Analysis
-
max time kernel
210s -
max time network
211s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09-08-2024 16:06
Behavioral task
behavioral1
Sample
RD_VSetup1.41.exe
Resource
win7-20240704-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
RD_VSetup1.41.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
RD_VSetup1.41.exe
-
Size
3.3MB
-
MD5
094452bdd14c5acce6a8e5cb16f39fac
-
SHA1
f7c55189d66bb0722bc00af7b400d66b6caa8779
-
SHA256
eea939e6d9dae292703d7d5b634938cfe4a00db8115daf9c3c4148afd8895eef
-
SHA512
4dde7c1083b658b943cbb50e95c6fd8fe547512eb11cdfd1f1d0fe9f1552b968f6cbf30fbfb8829cba65e00504abe63c39c0c9680cd8d0c945c56e1fe8a96d67
-
SSDEEP
49152:fvLI22SsaNYfdPBldt698dBcjH20ymSmzDwoGdeBTHHB72eh2NTc:fv022SsaNYfdPBldt6+dBcjH/ym8+
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
RemixThatTing
C2
192.168.1.1:4782
Mutex
2853cd92-f829-4151-a3ab-a32a77b6bfd1
Attributes
-
encryption_key
1C048FBC4D2C47C8039B5C30AAA4E3E12C03AE02
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Java Updater v.1.4.1
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
resource yara_rule behavioral1/memory/1848-1-0x0000000000070000-0x00000000003C2000-memory.dmp family_quasar -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3052 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2976 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1848 RD_VSetup1.41.exe Token: SeDebugPrivilege 2976 taskmgr.exe Token: SeDebugPrivilege 2728 RD_VSetup1.41.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 1848 RD_VSetup1.41.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 1848 RD_VSetup1.41.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1848 RD_VSetup1.41.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1848 wrote to memory of 3052 1848 RD_VSetup1.41.exe 31 PID 1848 wrote to memory of 3052 1848 RD_VSetup1.41.exe 31 PID 1848 wrote to memory of 3052 1848 RD_VSetup1.41.exe 31 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RD_VSetup1.41.exe"C:\Users\Admin\AppData\Local\Temp\RD_VSetup1.41.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Java Updater v.1.4.1" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3052
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2976
-
C:\Users\Admin\AppData\Local\Temp\RD_VSetup1.41.exe"C:\Users\Admin\AppData\Local\Temp\RD_VSetup1.41.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728