Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
14-12-2024 01:48
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
2b94149c3f189fcfeb12bb357a5ef826
-
SHA1
3ab132c97840bbd3295b9ebb5432d4996bda7c60
-
SHA256
ccd7a66e3fcf6461917a355c88b073598686a1f7e987378c0a271ee322eadb68
-
SHA512
1a713e26af54a3e8967002a6f8a5f9d27305ce9908106fd919ba2c6cd6709901d1555fe49fc42e41095aff7b4a4374ab12b2e1baa660751fce05ecd83bfd847d
-
SSDEEP
49152:uvCI22SsaNYfdPBldt698dBcjHY3a0h2arW6oGdESTHHB72eh2NT:uvP22SsaNYfdPBldt6+dBcjH81hf
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
exe
C2
192.168.4.70:4782
Mutex
20b94a11-6f09-4a42-b723-e2b3fc07ea20
Attributes
-
encryption_key
85087DC59010C3D9E4749A15AB7F44397E834804
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
1
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/4812-1-0x00000000009F0000-0x0000000000D14000-memory.dmp family_quasar behavioral1/files/0x002800000004613f-3.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 1004 Client.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2608 schtasks.exe 936 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4720 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4812 Client-built.exe Token: SeDebugPrivilege 1004 Client.exe Token: SeDebugPrivilege 4720 taskmgr.exe Token: SeSystemProfilePrivilege 4720 taskmgr.exe Token: SeCreateGlobalPrivilege 4720 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe 4720 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1004 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4812 wrote to memory of 2608 4812 Client-built.exe 84 PID 4812 wrote to memory of 2608 4812 Client-built.exe 84 PID 4812 wrote to memory of 1004 4812 Client-built.exe 86 PID 4812 wrote to memory of 1004 4812 Client-built.exe 86 PID 1004 wrote to memory of 936 1004 Client.exe 87 PID 1004 wrote to memory of 936 1004 Client.exe 87 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2608
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:936
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD52b94149c3f189fcfeb12bb357a5ef826
SHA13ab132c97840bbd3295b9ebb5432d4996bda7c60
SHA256ccd7a66e3fcf6461917a355c88b073598686a1f7e987378c0a271ee322eadb68
SHA5121a713e26af54a3e8967002a6f8a5f9d27305ce9908106fd919ba2c6cd6709901d1555fe49fc42e41095aff7b4a4374ab12b2e1baa660751fce05ecd83bfd847d