Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 21:22
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240705-en
General
-
Target
Client-built.exe
-
Size
3.3MB
-
MD5
9eb8732b560208f0380c386771aba096
-
SHA1
d2ae1ff6755e79f97485aea27912ed7710378b08
-
SHA256
d00477c11f3c8ad73a0ea9c3c4b7e549754ed63b645a3a8f57de6dd2f89ec8d0
-
SHA512
686b1968a19d6f81562df6efd659060ecc7d2eceb7b053d530e8bcba030db6e7b55cb7c6364d6dddc7ea9a46b5004cae3a78db5b432ed279ce2fa854fa400b8a
-
SSDEEP
49152:B6LFXL5Z8hlPKxXavF01l+5I2jPTHHB72eh2NT1:B6p5Z8hlPKxXavFkl0M
Malware Config
Extracted
quasar
1.4.1
SKIDS
147.185.221.22:6712
9dcff5fc-a88b-409b-a00a-590c080de54a
-
encryption_key
5678253D7FFD68D83D55A584486F1015D2B1BC30
-
install_name
Windows Host Process.exe
-
log_directory
Windows-Logs
-
reconnect_delay
3000
-
startup_key
Windows Host Process
-
subdirectory
Windows
Signatures
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/2932-1-0x0000000000060000-0x00000000003B8000-memory.dmp family_quasar behavioral2/files/0x00080000000234c6-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 3008 Windows Host Process.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\Windows\Windows Host Process.exe Client-built.exe File opened for modification C:\Windows\system32\Windows Client-built.exe File opened for modification C:\Windows\system32\Windows\Windows Host Process.exe Windows Host Process.exe File opened for modification C:\Windows\system32\Windows Windows Host Process.exe File created C:\Windows\system32\Windows\Windows Host Process.exe Client-built.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1552 schtasks.exe 2896 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2932 Client-built.exe Token: SeDebugPrivilege 3008 Windows Host Process.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 3008 Windows Host Process.exe 3008 Windows Host Process.exe 3008 Windows Host Process.exe 3008 Windows Host Process.exe 3008 Windows Host Process.exe 3008 Windows Host Process.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 3008 Windows Host Process.exe 3008 Windows Host Process.exe 3008 Windows Host Process.exe 3008 Windows Host Process.exe 3008 Windows Host Process.exe 3008 Windows Host Process.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3008 Windows Host Process.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2932 wrote to memory of 1552 2932 Client-built.exe 87 PID 2932 wrote to memory of 1552 2932 Client-built.exe 87 PID 2932 wrote to memory of 3008 2932 Client-built.exe 89 PID 2932 wrote to memory of 3008 2932 Client-built.exe 89 PID 3008 wrote to memory of 2896 3008 Windows Host Process.exe 90 PID 3008 wrote to memory of 2896 3008 Windows Host Process.exe 90 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1552
-
-
C:\Windows\system32\Windows\Windows Host Process.exe"C:\Windows\system32\Windows\Windows Host Process.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2896
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD59eb8732b560208f0380c386771aba096
SHA1d2ae1ff6755e79f97485aea27912ed7710378b08
SHA256d00477c11f3c8ad73a0ea9c3c4b7e549754ed63b645a3a8f57de6dd2f89ec8d0
SHA512686b1968a19d6f81562df6efd659060ecc7d2eceb7b053d530e8bcba030db6e7b55cb7c6364d6dddc7ea9a46b5004cae3a78db5b432ed279ce2fa854fa400b8a