Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2024 16:44
Static task
static1
Behavioral task
behavioral1
Sample
ZulaSpacexHack.exe
Resource
win7-20240903-en
General
-
Target
ZulaSpacexHack.exe
-
Size
2.2MB
-
MD5
7785c52b863e9dae3fac08e3b130bb32
-
SHA1
d812fe11ca73f802e5dbfa3422c17d88bf59066d
-
SHA256
0f19f7f52cd3153147f72eadde474b26ad507715727d9a905a0817e4127fd334
-
SHA512
805aa770dce5b6fe0743d8de53c8b597eed372115f4b93077e5e22d5269f3b3425c01206d17c98f4ad7dae8aa3e001511c2e2bb598628700b804653965b7bc8a
-
SSDEEP
49152:+/y6Dko0SrLauBl8GGftU2wDRxOUiH6wPsJ1EtA9guyZ:+qW0UBMQxER2iA9guyZ
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Extracted
quasar
1.4.1
zulaspcx
yeniceri99-24578.portmap.io:24578
938aa95f-e3d4-483d-9217-ffafea133927
-
encryption_key
3BBA711AB673CCE3CC23338F52513D2C4D42AFEF
-
install_name
svchost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Update
-
subdirectory
Windows
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral2/memory/3284-8-0x0000000007460000-0x000000000780A000-memory.dmp family_quasar behavioral2/files/0x0008000000023c70-13.dat family_quasar behavioral2/memory/4004-23-0x00000000000F0000-0x0000000000414000-memory.dmp family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ZulaSpacexHack.exe -
Executes dropped EXE 2 IoCs
pid Process 4004 svchost.exe 1112 svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZulaSpacexHack.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3624 schtasks.exe 1800 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe 3284 ZulaSpacexHack.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4004 svchost.exe Token: SeDebugPrivilege 1112 svchost.exe Token: SeDebugPrivilege 3284 ZulaSpacexHack.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1112 svchost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3284 wrote to memory of 4004 3284 ZulaSpacexHack.exe 83 PID 3284 wrote to memory of 4004 3284 ZulaSpacexHack.exe 83 PID 4004 wrote to memory of 3624 4004 svchost.exe 84 PID 4004 wrote to memory of 3624 4004 svchost.exe 84 PID 4004 wrote to memory of 1112 4004 svchost.exe 86 PID 4004 wrote to memory of 1112 4004 svchost.exe 86 PID 1112 wrote to memory of 1800 1112 svchost.exe 88 PID 1112 wrote to memory of 1800 1112 svchost.exe 88 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZulaSpacexHack.exe"C:\Users\Admin\AppData\Local\Temp\ZulaSpacexHack.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\svchost.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3624
-
-
C:\Users\Admin\AppData\Roaming\Windows\svchost.exe"C:\Users\Admin\AppData\Roaming\Windows\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\svchost.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
PID:1800
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
3.1MB
MD5cda244bc8f0486f4bce677dc71784369
SHA1a7639235f14ed1ad673d2bfde070c266817e58b4
SHA256ceec77c3852dd8b1fe96799500350ecf1d8e7c3e2a5931d58a6c99a711c9bfec
SHA5123d6cd367f888923da267830e4e497808de31eed5e1d96a5de68ed82d0090aa23e41f1963ffb7cecc74fbf09948466a74666b4abaf7973b61da182b8e0096dea4