Analysis
-
max time kernel
72s -
max time network
72s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2024 06:22
Behavioral task
behavioral1
Sample
dwdwdw.exe
Resource
win7-20240708-en
Errors
General
-
Target
dwdwdw.exe
-
Size
3.1MB
-
MD5
2918c8a614e88697a74fa44db27518f0
-
SHA1
e7f6f4cf9e8cb900e71633b628b3a3b54e90a179
-
SHA256
ace4ac0da20b7e8b91205196f973a80e117bc4cede40ea445e851382567456a4
-
SHA512
f452b243d7ed593e4d22481e02431773687f1c61783ecebf70bb8e80ce17332b9f1c1a4cb21760770dcbb0adef22ab6c4196089b50a2565ba2da4d962b22b8e3
-
SSDEEP
49152:VHobtR1o2PmNXo7WCr5lkcXcIYXrYdyQTHHB72eh2NT:VHmRvmNXo7WCr5lkcXcI6/
Malware Config
Extracted
quasar
1.4.1
Office04
147.185.221.18:42996
147.185.221.18:1770
c2e1b18a-ce93-436d-ad8b-21bf89015e19
-
encryption_key
9E968F05BD874BA1BE086FD1774A027473823F49
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2268-1-0x00000000003A0000-0x00000000006C4000-memory.dmp family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dwdwdw.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation dwdwdw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "103" LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
dwdwdw.exeshutdown.exedescription pid process Token: SeDebugPrivilege 2268 dwdwdw.exe Token: SeShutdownPrivilege 2052 shutdown.exe Token: SeRemoteShutdownPrivilege 2052 shutdown.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
dwdwdw.exepid process 2268 dwdwdw.exe 2268 dwdwdw.exe 2268 dwdwdw.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
dwdwdw.exepid process 2268 dwdwdw.exe 2268 dwdwdw.exe 2268 dwdwdw.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 2492 LogonUI.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
dwdwdw.exedescription pid process target process PID 2268 wrote to memory of 2052 2268 dwdwdw.exe shutdown.exe PID 2268 wrote to memory of 2052 2268 dwdwdw.exe shutdown.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dwdwdw.exe"C:\Users\Admin\AppData\Local\Temp\dwdwdw.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /r /t 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3946855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2492