Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2024 05:07
Behavioral task
behavioral1
Sample
dwdwdw.exe
Resource
win7-20240705-en
General
-
Target
dwdwdw.exe
-
Size
3.1MB
-
MD5
1d2c7fbba453dd1cf4de79a6716daf93
-
SHA1
0257ce3de31e6bd8084e5b7f101438d1fe2c7730
-
SHA256
9fca56ce9e20354eae217b70b07955ebb8d44ea28f3a090c696e330c22cfb4da
-
SHA512
a68ad1c392a287a7993221c3a8e0f81eda02cbd22b2584f106276e92789738ac64190c8a01ee26ca577f4351af8f09d8fe2387ca5891f5d930e998fe275601c7
-
SSDEEP
49152:3vJlL26AaNeWgPhlmVqvMQ7XSK9/2xDRmhcorpszoGdiiTHHB72eh2NT:3vnL26AaNeWgPhlmVqkQ7XSK99Pey
Malware Config
Extracted
quasar
1.4.1
Office04
147.185.221.18:42996
147.185.221.18:1770
aef6df25-e90d-4712-99d2-9ec0dbe8e337
-
encryption_key
8BD05243304A2E80E6CB2DD2A023CA800A308299
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1540-1-0x00000000002E0000-0x0000000000604000-memory.dmp family_quasar -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
dwdwdw.exedescription pid process Token: SeDebugPrivilege 1540 dwdwdw.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
dwdwdw.exepid process 1540 dwdwdw.exe 1540 dwdwdw.exe 1540 dwdwdw.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
dwdwdw.exepid process 1540 dwdwdw.exe 1540 dwdwdw.exe 1540 dwdwdw.exe