Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 19:55
Behavioral task
behavioral1
Sample
PepperX.exe
Resource
win7-20240704-en
General
-
Target
PepperX.exe
-
Size
3.1MB
-
MD5
2ed601b0043d457f70fff1f1846acebb
-
SHA1
7c1a93357661d9b7ae82f570db12267b0163dc75
-
SHA256
fcece45f00b710bd5cb01a2a79781c871f1bd36fac18e00e85bd6452ecd5eadd
-
SHA512
36abc1f2c857e6d266b8bf7544f9f7bae9d1d8b96487588c0c7bb20f725323d12979831de4616d7af59424b4d2851359b2f2f5e97845585da6e7b18902f90d72
-
SSDEEP
49152:UvBt62XlaSFNWPjljiFa2RoUYIObKpF5MheLoG8oTHHB72eh2NT:Uvr62XlaSFNWPjljiFXRoUYI6KpFJ
Malware Config
Extracted
quasar
1.4.1
PepperX
73.190.43.125:4782
88509de8-78d9-4efe-9597-51afc31df588
-
encryption_key
76CFB69AF5F0F8C3D00E4C97AA198CA6E956A019
-
install_name
PepperX.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/1044-1-0x0000000000660000-0x0000000000984000-memory.dmp family_quasar behavioral2/files/0x00070000000234d3-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 3680 PepperX.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\SubDir PepperX.exe File created C:\Windows\system32\SubDir\PepperX.exe PepperX.exe File opened for modification C:\Windows\system32\SubDir\PepperX.exe PepperX.exe File opened for modification C:\Windows\system32\SubDir PepperX.exe File opened for modification C:\Windows\system32\SubDir\PepperX.exe PepperX.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 628 schtasks.exe 2924 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1044 PepperX.exe Token: SeDebugPrivilege 3680 PepperX.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3680 PepperX.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1044 wrote to memory of 628 1044 PepperX.exe 87 PID 1044 wrote to memory of 628 1044 PepperX.exe 87 PID 1044 wrote to memory of 3680 1044 PepperX.exe 89 PID 1044 wrote to memory of 3680 1044 PepperX.exe 89 PID 3680 wrote to memory of 2924 3680 PepperX.exe 90 PID 3680 wrote to memory of 2924 3680 PepperX.exe 90 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PepperX.exe"C:\Users\Admin\AppData\Local\Temp\PepperX.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Windows\system32\SubDir\PepperX.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:628
-
-
C:\Windows\system32\SubDir\PepperX.exe"C:\Windows\system32\SubDir\PepperX.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Windows\system32\SubDir\PepperX.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2924
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
3.1MB
MD52ed601b0043d457f70fff1f1846acebb
SHA17c1a93357661d9b7ae82f570db12267b0163dc75
SHA256fcece45f00b710bd5cb01a2a79781c871f1bd36fac18e00e85bd6452ecd5eadd
SHA51236abc1f2c857e6d266b8bf7544f9f7bae9d1d8b96487588c0c7bb20f725323d12979831de4616d7af59424b4d2851359b2f2f5e97845585da6e7b18902f90d72