Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 19:40
Static task
static1
Behavioral task
behavioral1
Sample
0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe
Resource
win7-20241023-en
General
-
Target
0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe
-
Size
877KB
-
MD5
af2cca9e175c1e73fdc927423bf34063
-
SHA1
9fb1313901e0ac98a4c5aa3da0c0223b4bfca1f2
-
SHA256
0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f
-
SHA512
8d57d681ad9bfb772fdf74b05a5012e0cac168db3265864de1b9898ac0126b8ac969a273060275309ab6e99087acfc7ea48a2c2b8d2bc70989ef546d98ab9b9f
-
SSDEEP
12288:7FY7UCaIsX+aC+fwRDV4gF03IFdfQeArznBKau8i1ozAq5uZCTN2E/Ep6A4W/89m:7FKraaaNwC3ktQeAwVGB5uaZ/of3
Malware Config
Extracted
quasar
1.3.0.0
AOY
87.120.120.27:61540
127.0.0.1:61540
87.121.86.205:61541
QSR_MUTEX_NOCv4TURf46HbVbxyc
-
encryption_key
fVsndNhImy9VosyZSQbQ
-
install_name
updates.exe
-
log_directory
Logs
-
reconnect_delay
4000
-
startup_key
Windows Update
-
subdirectory
Windows
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/2584-9-0x0000000000400000-0x000000000045E000-memory.dmp family_quasar -
Executes dropped EXE 2 IoCs
pid Process 2508 updates.exe 3712 updates.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1516 set thread context of 2584 1516 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe 84 PID 2508 set thread context of 3712 2508 updates.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updates.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updates.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4480 schtasks.exe 216 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1516 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe Token: SeDebugPrivilege 2584 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe Token: SeDebugPrivilege 2508 updates.exe Token: SeDebugPrivilege 3712 updates.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1516 wrote to memory of 2584 1516 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe 84 PID 1516 wrote to memory of 2584 1516 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe 84 PID 1516 wrote to memory of 2584 1516 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe 84 PID 1516 wrote to memory of 2584 1516 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe 84 PID 1516 wrote to memory of 2584 1516 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe 84 PID 1516 wrote to memory of 2584 1516 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe 84 PID 1516 wrote to memory of 2584 1516 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe 84 PID 1516 wrote to memory of 2584 1516 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe 84 PID 2584 wrote to memory of 4480 2584 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe 86 PID 2584 wrote to memory of 4480 2584 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe 86 PID 2584 wrote to memory of 4480 2584 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe 86 PID 2584 wrote to memory of 2508 2584 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe 88 PID 2584 wrote to memory of 2508 2584 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe 88 PID 2584 wrote to memory of 2508 2584 0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe 88 PID 2508 wrote to memory of 3712 2508 updates.exe 89 PID 2508 wrote to memory of 3712 2508 updates.exe 89 PID 2508 wrote to memory of 3712 2508 updates.exe 89 PID 2508 wrote to memory of 3712 2508 updates.exe 89 PID 2508 wrote to memory of 3712 2508 updates.exe 89 PID 2508 wrote to memory of 3712 2508 updates.exe 89 PID 2508 wrote to memory of 3712 2508 updates.exe 89 PID 2508 wrote to memory of 3712 2508 updates.exe 89 PID 3712 wrote to memory of 216 3712 updates.exe 90 PID 3712 wrote to memory of 216 3712 updates.exe 90 PID 3712 wrote to memory of 216 3712 updates.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe"C:\Users\Admin\AppData\Local\Temp\0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exeC:\Users\Admin\AppData\Local\Temp\0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4480
-
-
C:\Users\Admin\AppData\Roaming\Windows\updates.exe"C:\Users\Admin\AppData\Roaming\Windows\updates.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Roaming\Windows\updates.exeC:\Users\Admin\AppData\Roaming\Windows\updates.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\updates.exe" /rl HIGHEST /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:216
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f.exe.log
Filesize706B
MD5d95c58e609838928f0f49837cab7dfd2
SHA155e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA2560407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d
-
Filesize
877KB
MD5af2cca9e175c1e73fdc927423bf34063
SHA19fb1313901e0ac98a4c5aa3da0c0223b4bfca1f2
SHA2560d4777cd136637a6a622af6891450a910bfb908743c1586b987ee75f0d923c9f
SHA5128d57d681ad9bfb772fdf74b05a5012e0cac168db3265864de1b9898ac0126b8ac969a273060275309ab6e99087acfc7ea48a2c2b8d2bc70989ef546d98ab9b9f