Analysis
-
max time kernel
94s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 15:54
Static task
static1
Behavioral task
behavioral1
Sample
KRcLFIz5PCQunB7.exe
Resource
win7-20241010-en
General
-
Target
KRcLFIz5PCQunB7.exe
-
Size
3.5MB
-
MD5
a08b35662044abf9528c24c3f663eaed
-
SHA1
aee7831f263e6b83198a790d8a8948a841a600e2
-
SHA256
3f233256d32f8c33884510be0e50b614a35642f6ed7cb76b1f480373b548b295
-
SHA512
0866868cbf52999b233546348cde08c3cfcf2deef86830a319d8430e6d815a02b8438f46c944fbd9f2010d7e9fcb6f4f77db490280894b899de0afc71278b5dd
-
SSDEEP
49152:Uf+eHq329+bhPCNJZxh2H4s0E04nfxhFZ9kIODfdWutT825SkDh83TQ237w4fGi:U+MrJZqYsTfnFZ9ktfgtSSTQ23s4p
Malware Config
Extracted
quasar
1.4.1
FLO
qtd.ydns.eu:5829
ac3de377-7a66-4586-b523-567adbbba988
-
encryption_key
C5B555A83D127A9553D4FB1FCECB35CE8E91A447
-
install_name
outlooks.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Outlooks
-
subdirectory
WindowsUpdates
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/1504-11-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar -
Executes dropped EXE 3 IoCs
pid Process 3748 outlooks.exe 2944 outlooks.exe 1784 outlooks.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4100 set thread context of 1504 4100 KRcLFIz5PCQunB7.exe 96 PID 3748 set thread context of 1784 3748 outlooks.exe 104 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KRcLFIz5PCQunB7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KRcLFIz5PCQunB7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outlooks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outlooks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1596 schtasks.exe 4360 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4100 KRcLFIz5PCQunB7.exe 4100 KRcLFIz5PCQunB7.exe 3748 outlooks.exe 3748 outlooks.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4100 KRcLFIz5PCQunB7.exe Token: SeDebugPrivilege 1504 KRcLFIz5PCQunB7.exe Token: SeDebugPrivilege 3748 outlooks.exe Token: SeDebugPrivilege 1784 outlooks.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1784 outlooks.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 4100 wrote to memory of 780 4100 KRcLFIz5PCQunB7.exe 95 PID 4100 wrote to memory of 780 4100 KRcLFIz5PCQunB7.exe 95 PID 4100 wrote to memory of 780 4100 KRcLFIz5PCQunB7.exe 95 PID 4100 wrote to memory of 1504 4100 KRcLFIz5PCQunB7.exe 96 PID 4100 wrote to memory of 1504 4100 KRcLFIz5PCQunB7.exe 96 PID 4100 wrote to memory of 1504 4100 KRcLFIz5PCQunB7.exe 96 PID 4100 wrote to memory of 1504 4100 KRcLFIz5PCQunB7.exe 96 PID 4100 wrote to memory of 1504 4100 KRcLFIz5PCQunB7.exe 96 PID 4100 wrote to memory of 1504 4100 KRcLFIz5PCQunB7.exe 96 PID 4100 wrote to memory of 1504 4100 KRcLFIz5PCQunB7.exe 96 PID 4100 wrote to memory of 1504 4100 KRcLFIz5PCQunB7.exe 96 PID 1504 wrote to memory of 1596 1504 KRcLFIz5PCQunB7.exe 97 PID 1504 wrote to memory of 1596 1504 KRcLFIz5PCQunB7.exe 97 PID 1504 wrote to memory of 1596 1504 KRcLFIz5PCQunB7.exe 97 PID 1504 wrote to memory of 3748 1504 KRcLFIz5PCQunB7.exe 99 PID 1504 wrote to memory of 3748 1504 KRcLFIz5PCQunB7.exe 99 PID 1504 wrote to memory of 3748 1504 KRcLFIz5PCQunB7.exe 99 PID 3748 wrote to memory of 2944 3748 outlooks.exe 103 PID 3748 wrote to memory of 2944 3748 outlooks.exe 103 PID 3748 wrote to memory of 2944 3748 outlooks.exe 103 PID 3748 wrote to memory of 1784 3748 outlooks.exe 104 PID 3748 wrote to memory of 1784 3748 outlooks.exe 104 PID 3748 wrote to memory of 1784 3748 outlooks.exe 104 PID 3748 wrote to memory of 1784 3748 outlooks.exe 104 PID 3748 wrote to memory of 1784 3748 outlooks.exe 104 PID 3748 wrote to memory of 1784 3748 outlooks.exe 104 PID 3748 wrote to memory of 1784 3748 outlooks.exe 104 PID 3748 wrote to memory of 1784 3748 outlooks.exe 104 PID 1784 wrote to memory of 4360 1784 outlooks.exe 105 PID 1784 wrote to memory of 4360 1784 outlooks.exe 105 PID 1784 wrote to memory of 4360 1784 outlooks.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe"C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe"C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe"2⤵PID:780
-
-
C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe"C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Outlooks" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1596
-
-
C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe"4⤵
- Executes dropped EXE
PID:2944
-
-
C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Outlooks" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe" /rl HIGHEST /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4360
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
3.5MB
MD5a08b35662044abf9528c24c3f663eaed
SHA1aee7831f263e6b83198a790d8a8948a841a600e2
SHA2563f233256d32f8c33884510be0e50b614a35642f6ed7cb76b1f480373b548b295
SHA5120866868cbf52999b233546348cde08c3cfcf2deef86830a319d8430e6d815a02b8438f46c944fbd9f2010d7e9fcb6f4f77db490280894b899de0afc71278b5dd