Overview
overview
10Static
static
10AuroraALPH...2).exe
windows7-x64
10AuroraALPH...2).exe
windows10-1703-x64
10AuroraALPH...2).exe
windows10-2004-x64
10AuroraALPH...2).exe
windows11-21h2-x64
AuroraALPH...3).exe
windows7-x64
AuroraALPH...3).exe
windows10-1703-x64
10AuroraALPH...3).exe
windows10-2004-x64
AuroraALPH...3).exe
windows11-21h2-x64
10AuroraALPH...4).exe
windows7-x64
10AuroraALPH...4).exe
windows10-1703-x64
10AuroraALPH...4).exe
windows10-2004-x64
10AuroraALPH...4).exe
windows11-21h2-x64
10AuroraALPH...5).exe
windows7-x64
10AuroraALPH...5).exe
windows10-1703-x64
10AuroraALPH...5).exe
windows10-2004-x64
10AuroraALPH...5).exe
windows11-21h2-x64
10AuroraALPH...py.exe
windows7-x64
10AuroraALPH...py.exe
windows10-1703-x64
10AuroraALPH...py.exe
windows10-2004-x64
10AuroraALPH...py.exe
windows11-21h2-x64
10Analysis
-
max time kernel
436s -
max time network
1161s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
13-09-2024 18:56
Behavioral task
behavioral1
Sample
AuroraALPHABUILD.0-6 - Copy (2).exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
AuroraALPHABUILD.0-6 - Copy (2).exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
AuroraALPHABUILD.0-6 - Copy (2).exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
AuroraALPHABUILD.0-6 - Copy (2).exe
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
AuroraALPHABUILD.0-6 - Copy (3).exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
AuroraALPHABUILD.0-6 - Copy (3).exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
AuroraALPHABUILD.0-6 - Copy (3).exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
AuroraALPHABUILD.0-6 - Copy (3).exe
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
AuroraALPHABUILD.0-6 - Copy (4).exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
AuroraALPHABUILD.0-6 - Copy (4).exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
AuroraALPHABUILD.0-6 - Copy (4).exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
AuroraALPHABUILD.0-6 - Copy (4).exe
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
AuroraALPHABUILD.0-6 - Copy (5).exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
AuroraALPHABUILD.0-6 - Copy (5).exe
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
AuroraALPHABUILD.0-6 - Copy (5).exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
AuroraALPHABUILD.0-6 - Copy (5).exe
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
AuroraALPHABUILD.0-6 - Copy.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
AuroraALPHABUILD.0-6 - Copy.exe
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
AuroraALPHABUILD.0-6 - Copy.exe
Resource
win10v2004-20240802-en
General
-
Target
AuroraALPHABUILD.0-6 - Copy (5).exe
-
Size
231.7MB
-
MD5
3cda647a8948f3ac4df14abf6f1d62c1
-
SHA1
f4da28914a3938e7de76546bcf911f539672459a
-
SHA256
c905d2c1b9df641f12daab74948cef579aa92b6f07c36f97ed70146b615411c1
-
SHA512
77c0cd078ab2d2765237c3cc68a4872a81db653f1ad6a42122b786b27c7d48842577a65e88ad61e549e13b5be0df51e25b5f026089a19833e9da71f8c30c0cdd
-
SSDEEP
6144:0MNHXf500MU8zfjEm0beDmcCl/QOqNgJyCqv7cc:Rd505jwmZmcgSNgJyrv7cc
Malware Config
Extracted
quasar
1.3.0.0
gimp1
193.42.33.210:4444
gimpdns.ddns.net:4444
QSR_MUTEX_XwuUSTCgYhmnf6vJ1L
-
encryption_key
lRzFKjYQKUKzh6RyUYYQ
-
install_name
svchost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svchost
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral16/memory/1504-1-0x00000000009A0000-0x00000000009FE000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 3456 svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
schtasks.exesvchost.exeschtasks.exeschtasks.execmd.exechcp.comPING.EXEAuroraALPHABUILD.0-6 - Copy (5).exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AuroraALPHABUILD.0-6 - Copy (5).exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4808 schtasks.exe 1100 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AuroraALPHABUILD.0-6 - Copy (5).exesvchost.exedescription pid process Token: SeDebugPrivilege 1504 AuroraALPHABUILD.0-6 - Copy (5).exe Token: SeDebugPrivilege 3456 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 3456 svchost.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
AuroraALPHABUILD.0-6 - Copy (5).exesvchost.execmd.exedescription pid process target process PID 1504 wrote to memory of 4808 1504 AuroraALPHABUILD.0-6 - Copy (5).exe schtasks.exe PID 1504 wrote to memory of 4808 1504 AuroraALPHABUILD.0-6 - Copy (5).exe schtasks.exe PID 1504 wrote to memory of 4808 1504 AuroraALPHABUILD.0-6 - Copy (5).exe schtasks.exe PID 1504 wrote to memory of 3456 1504 AuroraALPHABUILD.0-6 - Copy (5).exe svchost.exe PID 1504 wrote to memory of 3456 1504 AuroraALPHABUILD.0-6 - Copy (5).exe svchost.exe PID 1504 wrote to memory of 3456 1504 AuroraALPHABUILD.0-6 - Copy (5).exe svchost.exe PID 3456 wrote to memory of 1100 3456 svchost.exe schtasks.exe PID 3456 wrote to memory of 1100 3456 svchost.exe schtasks.exe PID 3456 wrote to memory of 1100 3456 svchost.exe schtasks.exe PID 3456 wrote to memory of 2692 3456 svchost.exe schtasks.exe PID 3456 wrote to memory of 2692 3456 svchost.exe schtasks.exe PID 3456 wrote to memory of 2692 3456 svchost.exe schtasks.exe PID 3456 wrote to memory of 1048 3456 svchost.exe cmd.exe PID 3456 wrote to memory of 1048 3456 svchost.exe cmd.exe PID 3456 wrote to memory of 1048 3456 svchost.exe cmd.exe PID 1048 wrote to memory of 2484 1048 cmd.exe chcp.com PID 1048 wrote to memory of 2484 1048 cmd.exe chcp.com PID 1048 wrote to memory of 2484 1048 cmd.exe chcp.com PID 1048 wrote to memory of 3620 1048 cmd.exe PING.EXE PID 1048 wrote to memory of 3620 1048 cmd.exe PING.EXE PID 1048 wrote to memory of 3620 1048 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\AuroraALPHABUILD.0-6 - Copy (5).exe"C:\Users\Admin\AppData\Local\Temp\AuroraALPHABUILD.0-6 - Copy (5).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\AuroraALPHABUILD.0-6 - Copy (5).exe" /rl HIGHEST /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /delete /tn "svchost" /f3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mWi1OtyIiNQw.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\mWi1OtyIiNQw.batFilesize
263B
MD53a96edfc747cc280278d4a6962249605
SHA1724c531e0b4471a0ed452a90d6fc71e25472459f
SHA25684c2bb55d40158e553060c36f79bade2e6ca4503c53605532fb090372ff79af6
SHA512c829f6bb392d6bb36722ee60640e6887b717a9d65b27770a9121237cbee4bed3bc0b84ddfc305816e7d747851dacdb2ecd4bfe05fcc698be67a926b32f57d5d6
-
C:\Users\Admin\AppData\Roaming\Logs\09-13-~1Filesize
224B
MD554fa3984ae4bc36016d08225fc242614
SHA1f4a96fccc47f5d02fca5e8c7756567620923c6f2
SHA2560ed22740d7892a5bca073913a65c4b76655ff3fb6eec70c09b51eb7d4ef6b576
SHA5120de7bf3a14ec34836870464ade2745704c947156f5de7c8fcaed3151b2578fbc830ea04160ca1af7cc2d8d8e61347976728c46708b125b9132b15668aaf7e9f5
-
memory/1504-6-0x00000000061D0000-0x00000000061E2000-memory.dmpFilesize
72KB
-
memory/1504-3-0x0000000005510000-0x00000000055A2000-memory.dmpFilesize
584KB
-
memory/1504-4-0x0000000075040000-0x00000000757F1000-memory.dmpFilesize
7.7MB
-
memory/1504-5-0x00000000055B0000-0x0000000005616000-memory.dmpFilesize
408KB
-
memory/1504-0-0x000000007504E000-0x000000007504F000-memory.dmpFilesize
4KB
-
memory/1504-7-0x0000000006720000-0x000000000675C000-memory.dmpFilesize
240KB
-
memory/1504-15-0x0000000075040000-0x00000000757F1000-memory.dmpFilesize
7.7MB
-
memory/1504-2-0x0000000005A20000-0x0000000005FC6000-memory.dmpFilesize
5.6MB
-
memory/1504-1-0x00000000009A0000-0x00000000009FE000-memory.dmpFilesize
376KB
-
memory/3456-14-0x0000000075040000-0x00000000757F1000-memory.dmpFilesize
7.7MB
-
memory/3456-17-0x0000000006B20000-0x0000000006B2A000-memory.dmpFilesize
40KB
-
memory/3456-18-0x0000000075040000-0x00000000757F1000-memory.dmpFilesize
7.7MB
-
memory/3456-24-0x0000000075040000-0x00000000757F1000-memory.dmpFilesize
7.7MB