Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-08-2024 12:13
Behavioral task
behavioral1
Sample
9c682f5b5000cd003e76530706955a72.exe
Resource
win7-20240729-en
General
-
Target
9c682f5b5000cd003e76530706955a72.exe
-
Size
3.1MB
-
MD5
9c682f5b5000cd003e76530706955a72
-
SHA1
1a69da76e05d114a317342dae3e9c7b10f107d43
-
SHA256
36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522
-
SHA512
33bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f
-
SSDEEP
49152:CvIt62XlaSFNWPjljiFa2RoUYIqC41JoLoGdX/THHB72eh2NT:CvE62XlaSFNWPjljiFXRoUYIqC9
Malware Config
Extracted
quasar
1.4.1
Office04
51.222.21.20:4782
374acc94-a8cd-45c6-bc31-752e0f83541d
-
encryption_key
5B2A5F50FABB3F6748116D7077D95758D0DFFC77
-
install_name
svchost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svchost
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/408-1-0x0000000000AB0000-0x0000000000DD4000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2720 svchost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4344 schtasks.exe 5096 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9c682f5b5000cd003e76530706955a72.exesvchost.exedescription pid process Token: SeDebugPrivilege 408 9c682f5b5000cd003e76530706955a72.exe Token: SeDebugPrivilege 2720 svchost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
9c682f5b5000cd003e76530706955a72.exesvchost.exedescription pid process target process PID 408 wrote to memory of 4344 408 9c682f5b5000cd003e76530706955a72.exe schtasks.exe PID 408 wrote to memory of 4344 408 9c682f5b5000cd003e76530706955a72.exe schtasks.exe PID 408 wrote to memory of 2720 408 9c682f5b5000cd003e76530706955a72.exe svchost.exe PID 408 wrote to memory of 2720 408 9c682f5b5000cd003e76530706955a72.exe svchost.exe PID 2720 wrote to memory of 5096 2720 svchost.exe schtasks.exe PID 2720 wrote to memory of 5096 2720 svchost.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c682f5b5000cd003e76530706955a72.exe"C:\Users\Admin\AppData\Local\Temp\9c682f5b5000cd003e76530706955a72.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4344 -
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:5096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD59c682f5b5000cd003e76530706955a72
SHA11a69da76e05d114a317342dae3e9c7b10f107d43
SHA25636e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522
SHA51233bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f