Analysis
-
max time kernel
435s -
max time network
436s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 21:25
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240705-en
General
-
Target
Client-built.exe
-
Size
3.3MB
-
MD5
9eb8732b560208f0380c386771aba096
-
SHA1
d2ae1ff6755e79f97485aea27912ed7710378b08
-
SHA256
d00477c11f3c8ad73a0ea9c3c4b7e549754ed63b645a3a8f57de6dd2f89ec8d0
-
SHA512
686b1968a19d6f81562df6efd659060ecc7d2eceb7b053d530e8bcba030db6e7b55cb7c6364d6dddc7ea9a46b5004cae3a78db5b432ed279ce2fa854fa400b8a
-
SSDEEP
49152:B6LFXL5Z8hlPKxXavF01l+5I2jPTHHB72eh2NT1:B6p5Z8hlPKxXavFkl0M
Malware Config
Extracted
quasar
1.4.1
SKIDS
147.185.221.22:6712
9dcff5fc-a88b-409b-a00a-590c080de54a
-
encryption_key
5678253D7FFD68D83D55A584486F1015D2B1BC30
-
install_name
Windows Host Process.exe
-
log_directory
Windows-Logs
-
reconnect_delay
3000
-
startup_key
Windows Host Process
-
subdirectory
Windows
Signatures
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/5080-1-0x0000000000790000-0x0000000000AE8000-memory.dmp family_quasar behavioral2/files/0x000700000002341c-6.dat family_quasar -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1912 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation Windows Host Process.exe -
Executes dropped EXE 1 IoCs
pid Process 3896 Windows Host Process.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\system32\Windows\Windows Host Process.exe Client-built.exe File opened for modification C:\Windows\system32\Windows\Windows Host Process.exe Client-built.exe File opened for modification C:\Windows\system32\Windows Client-built.exe File opened for modification C:\Windows\system32\Windows\Windows Host Process.exe Windows Host Process.exe File opened for modification C:\Windows\system32\Windows Windows Host Process.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1360 PING.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings explorer.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1360 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1368 schtasks.exe 4968 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1912 powershell.exe 1912 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5080 Client-built.exe Token: SeDebugPrivilege 3896 Windows Host Process.exe Token: SeDebugPrivilege 1912 powershell.exe -
Suspicious use of FindShellTrayWindow 13 IoCs
pid Process 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe 3896 Windows Host Process.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3896 Windows Host Process.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 5080 wrote to memory of 1368 5080 Client-built.exe 89 PID 5080 wrote to memory of 1368 5080 Client-built.exe 89 PID 5080 wrote to memory of 3896 5080 Client-built.exe 91 PID 5080 wrote to memory of 3896 5080 Client-built.exe 91 PID 3896 wrote to memory of 4968 3896 Windows Host Process.exe 94 PID 3896 wrote to memory of 4968 3896 Windows Host Process.exe 94 PID 3896 wrote to memory of 1912 3896 Windows Host Process.exe 106 PID 3896 wrote to memory of 1912 3896 Windows Host Process.exe 106 PID 3896 wrote to memory of 1488 3896 Windows Host Process.exe 128 PID 3896 wrote to memory of 1488 3896 Windows Host Process.exe 128 PID 3896 wrote to memory of 4604 3896 Windows Host Process.exe 130 PID 3896 wrote to memory of 4604 3896 Windows Host Process.exe 130 PID 4604 wrote to memory of 1520 4604 cmd.exe 132 PID 4604 wrote to memory of 1520 4604 cmd.exe 132 PID 4604 wrote to memory of 1360 4604 cmd.exe 133 PID 4604 wrote to memory of 1360 4604 cmd.exe 133 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1368
-
-
C:\Windows\system32\Windows\Windows Host Process.exe"C:\Windows\system32\Windows\Windows Host Process.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4968
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /delete /tn "Windows Host Process" /f3⤵PID:1488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uCTdtSDvidJt.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\system32\chcp.comchcp 650014⤵PID:1520
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1360
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:840
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:208
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
215B
MD5965c829039f3d549a5905a168ee34311
SHA1dc572eeb4e27bb6892ed39ae05506bf76c9c2a38
SHA256b17acacbd92259fbab080f8d284f6b971493561f8b7243972309289949a9d522
SHA5126045c9a65cdaa78222dc3eab4320522fe868077d635c8aecf8effcdadd2219747cdfad67175ecc061e88b94465664b1401091a5fa65cba7f3006f27b39b37fae
-
Filesize
3.3MB
MD59eb8732b560208f0380c386771aba096
SHA1d2ae1ff6755e79f97485aea27912ed7710378b08
SHA256d00477c11f3c8ad73a0ea9c3c4b7e549754ed63b645a3a8f57de6dd2f89ec8d0
SHA512686b1968a19d6f81562df6efd659060ecc7d2eceb7b053d530e8bcba030db6e7b55cb7c6364d6dddc7ea9a46b5004cae3a78db5b432ed279ce2fa854fa400b8a