Analysis
-
max time kernel
1034s -
max time network
1050s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
05-11-2024 04:29
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
fef7fc18a56919307292dad1b0481e8e
-
SHA1
1b4cc3b74a2c5c43cad76cf12f7b03dafe6dad3a
-
SHA256
d2422e4e839fa1da5bdb80a4762ba07c26c6134eb9f00e691894ec5312024c83
-
SHA512
6fd9b368c64364b28e35a972fe5dc25f3afc3ce13ab4bb8764c9a80018bf97b1c6e13b2026750dc5dc08909a3f7054b85c5d23ef59217489f1d7807e3132e568
-
SSDEEP
49152:Gv3I22SsaNYfdPBldt698dBcjHPsRJ6ObR3LoGdbrTHHB72eh2NT:Gv422SsaNYfdPBldt6+dBcjHPsRJ6Ir
Malware Config
Extracted
quasar
1.4.1
Office04
10.127.1.127:4782
27b4bceb-071c-49a0-8bca-3a989c114a17
-
encryption_key
EAEDFD6C6C0EA0BF7F7A63603931D231453DE1D6
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/764-1-0x00000000002F0000-0x0000000000614000-memory.dmp family_quasar behavioral1/files/0x0028000000045132-3.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 924 Client.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3688 schtasks.exe 1460 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 764 Client-built.exe Token: SeDebugPrivilege 924 Client.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 924 Client.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 924 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 764 wrote to memory of 3688 764 Client-built.exe 85 PID 764 wrote to memory of 3688 764 Client-built.exe 85 PID 764 wrote to memory of 924 764 Client-built.exe 87 PID 764 wrote to memory of 924 764 Client-built.exe 87 PID 924 wrote to memory of 1460 924 Client.exe 88 PID 924 wrote to memory of 1460 924 Client.exe 88 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3688
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1460
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5fef7fc18a56919307292dad1b0481e8e
SHA11b4cc3b74a2c5c43cad76cf12f7b03dafe6dad3a
SHA256d2422e4e839fa1da5bdb80a4762ba07c26c6134eb9f00e691894ec5312024c83
SHA5126fd9b368c64364b28e35a972fe5dc25f3afc3ce13ab4bb8764c9a80018bf97b1c6e13b2026750dc5dc08909a3f7054b85c5d23ef59217489f1d7807e3132e568