Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
14-12-2024 12:20
Behavioral task
behavioral1
Sample
a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043.exe
Resource
win10v2004-20241007-en
General
-
Target
a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043.exe
-
Size
3.1MB
-
MD5
b29de0d04753ec41025d33b6c305b91d
-
SHA1
1fbb9cfbda8c550a142a80cef83706923af87cd8
-
SHA256
a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043
-
SHA512
cfa6f06cb7e2a8e1ff888fc783e0271f61db39251350423432d4be829188c98cd744e946595ccc01c9ad2b03053a10efa13312ce70c80f837293b6785c215816
-
SSDEEP
49152:zvHI22SsaNYfdPBldt698dBcjHOd/mBx3LoGdbTHHB72eh2NT:zvo22SsaNYfdPBldt6+dBcjHQ/e
Malware Config
Extracted
quasar
1.4.1
Windows Client
148.163.102.170:4782
4c18e02c-7c39-4a5e-bbef-16fe13828101
-
encryption_key
73B0A3AC50C78E243EA93BF9E60C9BC63D63CA26
-
install_name
Sever Startup.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Startup
-
subdirectory
Windows Startup
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2592-9-0x0000000000B10000-0x0000000000E34000-memory.dmp family_quasar behavioral1/files/0x0008000000016c66-7.dat family_quasar behavioral1/memory/2556-1-0x00000000010F0000-0x0000000001414000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2592 Sever Startup.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2580 schtasks.exe 2248 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2556 a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043.exe Token: SeDebugPrivilege 2592 Sever Startup.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2592 Sever Startup.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2592 Sever Startup.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2592 Sever Startup.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2556 wrote to memory of 2580 2556 a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043.exe 30 PID 2556 wrote to memory of 2580 2556 a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043.exe 30 PID 2556 wrote to memory of 2580 2556 a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043.exe 30 PID 2556 wrote to memory of 2592 2556 a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043.exe 32 PID 2556 wrote to memory of 2592 2556 a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043.exe 32 PID 2556 wrote to memory of 2592 2556 a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043.exe 32 PID 2592 wrote to memory of 2248 2592 Sever Startup.exe 33 PID 2592 wrote to memory of 2248 2592 Sever Startup.exe 33 PID 2592 wrote to memory of 2248 2592 Sever Startup.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043.exe"C:\Users\Admin\AppData\Local\Temp\a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2580
-
-
C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe"C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2248
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5b29de0d04753ec41025d33b6c305b91d
SHA11fbb9cfbda8c550a142a80cef83706923af87cd8
SHA256a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043
SHA512cfa6f06cb7e2a8e1ff888fc783e0271f61db39251350423432d4be829188c98cd744e946595ccc01c9ad2b03053a10efa13312ce70c80f837293b6785c215816