 4472 wrote to memory of 3436 4472 Client.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Powershell" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Client-built.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:2760 -
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Powershell" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:3436
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵PID:4592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
348KB
MD53f99cb13866f63a572bfc49f56e49a21
SHA1e968e6c46296389f04660d6811298025a5eef76f
SHA25645259ac5a1fd635f5b2a41492f4156cc8476afd8e8764a9d61d3158599a75fd8
SHA512042bca3a560803e9e3a1704a92278bbb63ffa3c7b7217eb7602a3c0a5b14d4ad71adb92423e937276df4f1e0a31c6c1ab51ef922e2c3d6ded9cded185edbffb2
-
memory/2112-6-0x00000000061D0000-0x00000000061E2000-memory.dmpFilesize
72KB
-
memory/2112-2-0x0000000005640000-0x0000000005BE4000-memory.dmpFilesize
5.6MB
-
memory/2112-3-0x00000000051C0000-0x0000000005252000-memory.dmpFilesize
584KB
-
memory/2112-4-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB
-
memory/2112-5-0x00000000054D0000-0x0000000005536000-memory.dmpFilesize
408KB
-
memory/2112-0-0x00000000753BE000-0x00000000753BF000-memory.dmpFilesize
4KB
-
memory/2112-7-0x0000000006610000-0x000000000664C000-memory.dmpFilesize
240KB
-
memory/2112-1-0x0000000000650000-0x00000000006AE000-memory.dmpFilesize
376KB
-
memory/2112-16-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB
-
memory/4472-14-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB
-
memory/4472-15-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB
-
memory/4472-18-0x0000000006FF0000-0x0000000006FFA000-memory.dmpFilesize
40KB
-
memory/4472-19-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB