Analysis
-
max time kernel
125s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 19:55
Behavioral task
behavioral1
Sample
PepperX.exe
Resource
win7-20240704-en
General
-
Target
PepperX.exe
-
Size
3.1MB
-
MD5
2ed601b0043d457f70fff1f1846acebb
-
SHA1
7c1a93357661d9b7ae82f570db12267b0163dc75
-
SHA256
fcece45f00b710bd5cb01a2a79781c871f1bd36fac18e00e85bd6452ecd5eadd
-
SHA512
36abc1f2c857e6d266b8bf7544f9f7bae9d1d8b96487588c0c7bb20f725323d12979831de4616d7af59424b4d2851359b2f2f5e97845585da6e7b18902f90d72
-
SSDEEP
49152:UvBt62XlaSFNWPjljiFa2RoUYIObKpF5MheLoG8oTHHB72eh2NT:Uvr62XlaSFNWPjljiFXRoUYI6KpFJ
Malware Config
Extracted
quasar
1.4.1
PepperX
73.190.43.125:4782
88509de8-78d9-4efe-9597-51afc31df588
-
encryption_key
76CFB69AF5F0F8C3D00E4C97AA198CA6E956A019
-
install_name
PepperX.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows
-
subdirectory
SubDir
Signatures
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2636-1-0x0000000000B60000-0x0000000000E84000-memory.dmp family_quasar behavioral1/files/0x0008000000016ccd-6.dat family_quasar behavioral1/memory/3068-8-0x00000000011B0000-0x00000000014D4000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 3068 PepperX.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\SubDir\PepperX.exe PepperX.exe File opened for modification C:\Windows\system32\SubDir PepperX.exe File opened for modification C:\Windows\system32\SubDir\PepperX.exe PepperX.exe File opened for modification C:\Windows\system32\SubDir PepperX.exe File created C:\Windows\system32\SubDir\PepperX.exe PepperX.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2712 schtasks.exe 2864 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2636 PepperX.exe Token: SeDebugPrivilege 3068 PepperX.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3068 PepperX.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2712 2636 PepperX.exe 30 PID 2636 wrote to memory of 2712 2636 PepperX.exe 30 PID 2636 wrote to memory of 2712 2636 PepperX.exe 30 PID 2636 wrote to memory of 3068 2636 PepperX.exe 32 PID 2636 wrote to memory of 3068 2636 PepperX.exe 32 PID 2636 wrote to memory of 3068 2636 PepperX.exe 32 PID 3068 wrote to memory of 2864 3068 PepperX.exe 33 PID 3068 wrote to memory of 2864 3068 PepperX.exe 33 PID 3068 wrote to memory of 2864 3068 PepperX.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PepperX.exe"C:\Users\Admin\AppData\Local\Temp\PepperX.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Windows\system32\SubDir\PepperX.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2712
-
-
C:\Windows\system32\SubDir\PepperX.exe"C:\Windows\system32\SubDir\PepperX.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Windows\system32\SubDir\PepperX.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2864
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD52ed601b0043d457f70fff1f1846acebb
SHA17c1a93357661d9b7ae82f570db12267b0163dc75
SHA256fcece45f00b710bd5cb01a2a79781c871f1bd36fac18e00e85bd6452ecd5eadd
SHA51236abc1f2c857e6d266b8bf7544f9f7bae9d1d8b96487588c0c7bb20f725323d12979831de4616d7af59424b4d2851359b2f2f5e97845585da6e7b18902f90d72