Analysis
-
max time kernel
129s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28-11-2024 13:43
Behavioral task
behavioral1
Sample
FREEROBUX.exe
Resource
win7-20241010-en
General
-
Target
FREEROBUX.exe
-
Size
3.1MB
-
MD5
3596db7936f5d66cecbe028d13a91bfc
-
SHA1
fba98fb2e56e9d729c94a982c6f48eb5aba8930a
-
SHA256
56e476ecef007b432c2e388802c7541762dae164ceea1b5342b59b4857d2dfac
-
SHA512
e74596a17e9e9db088292e67e06800098d52b1da6d0870d1239144005632aaebb3b25e7b43d02c481f536b0bdd2a0483fffc5bd55e396c9241c3a7f161340e76
-
SSDEEP
49152:7v+lL26AaNeWgPhlmVqvMQ7XSKhnn4gLoGd3lTHHB72eh2NT:7vuL26AaNeWgPhlmVqkQ7XSKhnnx
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.230:4782
192.168.1.233:4782
e4595bcd-22f9-4826-8d7f-d752e4ca2275
-
encryption_key
9209FE335E49520665B871E3C932A5C8D6821048
-
install_name
Setup.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2592-1-0x0000000000830000-0x0000000000B54000-memory.dmp family_quasar behavioral1/files/0x0031000000018bbf-7.dat family_quasar behavioral1/memory/2948-10-0x0000000000BD0000-0x0000000000EF4000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2948 Setup.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2892 schtasks.exe 2756 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2592 FREEROBUX.exe Token: SeDebugPrivilege 2948 Setup.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2948 Setup.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2592 wrote to memory of 2892 2592 FREEROBUX.exe 30 PID 2592 wrote to memory of 2892 2592 FREEROBUX.exe 30 PID 2592 wrote to memory of 2892 2592 FREEROBUX.exe 30 PID 2592 wrote to memory of 2948 2592 FREEROBUX.exe 32 PID 2592 wrote to memory of 2948 2592 FREEROBUX.exe 32 PID 2592 wrote to memory of 2948 2592 FREEROBUX.exe 32 PID 2948 wrote to memory of 2756 2948 Setup.exe 33 PID 2948 wrote to memory of 2756 2948 Setup.exe 33 PID 2948 wrote to memory of 2756 2948 Setup.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FREEROBUX.exe"C:\Users\Admin\AppData\Local\Temp\FREEROBUX.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Setup.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2892
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Setup.exe"C:\Users\Admin\AppData\Roaming\SubDir\Setup.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Setup.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2756
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD53596db7936f5d66cecbe028d13a91bfc
SHA1fba98fb2e56e9d729c94a982c6f48eb5aba8930a
SHA25656e476ecef007b432c2e388802c7541762dae164ceea1b5342b59b4857d2dfac
SHA512e74596a17e9e9db088292e67e06800098d52b1da6d0870d1239144005632aaebb3b25e7b43d02c481f536b0bdd2a0483fffc5bd55e396c9241c3a7f161340e76