Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
05-08-2024 16:18
Behavioral task
behavioral1
Sample
Bootstrapper (extract.me)(1).zip
Resource
win11-20240802-en
General
-
Target
Bootstrapper.exe
-
Size
3.1MB
-
MD5
14b871855a9046ef9aedeec80f9c2d86
-
SHA1
32c0ad34f524748b76c090fc881b75b928341e7e
-
SHA256
b14b916cd2f188ea09035489056e0bff9f8cb8e4a30eff50172f86319fabc940
-
SHA512
7ada8280b9a5a4dcb427da5f7634335c191645614148ed550dbbbacfaed72e1e99202caedddc02f48dc73d96bf0ecd4d35c2ed2d6206e9b25efba4f29dcc8e96
-
SSDEEP
49152:3v7lL26AaNeWgPhlmVqvMQ7XSKlfyCC4KgoGdulF8THHB72eh2NT:3vhL26AaNeWgPhlmVqkQ7XSKlfyg
Malware Config
Extracted
quasar
1.4.1
Office04
wefdwef-34180.portmap.host:34180
c4be1726-3f86-4f80-bc7c-0779b06ffeeb
-
encryption_key
97BF1FDCF446A7218FA05296FD8D8F0C41A6B1E7
-
install_name
Bootstrapper.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Spotify
-
subdirectory
system32
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2812-1-0x0000000000300000-0x0000000000624000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\system32\Bootstrapper.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Bootstrapper.exepid process 2392 Bootstrapper.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2212 schtasks.exe 1704 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Bootstrapper.exeBootstrapper.exedescription pid process Token: SeDebugPrivilege 2812 Bootstrapper.exe Token: SeDebugPrivilege 2392 Bootstrapper.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Bootstrapper.exepid process 2392 Bootstrapper.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Bootstrapper.exepid process 2392 Bootstrapper.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Bootstrapper.exepid process 2392 Bootstrapper.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Bootstrapper.exeBootstrapper.exedescription pid process target process PID 2812 wrote to memory of 2212 2812 Bootstrapper.exe schtasks.exe PID 2812 wrote to memory of 2212 2812 Bootstrapper.exe schtasks.exe PID 2812 wrote to memory of 2392 2812 Bootstrapper.exe Bootstrapper.exe PID 2812 wrote to memory of 2392 2812 Bootstrapper.exe Bootstrapper.exe PID 2392 wrote to memory of 1704 2392 Bootstrapper.exe schtasks.exe PID 2392 wrote to memory of 1704 2392 Bootstrapper.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Spotify" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system32\Bootstrapper.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2212 -
C:\Users\Admin\AppData\Roaming\system32\Bootstrapper.exe"C:\Users\Admin\AppData\Roaming\system32\Bootstrapper.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Spotify" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\system32\Bootstrapper.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b4e91d2e5f40d5e2586a86cf3bb4df24
SHA131920b3a41aa4400d4a0230a7622848789b38672
SHA2565d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
SHA512968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
-
Filesize
3.1MB
MD514b871855a9046ef9aedeec80f9c2d86
SHA132c0ad34f524748b76c090fc881b75b928341e7e
SHA256b14b916cd2f188ea09035489056e0bff9f8cb8e4a30eff50172f86319fabc940
SHA5127ada8280b9a5a4dcb427da5f7634335c191645614148ed550dbbbacfaed72e1e99202caedddc02f48dc73d96bf0ecd4d35c2ed2d6206e9b25efba4f29dcc8e96