Analysis
-
max time kernel
126s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05-08-2024 01:17
Behavioral task
behavioral1
Sample
36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522.exe
Resource
win7-20240704-en
General
-
Target
36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522.exe
-
Size
3.1MB
-
MD5
9c682f5b5000cd003e76530706955a72
-
SHA1
1a69da76e05d114a317342dae3e9c7b10f107d43
-
SHA256
36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522
-
SHA512
33bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f
-
SSDEEP
49152:CvIt62XlaSFNWPjljiFa2RoUYIqC41JoLoGdX/THHB72eh2NT:CvE62XlaSFNWPjljiFXRoUYIqC9
Malware Config
Extracted
quasar
1.4.1
Office04
51.222.21.20:4782
374acc94-a8cd-45c6-bc31-752e0f83541d
-
encryption_key
5B2A5F50FABB3F6748116D7077D95758D0DFFC77
-
install_name
svchost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svchost
-
subdirectory
SubDir
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2636-1-0x00000000001C0000-0x00000000004E4000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe family_quasar behavioral1/memory/3068-8-0x0000000000820000-0x0000000000B44000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 3068 svchost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2712 schtasks.exe 1232 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522.exesvchost.exedescription pid process Token: SeDebugPrivilege 2636 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522.exe Token: SeDebugPrivilege 3068 svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522.exesvchost.exedescription pid process target process PID 2636 wrote to memory of 2712 2636 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522.exe schtasks.exe PID 2636 wrote to memory of 2712 2636 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522.exe schtasks.exe PID 2636 wrote to memory of 2712 2636 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522.exe schtasks.exe PID 2636 wrote to memory of 3068 2636 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522.exe svchost.exe PID 2636 wrote to memory of 3068 2636 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522.exe svchost.exe PID 2636 wrote to memory of 3068 2636 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522.exe svchost.exe PID 3068 wrote to memory of 1232 3068 svchost.exe schtasks.exe PID 3068 wrote to memory of 1232 3068 svchost.exe schtasks.exe PID 3068 wrote to memory of 1232 3068 svchost.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522.exe"C:\Users\Admin\AppData\Local\Temp\36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2712 -
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1232
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD59c682f5b5000cd003e76530706955a72
SHA11a69da76e05d114a317342dae3e9c7b10f107d43
SHA25636e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522
SHA51233bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f