Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
87s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
07/12/2024, 16:42
Behavioral task
behavioral1
Sample
the newworking rat.exe
Resource
win11-20241007-en
windows11-21h2-x64
13 signatures
150 seconds
General
-
Target
the newworking rat.exe
-
Size
3.1MB
-
MD5
00c08053c9ec8b1575cc1dc37454ef36
-
SHA1
a41c5e4a0a07eaf751068543c0892451b06a17a1
-
SHA256
b1949d403caba3fc8addc1779b003b18fd9744f075dc9002213aa4104cdbbac1
-
SHA512
eaeefc1bdf1c4a1c98e0befced54a6dc83a1598f9d409bae6c0876447c832171e418a16b0be210d7223ee256a4f85946fdf4c4ddc7b3d6981c5ea23ef9d8998b
-
SSDEEP
98304:Pvm42pda6D+/PjlLOlZyQipVJ9RJ6I5a:nyOpTV5a
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
thecoolfile
C2
dfsgmnhsrf23456623423456-51636.portmap.host:51636
Mutex
ba019940-beb5-4159-a5b2-ce0bc35ac066
Attributes
-
encryption_key
B42CE86AEBA4D8818352F4D811EA7BBB472E229A
-
install_name
windows defender.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
discord
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/648-1-0x0000000000A30000-0x0000000000D54000-memory.dmp family_quasar behavioral1/files/0x001e00000002aba0-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 3048 windows defender.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1944 schtasks.exe 3260 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 648 the newworking rat.exe Token: SeDebugPrivilege 3048 windows defender.exe Token: SeDebugPrivilege 1876 taskmgr.exe Token: SeSystemProfilePrivilege 1876 taskmgr.exe Token: SeCreateGlobalPrivilege 1876 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe 1876 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3048 windows defender.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 648 wrote to memory of 1944 648 the newworking rat.exe 77 PID 648 wrote to memory of 1944 648 the newworking rat.exe 77 PID 648 wrote to memory of 3048 648 the newworking rat.exe 79 PID 648 wrote to memory of 3048 648 the newworking rat.exe 79 PID 3048 wrote to memory of 3260 3048 windows defender.exe 80 PID 3048 wrote to memory of 3260 3048 windows defender.exe 80 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\the newworking rat.exe"C:\Users\Admin\AppData\Local\Temp\the newworking rat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\windows defender.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1944
-
-
C:\Users\Admin\AppData\Roaming\SubDir\windows defender.exe"C:\Users\Admin\AppData\Roaming\SubDir\windows defender.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\windows defender.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3260
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD500c08053c9ec8b1575cc1dc37454ef36
SHA1a41c5e4a0a07eaf751068543c0892451b06a17a1
SHA256b1949d403caba3fc8addc1779b003b18fd9744f075dc9002213aa4104cdbbac1
SHA512eaeefc1bdf1c4a1c98e0befced54a6dc83a1598f9d409bae6c0876447c832171e418a16b0be210d7223ee256a4f85946fdf4c4ddc7b3d6981c5ea23ef9d8998b