Analysis
-
max time kernel
96s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 15:53
Static task
static1
Behavioral task
behavioral1
Sample
KRcLFIz5PCQunB7.exe
Resource
win7-20241010-en
General
-
Target
KRcLFIz5PCQunB7.exe
-
Size
3.5MB
-
MD5
a08b35662044abf9528c24c3f663eaed
-
SHA1
aee7831f263e6b83198a790d8a8948a841a600e2
-
SHA256
3f233256d32f8c33884510be0e50b614a35642f6ed7cb76b1f480373b548b295
-
SHA512
0866868cbf52999b233546348cde08c3cfcf2deef86830a319d8430e6d815a02b8438f46c944fbd9f2010d7e9fcb6f4f77db490280894b899de0afc71278b5dd
-
SSDEEP
49152:Uf+eHq329+bhPCNJZxh2H4s0E04nfxhFZ9kIODfdWutT825SkDh83TQ237w4fGi:U+MrJZqYsTfnFZ9ktfgtSSTQ23s4p
Malware Config
Extracted
quasar
1.4.1
FLO
qtd.ydns.eu:5829
ac3de377-7a66-4586-b523-567adbbba988
-
encryption_key
C5B555A83D127A9553D4FB1FCECB35CE8E91A447
-
install_name
outlooks.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Outlooks
-
subdirectory
WindowsUpdates
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/640-11-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar -
Executes dropped EXE 2 IoCs
pid Process 2792 outlooks.exe 1500 outlooks.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4212 set thread context of 640 4212 KRcLFIz5PCQunB7.exe 89 PID 2792 set thread context of 1500 2792 outlooks.exe 95 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KRcLFIz5PCQunB7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KRcLFIz5PCQunB7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outlooks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outlooks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4768 schtasks.exe 452 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 640 KRcLFIz5PCQunB7.exe Token: SeDebugPrivilege 1500 outlooks.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1500 outlooks.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4212 wrote to memory of 640 4212 KRcLFIz5PCQunB7.exe 89 PID 4212 wrote to memory of 640 4212 KRcLFIz5PCQunB7.exe 89 PID 4212 wrote to memory of 640 4212 KRcLFIz5PCQunB7.exe 89 PID 4212 wrote to memory of 640 4212 KRcLFIz5PCQunB7.exe 89 PID 4212 wrote to memory of 640 4212 KRcLFIz5PCQunB7.exe 89 PID 4212 wrote to memory of 640 4212 KRcLFIz5PCQunB7.exe 89 PID 4212 wrote to memory of 640 4212 KRcLFIz5PCQunB7.exe 89 PID 4212 wrote to memory of 640 4212 KRcLFIz5PCQunB7.exe 89 PID 640 wrote to memory of 452 640 KRcLFIz5PCQunB7.exe 90 PID 640 wrote to memory of 452 640 KRcLFIz5PCQunB7.exe 90 PID 640 wrote to memory of 452 640 KRcLFIz5PCQunB7.exe 90 PID 640 wrote to memory of 2792 640 KRcLFIz5PCQunB7.exe 92 PID 640 wrote to memory of 2792 640 KRcLFIz5PCQunB7.exe 92 PID 640 wrote to memory of 2792 640 KRcLFIz5PCQunB7.exe 92 PID 2792 wrote to memory of 1500 2792 outlooks.exe 95 PID 2792 wrote to memory of 1500 2792 outlooks.exe 95 PID 2792 wrote to memory of 1500 2792 outlooks.exe 95 PID 2792 wrote to memory of 1500 2792 outlooks.exe 95 PID 2792 wrote to memory of 1500 2792 outlooks.exe 95 PID 2792 wrote to memory of 1500 2792 outlooks.exe 95 PID 2792 wrote to memory of 1500 2792 outlooks.exe 95 PID 2792 wrote to memory of 1500 2792 outlooks.exe 95 PID 1500 wrote to memory of 4768 1500 outlooks.exe 96 PID 1500 wrote to memory of 4768 1500 outlooks.exe 96 PID 1500 wrote to memory of 4768 1500 outlooks.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe"C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe"C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Outlooks" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:452
-
-
C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Outlooks" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe" /rl HIGHEST /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4768
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
3.5MB
MD5a08b35662044abf9528c24c3f663eaed
SHA1aee7831f263e6b83198a790d8a8948a841a600e2
SHA2563f233256d32f8c33884510be0e50b614a35642f6ed7cb76b1f480373b548b295
SHA5120866868cbf52999b233546348cde08c3cfcf2deef86830a319d8430e6d815a02b8438f46c944fbd9f2010d7e9fcb6f4f77db490280894b899de0afc71278b5dd