Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-11-2024 20:36
Static task
static1
Behavioral task
behavioral1
Sample
d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe
Resource
win7-20240903-en
General
-
Target
d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe
-
Size
523KB
-
MD5
fe5b07b7c90a3adec3899ad65ee4e038
-
SHA1
9103e80c409e918f3a55f0eb819e83415f8a6388
-
SHA256
d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727
-
SHA512
d6fbceb80e1f6bfdbeb72d5b98e7dbfd8485e594fd97aa1c286d208911f2b93b700f5b7efb96d5049baf5a7fcc449219a185ce719dee7b60ac504f604b25a45a
-
SSDEEP
12288:Yh1Lk70TnvjcKcVob1y3O/Yj5QmRP8Fb5Ovm0BK2zScujuMt:Ek70TrcKkoE3O/YtZV8Fcv5BKwCuMt
Malware Config
Signatures
-
Quasar family
-
Executes dropped EXE 1 IoCs
pid Process 1740 dcuph.exe -
Loads dropped DLL 1 IoCs
pid Process 2976 d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcuph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1928 schtasks.exe 2816 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2976 d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe Token: SeDebugPrivilege 1740 dcuph.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1740 dcuph.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2976 wrote to memory of 1928 2976 d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe 31 PID 2976 wrote to memory of 1928 2976 d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe 31 PID 2976 wrote to memory of 1928 2976 d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe 31 PID 2976 wrote to memory of 1928 2976 d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe 31 PID 2976 wrote to memory of 1740 2976 d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe 33 PID 2976 wrote to memory of 1740 2976 d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe 33 PID 2976 wrote to memory of 1740 2976 d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe 33 PID 2976 wrote to memory of 1740 2976 d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe 33 PID 1740 wrote to memory of 2816 1740 dcuph.exe 34 PID 1740 wrote to memory of 2816 1740 dcuph.exe 34 PID 1740 wrote to memory of 2816 1740 dcuph.exe 34 PID 1740 wrote to memory of 2816 1740 dcuph.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe"C:\Users\Admin\AppData\Local\Temp\d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "dcuph" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727.exe" /rl HIGHEST /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1928
-
-
C:\Users\Admin\AppData\Roaming\sysnfkn\dcuph.exe"C:\Users\Admin\AppData\Roaming\sysnfkn\dcuph.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "dcuph" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\sysnfkn\dcuph.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2816
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
523KB
MD5fe5b07b7c90a3adec3899ad65ee4e038
SHA19103e80c409e918f3a55f0eb819e83415f8a6388
SHA256d8818dee0fc5da34e49f25a8f416b86b6635443d45bdca1c54d23fa766de3727
SHA512d6fbceb80e1f6bfdbeb72d5b98e7dbfd8485e594fd97aa1c286d208911f2b93b700f5b7efb96d5049baf5a7fcc449219a185ce719dee7b60ac504f604b25a45a