Analysis
-
max time kernel
94s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 18:12
Static task
static1
Behavioral task
behavioral1
Sample
a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe
Resource
win7-20240903-en
General
-
Target
a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe
-
Size
1.4MB
-
MD5
142210eb7464fb579c0c6030c15c876f
-
SHA1
65050f9af307ec87745a32e1cc79dee28e8bc5ea
-
SHA256
a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856
-
SHA512
4f82b7d3d6f8e49a0a4ef5a27e54d166cc4b4a9231442e46fee1d5ae85e16d779ef75a3bfeaa82d762976507b49ea91c8e2f9c2e80beb92c55759aa5f3721858
-
SSDEEP
12288:2fcOokxZ4FK9VlPprK7w5NljuDvdLwLEcXq8dxSaDygxpy3nZOJcllvB4:2P8FMhQiXhxkKcOUvi
Malware Config
Extracted
quasar
1.4.1
Chim
aboushagor.ydns.eu:6542
0b30f45d-3c54-4926-a32f-8a1dc077eb21
-
encryption_key
799E5C34BA6EC18D72E269D0C5CF1A5AC1AD9277
-
install_name
windows update.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svchost
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/5068-1098-0x0000000000500000-0x0000000000824000-memory.dmp family_quasar -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 916 created 3540 916 a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe 56 -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 916 set thread context of 5068 916 a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe 93 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3600 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 916 a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 916 a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe Token: SeDebugPrivilege 916 a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe Token: SeDebugPrivilege 5068 InstallUtil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 916 wrote to memory of 5068 916 a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe 93 PID 916 wrote to memory of 5068 916 a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe 93 PID 916 wrote to memory of 5068 916 a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe 93 PID 916 wrote to memory of 5068 916 a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe 93 PID 916 wrote to memory of 5068 916 a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe 93 PID 916 wrote to memory of 5068 916 a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe 93 PID 916 wrote to memory of 5068 916 a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe 93 PID 916 wrote to memory of 5068 916 a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe 93 PID 5068 wrote to memory of 3600 5068 InstallUtil.exe 94 PID 5068 wrote to memory of 3600 5068 InstallUtil.exe 94 PID 5068 wrote to memory of 3600 5068 InstallUtil.exe 94
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe"C:\Users\Admin\AppData\Local\Temp\a0a5e205567c676b99f69c9d11723a9e44e073cb61ca1ef5b228b26cea57e856.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\windows update.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3600
-
-