Analysis
-
max time kernel
863s -
max time network
869s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2024 05:03
Behavioral task
behavioral1
Sample
GensisLoader.exe
Resource
win10v2004-20240802-en
General
-
Target
GensisLoader.exe
-
Size
3.1MB
-
MD5
5c085700fda2c1047873e097f18c4b52
-
SHA1
058c3a0c25670219eb41efac7055c9335796b6dd
-
SHA256
e7b85652cc26274a0cf5b62c204b8cb4b3a592ec6582f300ec9ba0cc3bdf171b
-
SHA512
be44dfbdcd32716c267c08710130f12eb97f9b7b827859a5d73824694dbdd1ef9ddea72850865991fa8eee97cc9dbeae02f06efa58acd9b931ead8a5d1b5e913
-
SSDEEP
49152:bvJlL26AaNeWgPhlmVqvMQ7XSKGjd7kbFHPoGd63THHB72eh2NT:bvnL26AaNeWgPhlmVqkQ7XSKGjqv
Malware Config
Extracted
quasar
1.4.1
Office04
147.185.221.18:42996
147.185.221.18:1770
aef6df25-e90d-4712-99d2-9ec0dbe8e337
-
encryption_key
8BD05243304A2E80E6CB2DD2A023CA800A308299
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4520-1-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
GensisLoader.exedescription pid process Token: SeDebugPrivilege 4520 GensisLoader.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
GensisLoader.exepid process 4520 GensisLoader.exe 4520 GensisLoader.exe 4520 GensisLoader.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
GensisLoader.exepid process 4520 GensisLoader.exe 4520 GensisLoader.exe 4520 GensisLoader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GensisLoader.exe"C:\Users\Admin\AppData\Local\Temp\GensisLoader.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4520
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4416,i,3239535018877284530,3457823197501312703,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:81⤵PID:2820
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3668,i,3239535018877284530,3457823197501312703,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:81⤵PID:1884