Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01-08-2024 08:51
Behavioral task
behavioral1
Sample
429d98e4f83301b513eab17210d91579428ac61e976e0df744d155f7f27f46b0.exe
Resource
win7-20240708-en
General
-
Target
429d98e4f83301b513eab17210d91579428ac61e976e0df744d155f7f27f46b0.exe
-
Size
3.1MB
-
MD5
2a93b7369d5bff945e137add755297dc
-
SHA1
a43b23f75685dd1033fcaf8a8611c0aeff7cb9c9
-
SHA256
429d98e4f83301b513eab17210d91579428ac61e976e0df744d155f7f27f46b0
-
SHA512
a3d0b5ce054f3765f4f074352aea11cad09689201b9759b0ef32f5e3063c3706bb9991ff8de63c172d43db97073f88f9259ef1cb6a1a25c194125c88e0b17a95
-
SSDEEP
49152:WvXI22SsaNYfdPBldt698dBcjHPFWbCE2CxpmIHLoGOfpTHHB72eh2NT:WvY22SsaNYfdPBldt6+dBcjHtWbCi
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.8.195:4782
f569b663-adac-40e8-9ba7-aa60b6838dad
-
encryption_key
EB173B446A47D9C5ABC3CE2B7C417F5FCEC32402
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1892-1-0x0000000000190000-0x00000000004B4000-memory.dmp family_quasar -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
429d98e4f83301b513eab17210d91579428ac61e976e0df744d155f7f27f46b0.exedescription pid process Token: SeDebugPrivilege 1892 429d98e4f83301b513eab17210d91579428ac61e976e0df744d155f7f27f46b0.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
429d98e4f83301b513eab17210d91579428ac61e976e0df744d155f7f27f46b0.exedescription pid process target process PID 1892 wrote to memory of 2736 1892 429d98e4f83301b513eab17210d91579428ac61e976e0df744d155f7f27f46b0.exe schtasks.exe PID 1892 wrote to memory of 2736 1892 429d98e4f83301b513eab17210d91579428ac61e976e0df744d155f7f27f46b0.exe schtasks.exe PID 1892 wrote to memory of 2736 1892 429d98e4f83301b513eab17210d91579428ac61e976e0df744d155f7f27f46b0.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\429d98e4f83301b513eab17210d91579428ac61e976e0df744d155f7f27f46b0.exe"C:\Users\Admin\AppData\Local\Temp\429d98e4f83301b513eab17210d91579428ac61e976e0df744d155f7f27f46b0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2736