Analysis
-
max time kernel
276s -
max time network
293s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
03-06-2024 17:05
Behavioral task
behavioral1
Sample
Silent-Skull.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Silent-Skull.exe
Resource
win10v2004-20240508-en
General
-
Target
Silent-Skull.exe
-
Size
348KB
-
MD5
8436d16727f4b911f5480809103baa87
-
SHA1
50a1b81af0bf85af5a3ef841fe49746675313120
-
SHA256
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220
-
SHA512
ae668799e2caca582c437271e7ee51c5d679a64a7dec26e4a31909bf948d6c9f0d467a2d39b625af8471267431adeec70b89513100690c6937aae21e1b6c521d
-
SSDEEP
3072:9FxkhjvK3tFGW8jrQ+G/3NFZLZICSAr0EXZtiNLBPp64PFvqv5bnux7E3MpdMGTE:9LL3HRsM+OFZL2HL7CRbu+8gYdfDIui
Malware Config
Extracted
quasar
1.3.0.0
Client
runderscore00-61208.portmap.host:61208
QSR_MUTEX_q1SPcFNLEQ1FIcq9Po
-
encryption_key
qQYEXzkyhZKvRSzcxALx
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral3/memory/5056-1-0x0000000000700000-0x000000000075E000-memory.dmp family_quasar -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Silent-Skull.exedescription pid process Token: SeDebugPrivilege 5056 Silent-Skull.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5056-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmpFilesize
4KB
-
memory/5056-1-0x0000000000700000-0x000000000075E000-memory.dmpFilesize
376KB
-
memory/5056-2-0x00000000056C0000-0x0000000005C66000-memory.dmpFilesize
5.6MB
-
memory/5056-3-0x0000000005230000-0x00000000052C2000-memory.dmpFilesize
584KB
-
memory/5056-4-0x0000000074BA0000-0x0000000075351000-memory.dmpFilesize
7.7MB
-
memory/5056-5-0x0000000005330000-0x0000000005396000-memory.dmpFilesize
408KB
-
memory/5056-6-0x0000000006030000-0x0000000006042000-memory.dmpFilesize
72KB
-
memory/5056-7-0x0000000006580000-0x00000000065BC000-memory.dmpFilesize
240KB
-
memory/5056-8-0x0000000006730000-0x000000000673A000-memory.dmpFilesize
40KB
-
memory/5056-9-0x0000000074BAE000-0x0000000074BAF000-memory.dmpFilesize
4KB
-
memory/5056-10-0x0000000074BA0000-0x0000000075351000-memory.dmpFilesize
7.7MB