Analysis
-
max time kernel
79s -
max time network
79s -
platform
windows11-21h2_x64 -
resource
win11-20241023-en -
resource tags
arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-12-2024 16:45
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win11-20241023-en
windows11-21h2-x64
13 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
987547ab64e63245ed07964daef37f3b
-
SHA1
ea23278cfefdd48b9da3dd07ebb94e1194817587
-
SHA256
815ce2d6945fa3d5b5e7ea7d7c4b65d318255e700aa503ae70fa347217114b65
-
SHA512
2648df67c0e6654327539d00ce27ff79fdf4e357072ad82c5624eb74c9d53bc90ee91017d27ed31d9577fb9e5439a2ea8e2f27e0a934afee58b98c9de56a4e25
-
SSDEEP
49152:rvHG42pda6D+/PjlLOlg6yQipV8KRJ6ebR3LoGduTHHB72eh2NT:rvm42pda6D+/PjlLOlZyQipV8KRJ6Y
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
thecoolfile
C2
dfsgmnhsrf23456623423456-51636.portmap.host:51636
Mutex
372f3f9f-1eba-429d-9b98-7c94499b8dbf
Attributes
-
encryption_key
B42CE86AEBA4D8818352F4D811EA7BBB472E229A
-
install_name
windows defender.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
discord
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/2176-1-0x0000000000880000-0x0000000000BA4000-memory.dmp family_quasar behavioral1/files/0x000700000002a86c-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2880 windows defender.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1500 schtasks.exe 2588 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2176 Client-built.exe Token: SeDebugPrivilege 2880 windows defender.exe Token: SeDebugPrivilege 780 taskmgr.exe Token: SeSystemProfilePrivilege 780 taskmgr.exe Token: SeCreateGlobalPrivilege 780 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe 780 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2880 windows defender.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2176 wrote to memory of 1500 2176 Client-built.exe 80 PID 2176 wrote to memory of 1500 2176 Client-built.exe 80 PID 2176 wrote to memory of 2880 2176 Client-built.exe 82 PID 2176 wrote to memory of 2880 2176 Client-built.exe 82 PID 2880 wrote to memory of 2588 2880 windows defender.exe 83 PID 2880 wrote to memory of 2588 2880 windows defender.exe 83 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\windows defender.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1500
-
-
C:\Users\Admin\AppData\Roaming\SubDir\windows defender.exe"C:\Users\Admin\AppData\Roaming\SubDir\windows defender.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\windows defender.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2588
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5987547ab64e63245ed07964daef37f3b
SHA1ea23278cfefdd48b9da3dd07ebb94e1194817587
SHA256815ce2d6945fa3d5b5e7ea7d7c4b65d318255e700aa503ae70fa347217114b65
SHA5122648df67c0e6654327539d00ce27ff79fdf4e357072ad82c5624eb74c9d53bc90ee91017d27ed31d9577fb9e5439a2ea8e2f27e0a934afee58b98c9de56a4e25