Analysis
-
max time kernel
479s -
max time network
484s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-12-2024 12:39
Behavioral task
behavioral1
Sample
Undetected.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
300 seconds
General
-
Target
Undetected.exe
-
Size
3.1MB
-
MD5
24fb6d0cd65b9ed0723547d5584ee740
-
SHA1
2313a05b60b54e381ba48c54c54f49aedffd2363
-
SHA256
258a88a0891701d6295f2b8cc44ef6bb9f1d81b0100714b77feb8dceaf8d8c5f
-
SHA512
da701c25907ebb5153b2909f78add8a3c2e21c2425c38949a0b3b622d7f0953ac0fee5faec8d22bb2871808f9127b78b2a4712bfa2695b3a72de1325617809e8
-
SSDEEP
49152:HvyI22SsaNYfdPBldt698dBcjHWrgzMlbRwLoGdwTHHB72eh2NT:Hvf22SsaNYfdPBldt6+dBcjHWrgzMy
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
192.168.178.56:4782
Mutex
d47b824b-b4e1-49c3-b7b1-e2aed266d704
Attributes
-
encryption_key
591E93A21B2268B2675C524C4C3528D8858C7B87
-
install_name
Undetected.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
windows Updater5
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2668-1-0x0000000000090000-0x00000000003B4000-memory.dmp family_quasar behavioral1/files/0x0008000000015685-6.dat family_quasar behavioral1/memory/2792-9-0x00000000000C0000-0x00000000003E4000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2792 Undetected.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2944 schtasks.exe 2872 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2608 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2668 Undetected.exe Token: SeDebugPrivilege 2792 Undetected.exe Token: SeDebugPrivilege 2608 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe 2608 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2792 Undetected.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2944 2668 Undetected.exe 30 PID 2668 wrote to memory of 2944 2668 Undetected.exe 30 PID 2668 wrote to memory of 2944 2668 Undetected.exe 30 PID 2668 wrote to memory of 2792 2668 Undetected.exe 32 PID 2668 wrote to memory of 2792 2668 Undetected.exe 32 PID 2668 wrote to memory of 2792 2668 Undetected.exe 32 PID 2792 wrote to memory of 2872 2792 Undetected.exe 33 PID 2792 wrote to memory of 2872 2792 Undetected.exe 33 PID 2792 wrote to memory of 2872 2792 Undetected.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Undetected.exe"C:\Users\Admin\AppData\Local\Temp\Undetected.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "windows Updater5" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Undetected.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2944
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Undetected.exe"C:\Users\Admin\AppData\Roaming\SubDir\Undetected.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "windows Updater5" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Undetected.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2872
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD524fb6d0cd65b9ed0723547d5584ee740
SHA12313a05b60b54e381ba48c54c54f49aedffd2363
SHA256258a88a0891701d6295f2b8cc44ef6bb9f1d81b0100714b77feb8dceaf8d8c5f
SHA512da701c25907ebb5153b2909f78add8a3c2e21c2425c38949a0b3b622d7f0953ac0fee5faec8d22bb2871808f9127b78b2a4712bfa2695b3a72de1325617809e8