quasar | 343ede22fe4ea40332033bb21aa899d9adbc2bacbae9fdddeb1380f8f47b3554

Virtualization/Sandbox Evasion

T1497

Processes:

loader.exedefenderx64.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	defenderx64.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

defenderx64.exeloader.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	defenderx64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	defenderx64.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

873a1e2ab5cd98979796cc8b3c3f66f0_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	873a1e2ab5cd98979796cc8b3c3f66f0_NeikiAnalytics.exe

Executes dropped EXE 2 IoCs

Processes:

loader.exedefenderx64.exe

pid process

2488 loader.exe
4576 defenderx64.exe

pid	process
2488	loader.exe
4576	defenderx64.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\loader.exe	themida
behavioral2/memory/2488-28-0x0000000000400000-0x000000000109A000-memory.dmp	themida
behavioral2/memory/2488-29-0x0000000000400000-0x000000000109A000-memory.dmp	themida
behavioral2/memory/2488-37-0x0000000000400000-0x000000000109A000-memory.dmp	themida
behavioral2/memory/4576-40-0x0000000000400000-0x000000000109A000-memory.dmp	themida
behavioral2/memory/4576-41-0x0000000000400000-0x000000000109A000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

loader.exedefenderx64.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	loader.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	defenderx64.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

15 raw.githubusercontent.com
16 raw.githubusercontent.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

loader.exedefenderx64.exe

pid process

2488 loader.exe
4576 defenderx64.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2140 schtasks.exe
4936 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

loader.exedefenderx64.exe

pid process

2488 loader.exe
2488 loader.exe
4576 defenderx64.exe
4576 defenderx64.exe

flow	ioc
15	raw.githubusercontent.com
16	raw.githubusercontent.com

pid	process
2488	loader.exe
4576	defenderx64.exe

pid	process
2140	schtasks.exe
4936	schtasks.exe

pid	process
2488	loader.exe
2488	loader.exe
4576	defenderx64.exe
4576	defenderx64.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

873a1e2ab5cd98979796cc8b3c3f66f0_NeikiAnalytics.exeloader.exedefenderx64.exe

description	pid	process
Token: SeDebugPrivilege	4456	873a1e2ab5cd98979796cc8b3c3f66f0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2488	loader.exe
Token: SeDebugPrivilege	4576	defenderx64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

defenderx64.exe

pid process

4576 defenderx64.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

defenderx64.exe

pid process

4576 defenderx64.exe

pid	process
4576	defenderx64.exe

pid	process
4576	defenderx64.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

873a1e2ab5cd98979796cc8b3c3f66f0_NeikiAnalytics.exeloader.exedefenderx64.exe

description	pid	process	target process
PID 4456 wrote to memory of 2488	4456	873a1e2ab5cd98979796cc8b3c3f66f0_NeikiAnalytics.exe	loader.exe
PID 4456 wrote to memory of 2488	4456	873a1e2ab5cd98979796cc8b3c3f66f0_NeikiAnalytics.exe	loader.exe
PID 4456 wrote to memory of 2488	4456	873a1e2ab5cd98979796cc8b3c3f66f0_NeikiAnalytics.exe	loader.exe
PID 2488 wrote to memory of 4936	2488	loader.exe	schtasks.exe
PID 2488 wrote to memory of 4936	2488	loader.exe	schtasks.exe
PID 2488 wrote to memory of 4936	2488	loader.exe	schtasks.exe
PID 2488 wrote to memory of 4576	2488	loader.exe	defenderx64.exe
PID 2488 wrote to memory of 4576	2488	loader.exe	defenderx64.exe
PID 2488 wrote to memory of 4576	2488	loader.exe	defenderx64.exe
PID 4576 wrote to memory of 2140	4576	defenderx64.exe	schtasks.exe
PID 4576 wrote to memory of 2140	4576	defenderx64.exe	schtasks.exe
PID 4576 wrote to memory of 2140	4576	defenderx64.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\873a1e2ab5cd98979796cc8b3c3f66f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\873a1e2ab5cd98979796cc8b3c3f66f0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "Windows Defender Helper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\en\defenderx64.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:4936

C:\Users\Admin\AppData\Roaming\en\defenderx64.exe
"C:\Users\Admin\AppData\Roaming\en\defenderx64.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4576

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "Windows Defender Helper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\en\defenderx64.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2140

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

3

Virtualization/Sandbox Evasion

T1497

System Information Discovery

4

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service