Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 22:09
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240705-en
General
-
Target
Client-built.exe
-
Size
3.4MB
-
MD5
58587e08cc617fb97526bfbac57b62e8
-
SHA1
bd38f26aa6541b07a510d0a064b5c7235c9c8a5b
-
SHA256
7a85eb78ce7c9487c6d2aa0ffcb569687accf73377cc1e6ce8123a15345cd7aa
-
SHA512
b0ecdbe15b1fd4d2e190c285c14d1e454e9192105698f0d89952999a13b2b238128326eaf243e29c13c8d1c1e8372c7b6d735c92374921e2740fdd91d91da525
-
SSDEEP
49152:k6LFXL5Z8hlPKxXava0n+g5I2j1THHB72eh2NT1Yq:k6p5Z8hlPKxXava0+KOY
Malware Config
Extracted
quasar
1.4.1
RAN
147.185.221.22:10340
541c4371-7091-40eb-8fd1-2973b63dd560
-
encryption_key
45428D99D260D9C913112BDB878C52EA244CE0DB
-
install_name
Windows Host Process.exe
-
log_directory
Windows-Logs
-
reconnect_delay
3000
-
startup_key
Windows Host Process
-
subdirectory
Windows
Signatures
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/1984-1-0x0000000001280000-0x00000000015E6000-memory.dmp family_quasar behavioral1/files/0x0009000000016433-6.dat family_quasar behavioral1/memory/1376-9-0x00000000010D0000-0x0000000001436000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 1376 Windows Host Process.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\Windows\Windows Host Process.exe Windows Host Process.exe File opened for modification C:\Windows\system32\Windows Windows Host Process.exe File created C:\Windows\system32\Windows\Windows Host Process.exe Client-built.exe File opened for modification C:\Windows\system32\Windows\Windows Host Process.exe Client-built.exe File opened for modification C:\Windows\system32\Windows Client-built.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2860 schtasks.exe 2512 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1984 Client-built.exe Token: SeDebugPrivilege 1376 Windows Host Process.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1376 Windows Host Process.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1376 Windows Host Process.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1376 Windows Host Process.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2860 1984 Client-built.exe 30 PID 1984 wrote to memory of 2860 1984 Client-built.exe 30 PID 1984 wrote to memory of 2860 1984 Client-built.exe 30 PID 1984 wrote to memory of 1376 1984 Client-built.exe 32 PID 1984 wrote to memory of 1376 1984 Client-built.exe 32 PID 1984 wrote to memory of 1376 1984 Client-built.exe 32 PID 1376 wrote to memory of 2512 1376 Windows Host Process.exe 33 PID 1376 wrote to memory of 2512 1376 Windows Host Process.exe 33 PID 1376 wrote to memory of 2512 1376 Windows Host Process.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2860
-
-
C:\Windows\system32\Windows\Windows Host Process.exe"C:\Windows\system32\Windows\Windows Host Process.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2512
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD558587e08cc617fb97526bfbac57b62e8
SHA1bd38f26aa6541b07a510d0a064b5c7235c9c8a5b
SHA2567a85eb78ce7c9487c6d2aa0ffcb569687accf73377cc1e6ce8123a15345cd7aa
SHA512b0ecdbe15b1fd4d2e190c285c14d1e454e9192105698f0d89952999a13b2b238128326eaf243e29c13c8d1c1e8372c7b6d735c92374921e2740fdd91d91da525