Analysis
-
max time kernel
66s -
max time network
69s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-12-2024 02:42
General
-
Target
guwahdsadasdsdadas.exe
-
Size
3.1MB
-
MD5
8c18dd1ddcbedeae5f0899595eaf33a7
-
SHA1
5abff6dd235e817d560bda3d4bf2a11b1f4bd292
-
SHA256
504ede0cfa90eafc6b86402fcdfc07d6e6361a4cdd3a2c4a3682133ddb84d57b
-
SHA512
50769dbbdc15a292d04d400af8a2fa95675e68b5fc5ce783bdcde24c0a76fa2896dbe66f21d3b3d4cd9452a19735d2d0a13561b840433342431652dcbfaca8d8
-
SSDEEP
49152:fvelL26AaNeWgPhlmVqvMQ7XSKYEmMmzNRoGdzTHHB72eh2NT:fvOL26AaNeWgPhlmVqkQ7XSKYEmN
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
roar
C2
fojeweb571-64431.portmap.host:8848
Mutex
0c203952-83f0-40e8-a93c-b701163cc930
Attributes
-
encryption_key
B42CE86AEBA4D8818352F4D811EA7BBB472E229A
-
install_name
windows defender.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
discord
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/2384-1-0x0000000000DE0000-0x0000000001104000-memory.dmp family_quasar behavioral1/files/0x001a00000002ab8a-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2620 windows defender.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" BackgroundTransferHost.exe Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\MuiCache BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix BackgroundTransferHost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5112 schtasks.exe 4368 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2384 guwahdsadasdsdadas.exe Token: SeDebugPrivilege 2620 windows defender.exe Token: SeDebugPrivilege 1456 taskmgr.exe Token: SeSystemProfilePrivilege 1456 taskmgr.exe Token: SeCreateGlobalPrivilege 1456 taskmgr.exe -
Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe -
Suspicious use of SendNotifyMessage 57 IoCs
pid Process 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2620 windows defender.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2384 wrote to memory of 5112 2384 guwahdsadasdsdadas.exe 78 PID 2384 wrote to memory of 5112 2384 guwahdsadasdsdadas.exe 78 PID 2384 wrote to memory of 2620 2384 guwahdsadasdsdadas.exe 80 PID 2384 wrote to memory of 2620 2384 guwahdsadasdsdadas.exe 80 PID 2620 wrote to memory of 4368 2620 windows defender.exe 81 PID 2620 wrote to memory of 4368 2620 windows defender.exe 81 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\guwahdsadasdsdadas.exe"C:\Users\Admin\AppData\Local\Temp\guwahdsadasdsdadas.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\windows defender.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5112
-
-
C:\Users\Admin\AppData\Roaming\SubDir\windows defender.exe"C:\Users\Admin\AppData\Roaming\SubDir\windows defender.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\windows defender.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4368
-
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
PID:3816
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\ea757334-c651-41ed-9450-a8dd54083493.down_data
Filesize555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
Filesize
3.1MB
MD58c18dd1ddcbedeae5f0899595eaf33a7
SHA15abff6dd235e817d560bda3d4bf2a11b1f4bd292
SHA256504ede0cfa90eafc6b86402fcdfc07d6e6361a4cdd3a2c4a3682133ddb84d57b
SHA51250769dbbdc15a292d04d400af8a2fa95675e68b5fc5ce783bdcde24c0a76fa2896dbe66f21d3b3d4cd9452a19735d2d0a13561b840433342431652dcbfaca8d8