Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/10/2024, 19:24
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
General
- Target Client-built.exe
- Size 3.1MB
- Sample241014-x4rsrasbkh
- SHA256 f9064f9b926ee57799da20b7e6062e5a118cca9d12b20781dbdcc5de53f9c0ab
- MD5 c94b7455fd3516fba1e10982efe6976e
- SHA1 bf82227c38f5f2f6f53120bde3ac86904dbc0e82
- SHA512 8e103c43d5f71042d6d8a2b5ceb0701b3593a1d29b92d9caef6e833303ed33b8bb50fa10233dc7bb9f31ac28d785f403f58f16db53cd11ac3bc49badd97aa137
- SSDEEP 49152:IvwI22SsaNYfdPBldt698dBcjH64mamzStoGdAjTHHB72eh2NT:IvN22SsaNYfdPBldt6+dBcjH64m6
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
Alessandrolol66-30592.portmap.host:30592
Mutex
-
730dd576-083f-43b6-af44-22840d333bbd
Attributes
-
encryption_key
B11D992865826F9FDFE1488DBCF3B1031C9ED9CB
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows.Sys
-
subdirectory
SubDir
Signatures
- Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/468-1-0x0000000000C90000-0x0000000000FB4000-memory.dmp family_quasar behavioral2/files/0x0008000000023c84-5.dat family_quasar - Executes dropped EXE 1 IoCs
pid Process 2272 Client.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2340 schtasks.exe 4684 schtasks.exe - Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 468 Client-built.exe Token: SeDebugPrivilege 2272 Client.exe Token: SeDebugPrivilege 4204 Client-built.exe Token: SeDebugPrivilege 2208 Client-built.exe Token: SeDebugPrivilege 4816 Client-built.exe Token: SeDebugPrivilege 4580 taskmgr.exe Token: SeSystemProfilePrivilege 4580 taskmgr.exe Token: SeCreateGlobalPrivilege 4580 taskmgr.exe Token: 33 4580 taskmgr.exe Token: SeIncBasePriorityPrivilege 4580 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2272 Client.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2272 Client.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe 4580 taskmgr.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 468 wrote to memory of 2340 468 Client-built.exe 87 PID 468 wrote to memory of 2340 468 Client-built.exe 87 PID 468 wrote to memory of 2272 468 Client-built.exe 89 PID 468 wrote to memory of 2272 468 Client-built.exe 89 PID 2272 wrote to memory of 4684 2272 Client.exe 90 PID 2272 wrote to memory of 4684 2272 Client.exe 90 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows.Sys" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2340
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows.Sys" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4684
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4204
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4816
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client-built.exe.log
- Size 1KB
- SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
- MD5 baf55b95da4a601229647f25dad12878
- SHA1 abc16954ebfd213733c4493fc1910164d825cac8
- SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
- Size 3.1MB
- SHA256 f9064f9b926ee57799da20b7e6062e5a118cca9d12b20781dbdcc5de53f9c0ab
- MD5 c94b7455fd3516fba1e10982efe6976e
- SHA1 bf82227c38f5f2f6f53120bde3ac86904dbc0e82
- SHA512 8e103c43d5f71042d6d8a2b5ceb0701b3593a1d29b92d9caef6e833303ed33b8bb50fa10233dc7bb9f31ac28d785f403f58f16db53cd11ac3bc49badd97aa137
- SSDEEP 49152:IvwI22SsaNYfdPBldt698dBcjH64mamzStoGdAjTHHB72eh2NT:IvN22SsaNYfdPBldt6+dBcjH64m6
- MD5 SHA1 SHA512 SSDEEP