Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
31-10-2024 00:26
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
dca77ba52c9e20bdb3fcb81657918f89
-
SHA1
7cec39d83783008bb9a151b2a71dbc1eb03a7bbf
-
SHA256
fc564833b7c6fc4e991eb80e075d1c36306b9828172609ad311216ec5fc647f4
-
SHA512
30fe235a26fe74a1fe27caafe059ee5463790252b046a5e467a0d938f1b77a05c0850a37883066a0d4c7bbd11f1bf36bf7a35e4ef3da86d4f7b2c240f2d8929a
-
SSDEEP
49152:uv3I22SsaNYfdPBldt698dBcjHOezFXear1QoGdiWTHHB72eh2NT:uv422SsaNYfdPBldt6+dBcjHXZXK
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
10.127.1.2:1604
Mutex
93b40a09-fbd7-4b29-8423-560b40061e4f
Attributes
-
encryption_key
55EAC2BE7559DA6721E45ED8C2349D6EFC3C9EE2
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/3152-1-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar behavioral1/files/0x002800000004504e-3.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 3784 Client.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3284 schtasks.exe 2096 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3152 Client-built.exe Token: SeDebugPrivilege 3784 Client.exe Token: SeDebugPrivilege 1404 taskmgr.exe Token: SeSystemProfilePrivilege 1404 taskmgr.exe Token: SeCreateGlobalPrivilege 1404 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3784 Client.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3784 Client.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe 1404 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3152 wrote to memory of 2096 3152 Client-built.exe 84 PID 3152 wrote to memory of 2096 3152 Client-built.exe 84 PID 3152 wrote to memory of 3784 3152 Client-built.exe 86 PID 3152 wrote to memory of 3784 3152 Client-built.exe 86 PID 3784 wrote to memory of 3284 3784 Client.exe 87 PID 3784 wrote to memory of 3284 3784 Client.exe 87 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2096
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3284
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5dca77ba52c9e20bdb3fcb81657918f89
SHA17cec39d83783008bb9a151b2a71dbc1eb03a7bbf
SHA256fc564833b7c6fc4e991eb80e075d1c36306b9828172609ad311216ec5fc647f4
SHA51230fe235a26fe74a1fe27caafe059ee5463790252b046a5e467a0d938f1b77a05c0850a37883066a0d4c7bbd11f1bf36bf7a35e4ef3da86d4f7b2c240f2d8929a