Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
17-11-2024 13:21
Behavioral task
behavioral1
Sample
ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b.exe
Resource
win7-20241023-en
General
-
Target
ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b.exe
-
Size
3.1MB
-
MD5
112052df0155dc61ccd59a085552acc2
-
SHA1
0da0103f733680888948585e1e1cbb50711c0a3f
-
SHA256
ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b
-
SHA512
78f7bfc985fbae2f030ea1268d087b7b68e532bd3f44181fe0c28dd906ebbb858687209b60fbf7d1f8cdc84ee09374a9d55cfb0834ae9fd51e98b5effcb60645
-
SSDEEP
49152:zvkI22SsaNYfdPBldt698dBcjHetxNESEUk/iSboGdzTHHB72eh2NT:zvJ22SsaNYfdPBldt6+dBcjH4xjU
Malware Config
Extracted
quasar
1.4.1
Office04
154.83.15.5:4782
f471b896-c945-43dc-9217-eb1657caa328
-
encryption_key
2B2223EBAC01E73CC719C15E7C1A885C0BBF24EC
-
install_name
ww.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2172-1-0x0000000000D90000-0x00000000010B4000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\ww.exe family_quasar behavioral1/memory/3044-7-0x0000000000F20000-0x0000000001244000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
ww.exepid process 3044 ww.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b.exeww.exedescription pid process Token: SeDebugPrivilege 2172 ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b.exe Token: SeDebugPrivilege 3044 ww.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ww.exepid process 3044 ww.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b.exedescription pid process target process PID 2172 wrote to memory of 3044 2172 ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b.exe ww.exe PID 2172 wrote to memory of 3044 2172 ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b.exe ww.exe PID 2172 wrote to memory of 3044 2172 ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b.exe ww.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b.exe"C:\Users\Admin\AppData\Local\Temp\ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Roaming\SubDir\ww.exe"C:\Users\Admin\AppData\Roaming\SubDir\ww.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3044
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5112052df0155dc61ccd59a085552acc2
SHA10da0103f733680888948585e1e1cbb50711c0a3f
SHA256ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b
SHA51278f7bfc985fbae2f030ea1268d087b7b68e532bd3f44181fe0c28dd906ebbb858687209b60fbf7d1f8cdc84ee09374a9d55cfb0834ae9fd51e98b5effcb60645