Overview
overview
10Static
static
10AuroraALPH...2).exe
windows7-x64
10AuroraALPH...2).exe
windows10-1703-x64
10AuroraALPH...2).exe
windows10-2004-x64
10AuroraALPH...2).exe
windows11-21h2-x64
AuroraALPH...3).exe
windows7-x64
AuroraALPH...3).exe
windows10-1703-x64
10AuroraALPH...3).exe
windows10-2004-x64
AuroraALPH...3).exe
windows11-21h2-x64
10AuroraALPH...4).exe
windows7-x64
10AuroraALPH...4).exe
windows10-1703-x64
10AuroraALPH...4).exe
windows10-2004-x64
10AuroraALPH...4).exe
windows11-21h2-x64
10AuroraALPH...5).exe
windows7-x64
10AuroraALPH...5).exe
windows10-1703-x64
10AuroraALPH...5).exe
windows10-2004-x64
10AuroraALPH...5).exe
windows11-21h2-x64
10AuroraALPH...py.exe
windows7-x64
10AuroraALPH...py.exe
windows10-1703-x64
10AuroraALPH...py.exe
windows10-2004-x64
10AuroraALPH...py.exe
windows11-21h2-x64
10Analysis
-
max time kernel
314s -
max time network
867s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
13-09-2024 18:56
Behavioral task
behavioral1
Sample
AuroraALPHABUILD.0-6 - Copy (2).exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
AuroraALPHABUILD.0-6 - Copy (2).exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
AuroraALPHABUILD.0-6 - Copy (2).exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
AuroraALPHABUILD.0-6 - Copy (2).exe
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
AuroraALPHABUILD.0-6 - Copy (3).exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
AuroraALPHABUILD.0-6 - Copy (3).exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
AuroraALPHABUILD.0-6 - Copy (3).exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
AuroraALPHABUILD.0-6 - Copy (3).exe
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
AuroraALPHABUILD.0-6 - Copy (4).exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
AuroraALPHABUILD.0-6 - Copy (4).exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
AuroraALPHABUILD.0-6 - Copy (4).exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
AuroraALPHABUILD.0-6 - Copy (4).exe
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
AuroraALPHABUILD.0-6 - Copy (5).exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
AuroraALPHABUILD.0-6 - Copy (5).exe
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
AuroraALPHABUILD.0-6 - Copy (5).exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
AuroraALPHABUILD.0-6 - Copy (5).exe
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
AuroraALPHABUILD.0-6 - Copy.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
AuroraALPHABUILD.0-6 - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
AuroraALPHABUILD.0-6 - Copy.exe
Resource
win10v2004-20240802-en
General
-
Target
AuroraALPHABUILD.0-6 - Copy (5).exe
-
Size
231.7MB
-
MD5
3cda647a8948f3ac4df14abf6f1d62c1
-
SHA1
f4da28914a3938e7de76546bcf911f539672459a
-
SHA256
c905d2c1b9df641f12daab74948cef579aa92b6f07c36f97ed70146b615411c1
-
SHA512
77c0cd078ab2d2765237c3cc68a4872a81db653f1ad6a42122b786b27c7d48842577a65e88ad61e549e13b5be0df51e25b5f026089a19833e9da71f8c30c0cdd
-
SSDEEP
6144:0MNHXf500MU8zfjEm0beDmcCl/QOqNgJyCqv7cc:Rd505jwmZmcgSNgJyrv7cc
Malware Config
Extracted
quasar
1.3.0.0
gimp1
193.42.33.210:4444
gimpdns.ddns.net:4444
QSR_MUTEX_XwuUSTCgYhmnf6vJ1L
-
encryption_key
lRzFKjYQKUKzh6RyUYYQ
-
install_name
svchost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svchost
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral14/memory/2948-1-0x0000000000150000-0x00000000001AE000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 3112 svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
PING.EXEAuroraALPHABUILD.0-6 - Copy (5).exeschtasks.exesvchost.exeschtasks.exeschtasks.execmd.exechcp.comdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AuroraALPHABUILD.0-6 - Copy (5).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 408 schtasks.exe 8 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AuroraALPHABUILD.0-6 - Copy (5).exesvchost.exedescription pid process Token: SeDebugPrivilege 2948 AuroraALPHABUILD.0-6 - Copy (5).exe Token: SeDebugPrivilege 3112 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 3112 svchost.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
AuroraALPHABUILD.0-6 - Copy (5).exesvchost.execmd.exedescription pid process target process PID 2948 wrote to memory of 408 2948 AuroraALPHABUILD.0-6 - Copy (5).exe schtasks.exe PID 2948 wrote to memory of 408 2948 AuroraALPHABUILD.0-6 - Copy (5).exe schtasks.exe PID 2948 wrote to memory of 408 2948 AuroraALPHABUILD.0-6 - Copy (5).exe schtasks.exe PID 2948 wrote to memory of 3112 2948 AuroraALPHABUILD.0-6 - Copy (5).exe svchost.exe PID 2948 wrote to memory of 3112 2948 AuroraALPHABUILD.0-6 - Copy (5).exe svchost.exe PID 2948 wrote to memory of 3112 2948 AuroraALPHABUILD.0-6 - Copy (5).exe svchost.exe PID 3112 wrote to memory of 8 3112 svchost.exe schtasks.exe PID 3112 wrote to memory of 8 3112 svchost.exe schtasks.exe PID 3112 wrote to memory of 8 3112 svchost.exe schtasks.exe PID 3112 wrote to memory of 3320 3112 svchost.exe schtasks.exe PID 3112 wrote to memory of 3320 3112 svchost.exe schtasks.exe PID 3112 wrote to memory of 3320 3112 svchost.exe schtasks.exe PID 3112 wrote to memory of 4892 3112 svchost.exe cmd.exe PID 3112 wrote to memory of 4892 3112 svchost.exe cmd.exe PID 3112 wrote to memory of 4892 3112 svchost.exe cmd.exe PID 4892 wrote to memory of 4180 4892 cmd.exe chcp.com PID 4892 wrote to memory of 4180 4892 cmd.exe chcp.com PID 4892 wrote to memory of 4180 4892 cmd.exe chcp.com PID 4892 wrote to memory of 4088 4892 cmd.exe PING.EXE PID 4892 wrote to memory of 4088 4892 cmd.exe PING.EXE PID 4892 wrote to memory of 4088 4892 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\AuroraALPHABUILD.0-6 - Copy (5).exe"C:\Users\Admin\AppData\Local\Temp\AuroraALPHABUILD.0-6 - Copy (5).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\AuroraALPHABUILD.0-6 - Copy (5).exe" /rl HIGHEST /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /delete /tn "svchost" /f3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lo47dEVP2AO2.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lo47dEVP2AO2.batFilesize
263B
MD592886753146f77dc4470525977950a30
SHA1bf1d6360c92b9a5751d455dfa1b49d4f7195b474
SHA2563546509ec20d3fb65e4a300628e7c5e2f06d8f54ee7f3ca205e43b583e9b3df7
SHA51286a952da7a2fe33161fe52fd65a2424a4b123ba6eda9d8d129b23e4b1b16dfe8b267bb682b77528b6f90603551cf15b997fe21d42eedd6da642b39a327387ca8
-
C:\Users\Admin\AppData\Roaming\Logs\09-13-~1Filesize
224B
MD5ad88d24f7c02151ad05c5d177c0fa049
SHA1aa5196355612ba3529c4410ac33fc59ef1e16eab
SHA256cf772bf5c6520e642bd05c3cc7c7046fc1a2f72043a9a6bc56e839d83e77d932
SHA5127d03c75c01fb4e31f3990c54f5ae4a86d32148ae9340664bbd9493ffbf4dd29ca3ba3fc391284f8440ca302f1c2288b6d02cac57f0bab3a0be143aa9d2ab31fa
-
memory/2948-1-0x0000000000150000-0x00000000001AE000-memory.dmpFilesize
376KB
-
memory/2948-2-0x0000000004F70000-0x000000000546E000-memory.dmpFilesize
5.0MB
-
memory/2948-3-0x0000000004A70000-0x0000000004B02000-memory.dmpFilesize
584KB
-
memory/2948-4-0x0000000073240000-0x000000007392E000-memory.dmpFilesize
6.9MB
-
memory/2948-5-0x0000000004B10000-0x0000000004B76000-memory.dmpFilesize
408KB
-
memory/2948-6-0x0000000005670000-0x0000000005682000-memory.dmpFilesize
72KB
-
memory/2948-7-0x0000000005A60000-0x0000000005A9E000-memory.dmpFilesize
248KB
-
memory/2948-0-0x000000007324E000-0x000000007324F000-memory.dmpFilesize
4KB
-
memory/2948-14-0x0000000073240000-0x000000007392E000-memory.dmpFilesize
6.9MB
-
memory/3112-15-0x0000000073240000-0x000000007392E000-memory.dmpFilesize
6.9MB
-
memory/3112-19-0x0000000073240000-0x000000007392E000-memory.dmpFilesize
6.9MB
-
memory/3112-18-0x00000000072C0000-0x00000000072CA000-memory.dmpFilesize
40KB
-
memory/3112-25-0x0000000073240000-0x000000007392E000-memory.dmpFilesize
6.9MB
-
memory/3112-16-0x0000000073240000-0x000000007392E000-memory.dmpFilesize
6.9MB