Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 22:06
Static task
static1
General
-
Target
index.exe
-
Size
36.2MB
-
MD5
aa55396d7df072973d0ea88ec505579d
-
SHA1
8a9b057a859cee6ca3053dc0ef05089bbf2ac4ab
-
SHA256
375f99f85beb8bc69029429b3c5317543957ffa7ba559da6fd4b930ce48bfc7c
-
SHA512
969b634ed5aa5075b9b48ebabcf0e9093c530578ec292e67582db16f84437f4a2823130e354b0054f909ec361b145dc4236b57a9991d4974738924f44e06a2ff
-
SSDEEP
393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfG:fMguj8Q4VfvvqFTrYmi
Malware Config
Extracted
quasar
3.1.5
SeroXen
147.185.221.20:47638
$Sxr-GV6wZsGZZMeZ3qfenc
-
encryption_key
pCYwpdVg3UP8ZY0FIEl9
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Defender Anti-Malware Disable Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\89435a09aea852638faa0bf902e7b347.bat family_quasar -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4104 powershell.exe 4104 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 4104 powershell.exe Token: 33 4544 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4544 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
index.execmd.exepowershell.execsc.exedescription pid process target process PID 2836 wrote to memory of 3576 2836 index.exe cmd.exe PID 2836 wrote to memory of 3576 2836 index.exe cmd.exe PID 2836 wrote to memory of 2868 2836 index.exe cmd.exe PID 2836 wrote to memory of 2868 2836 index.exe cmd.exe PID 3576 wrote to memory of 4104 3576 cmd.exe powershell.exe PID 3576 wrote to memory of 4104 3576 cmd.exe powershell.exe PID 4104 wrote to memory of 3864 4104 powershell.exe csc.exe PID 4104 wrote to memory of 3864 4104 powershell.exe csc.exe PID 3864 wrote to memory of 4472 3864 csc.exe cvtres.exe PID 3864 wrote to memory of 4472 3864 csc.exe cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\index.exe"C:\Users\Admin\AppData\Local\Temp\index.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\system32\cmd.execmd.exe /C call powershell -E QQBkAGQALQBUAHkAcABlACAAQAAiAAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIABwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzACAAewAKACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AFAAYQByAGUAbgB0ACgASQBuAHQAUAB0AHIAIABoAFcAbgBkACkAOwAKAAoAIAAgACAAIAAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAIAAgACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwAKACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAASQBuAHQAUAB0AHIAIABHAGUAdABUAGEAcgBnAGUAdABXAGkAbgBkAG8AdwAoACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHQAUAB0AHIAIABjAG8AbgBzAG8AbABlAFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdABQAHQAcgAgAHAAYQByAGUAbgB0AFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AFAAYQByAGUAbgB0ACgAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAIAA9AD0AIABJAG4AdABQAHQAcgAuAFoAZQByAG8AKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9AAoAIgBAAAoACgBbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AFMAaABvAHcAVwBpAG4AZABvAHcAKABbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AEcAZQB0AFQAYQByAGcAZQB0AFcAaQBuAGQAbwB3ACgAKQAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=2⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -E QQBkAGQALQBUAHkAcABlACAAQAAiAAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIABwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzACAAewAKACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AFAAYQByAGUAbgB0ACgASQBuAHQAUAB0AHIAIABoAFcAbgBkACkAOwAKAAoAIAAgACAAIAAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAIAAgACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwAKACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAASQBuAHQAUAB0AHIAIABHAGUAdABUAGEAcgBnAGUAdABXAGkAbgBkAG8AdwAoACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHQAUAB0AHIAIABjAG8AbgBzAG8AbABlAFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdABQAHQAcgAgAHAAYQByAGUAbgB0AFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AFAAYQByAGUAbgB0ACgAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAIAA9AD0AIABJAG4AdABQAHQAcgAuAFoAZQByAG8AKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9AAoAIgBAAAoACgBbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AFMAaABvAHcAVwBpAG4AZABvAHcAKABbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AEcAZQB0AFQAYQByAGcAZQB0AFcAaQBuAGQAbwB3ACgAKQAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zztiz1ya\zztiz1ya.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6DDD.tmp" "c:\Users\Admin\AppData\Local\Temp\zztiz1ya\CSCE67F815A423A43EB8D3D5E4C98FA1432.TMP"5⤵PID:4472
-
C:\Windows\system32\cmd.execmd.exe /C call C:\Users\Admin\AppData\Local\Temp\89435a09aea852638faa0bf902e7b347.bat2⤵PID:2868
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x244 0x4a81⤵
- Suspicious use of AdjustPrivilegeToken
PID:4544
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
409KB
MD5ef652484dc356b0bc87741f24f2ade24
SHA1f988ef8700c1ed15fa42f9a5756471d6bc18c9c8
SHA256e5e973ff9fe9b009638fc6f8e3b10ca9acad76d2c6cf887f82b018e5a39aa225
SHA512fae5a830fc64a0599686368ca0d3826e4ada1ec383f6faae19054d61bee285442b7471c8f18faf4d378ea025128cab974c50a0cd8f8daf892c6107d812662fec
-
Filesize
1KB
MD5e29a9561260bc2acb2d39b5ebd4fbbfb
SHA11b49a89d1096db2b958700252b92aa875a6ed34b
SHA25650cee6143d9426165b063da75e03003d8fb9daa422ecac1afc580be66eef742a
SHA512be2a1573a28d1e197d4d4af8a7d4443877c40fb95b403a2474c4fac0574b06d312da1874047d15e9abe52e83a08fb7b1b31bf38d7122dc63ea40a008cf282bd2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3KB
MD5343ba1527e7369deadfd30c706f080d8
SHA15ba15adfe09cc99cfe255970aa7fd536e8b57a3c
SHA256e14ec6ea431dfe871cc5de307e9735a176a5778c8297dba648e065e36cfd24b2
SHA5126f822ad735357bcf480e5d01295adde5450a0a1a18ea0178c46c8a4b3351d4b61a83d1f9ee0e8730dc907fa5db1fe8ec46c0c0a7e198a9b1357d6b4ebd104dba
-
Filesize
652B
MD58eb172d02ceca693d2a57842e6eb90a8
SHA1ec7c1c73f8e82fb8d041f64769e0208165eddc16
SHA2563aaad5a68403c9df8099a7bd96a6155c8dff6987f7d5763f73444101ed40207f
SHA512d25edbe53725d62956dc03c1da7a74ecba4bc2f25e0f4ad4555625168a47a033f0d74b49eb90ef4d1ecb1dd8262c14e5153ebee0273469134048779c263ddbca
-
Filesize
737B
MD53d57f8f44297464baafa6aeecd3bf4bc
SHA1f370b4b9f8dba01fbcad979bd663d341f358a509
SHA256415199eec01052503978381a4f88f4cd970b441fedce519905990ed8b629b0f1
SHA5124052dd65ca0a505a36c7c344671afcadb8f82cc24b0d1d8362f61565f9d37782e00332908444f6a95286dd1785d074762b27c20be1f361eec67807fad052d798
-
Filesize
369B
MD56fb9d8678d3a39cb4ca19d51bbbfbe99
SHA1257d26f7403d0e123e4e1e10f304c665a63ba7ce
SHA2561dd38e11b6821bfe7aa3bb54c4bcf0b940d0fbc1f1366ef9d6fa29062154adcf
SHA51238c0ed12233ae13a719b1db452ba9cd8385b616dd7ce2bc343866a65d36f1dadcb4e1cee7f6daeaf8b0457adbbc73bdb8d8d7fa92a519ce380487b9e3297a686