Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
04-11-2024 05:05
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
0e3a741ba36201716079c915282ce457
-
SHA1
0b46da777889b26338525adcc5f1a0fc2c1f27e3
-
SHA256
bc9d7ab160ae768a0d7cddd828e23c7d97dacae1f0adf71f86f3157931c2575c
-
SHA512
1beeb0fe665b0a236a142132f47d2d248f2b825d9e600e8d9a3ad5f3691aa982a93dc7828c4b06ee84e7fe40b6447c79da887f98e200304a04ef1f103ff7237c
-
SSDEEP
49152:bv2I22SsaNYfdPBldt698dBcjHkhCmYmzUloGdYITHHB72eh2NT:bvb22SsaNYfdPBldt6+dBcjHkhCmA
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Víctima
C2
crismulticuenta-30512.portmap.host:30512
Mutex
d7480f6f-e85f-4b68-8813-8279e2e6cb96
Attributes
-
encryption_key
8497DDBEB7064872EF356A0D1A58DE488578E1E0
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Updater
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/404-1-0x0000000000670000-0x0000000000994000-memory.dmp family_quasar -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid Process 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid Process 2812 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Client-built.exetaskmgr.exedescription pid Process Token: SeDebugPrivilege 404 Client-built.exe Token: SeDebugPrivilege 2812 taskmgr.exe Token: SeSystemProfilePrivilege 2812 taskmgr.exe Token: SeCreateGlobalPrivilege 2812 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe 2812 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Client-built.exedescription pid Process procid_target PID 404 wrote to memory of 388 404 Client-built.exe 84 PID 404 wrote to memory of 388 404 Client-built.exe 84 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:388
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2812