Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-11-2024 13:56
Behavioral task
behavioral1
Sample
6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe
Resource
win10v2004-20241007-en
General
-
Target
6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe
-
Size
349KB
-
MD5
f74a56c1ae8315915efa57dc391dcace
-
SHA1
4a24d459bedf21c4ebf390313d6605caec76f862
-
SHA256
6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4
-
SHA512
d0e24523933cb6816bb868279d1107e1bb4d73d1aa4f09689893d71ea11aed72e996033423f1cbc9c6bcc32482503104e32059dceff890244032e09d0dbe59fc
-
SSDEEP
6144:2K2J10qdSlEc39HGGZlMi9MqKQPxjub0n6RKCKSU+yTp0xr:2KFXZhMqKQJjDwKjd0xr
Malware Config
Extracted
quasar
1.3.0.0
ProyectosCUU
192.168.1.198:4782
QSR_MUTEX_m5dUI8hKcZccXa2Bjv
-
encryption_key
hjqFnSRNHmM40urcuGMr
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
cles
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/1380-1-0x0000000000FA0000-0x0000000000FFE000-memory.dmp family_quasar behavioral1/files/0x0008000000018741-5.dat family_quasar behavioral1/memory/2188-11-0x0000000001230000-0x000000000128E000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2188 Client.exe -
Loads dropped DLL 1 IoCs
pid Process 1380 6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\cles Client.exe File created C:\Program Files (x86)\cles\Client.exe 6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe File opened for modification C:\Program Files (x86)\cles\Client.exe 6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe File opened for modification C:\Program Files (x86)\cles\Client.exe Client.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1852 schtasks.exe 3028 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1380 6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe Token: SeDebugPrivilege 2188 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2188 Client.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1380 wrote to memory of 1852 1380 6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe 31 PID 1380 wrote to memory of 1852 1380 6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe 31 PID 1380 wrote to memory of 1852 1380 6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe 31 PID 1380 wrote to memory of 1852 1380 6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe 31 PID 1380 wrote to memory of 2188 1380 6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe 33 PID 1380 wrote to memory of 2188 1380 6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe 33 PID 1380 wrote to memory of 2188 1380 6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe 33 PID 1380 wrote to memory of 2188 1380 6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe 33 PID 2188 wrote to memory of 3028 2188 Client.exe 34 PID 2188 wrote to memory of 3028 2188 Client.exe 34 PID 2188 wrote to memory of 3028 2188 Client.exe 34 PID 2188 wrote to memory of 3028 2188 Client.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe"C:\Users\Admin\AppData\Local\Temp\6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\6e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4.exe" /rl HIGHEST /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1852
-
-
C:\Program Files (x86)\cles\Client.exe"C:\Program Files (x86)\cles\Client.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files (x86)\cles\Client.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3028
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
349KB
MD5f74a56c1ae8315915efa57dc391dcace
SHA14a24d459bedf21c4ebf390313d6605caec76f862
SHA2566e39ea5185c45d33204cadb86a374e3a2224a4437a316e57fa6a051973fcb5d4
SHA512d0e24523933cb6816bb868279d1107e1bb4d73d1aa4f09689893d71ea11aed72e996033423f1cbc9c6bcc32482503104e32059dceff890244032e09d0dbe59fc