Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14-12-2024 12:31
Behavioral task
behavioral1
Sample
b961d39237a098049a7ba1b6c78f2f02b6f1b9e80d149593f3103aafb6b215b8.exe
Resource
win7-20241010-en
General
-
Target
b961d39237a098049a7ba1b6c78f2f02b6f1b9e80d149593f3103aafb6b215b8.exe
-
Size
3.1MB
-
MD5
77de6e8143094a619804ebf2d59eb094
-
SHA1
b87fc79d0825d979314c392781b0211087e78ca2
-
SHA256
b961d39237a098049a7ba1b6c78f2f02b6f1b9e80d149593f3103aafb6b215b8
-
SHA512
fa6dcd1d8b78548e12d22098a6b9107a744b9b85dd8276c18faf601f30ada97e7f023c6e376dc929c715c308a57b1105199acdd69697a0e6930bccd7afc2a6f9
-
SSDEEP
49152:zvylL26AaNeWgPhlmVqvMQ7XSKokCP1JSLoGdatCTHHB72eh2NT:zvqL26AaNeWgPhlmVqkQ7XSKokCs
Malware Config
Extracted
quasar
1.4.1
Test
193.161.193.99:35184
67.205.154.243:35184
9cabbafb-503b-49f1-ab22-adc756455c10
-
encryption_key
8B93C77AC1C58EA80A3327E9FD26246A79EF3B8E
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
MS Build Tools
-
subdirectory
Microsoft-Build-Tools
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2292-1-0x0000000000D20000-0x0000000001044000-memory.dmp family_quasar behavioral1/files/0x000800000001941b-5.dat family_quasar behavioral1/memory/1940-7-0x0000000000950000-0x0000000000C74000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 1940 Client.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 484 schtasks.exe 2752 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2292 b961d39237a098049a7ba1b6c78f2f02b6f1b9e80d149593f3103aafb6b215b8.exe Token: SeDebugPrivilege 1940 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1940 Client.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2292 wrote to memory of 484 2292 b961d39237a098049a7ba1b6c78f2f02b6f1b9e80d149593f3103aafb6b215b8.exe 31 PID 2292 wrote to memory of 484 2292 b961d39237a098049a7ba1b6c78f2f02b6f1b9e80d149593f3103aafb6b215b8.exe 31 PID 2292 wrote to memory of 484 2292 b961d39237a098049a7ba1b6c78f2f02b6f1b9e80d149593f3103aafb6b215b8.exe 31 PID 2292 wrote to memory of 1940 2292 b961d39237a098049a7ba1b6c78f2f02b6f1b9e80d149593f3103aafb6b215b8.exe 33 PID 2292 wrote to memory of 1940 2292 b961d39237a098049a7ba1b6c78f2f02b6f1b9e80d149593f3103aafb6b215b8.exe 33 PID 2292 wrote to memory of 1940 2292 b961d39237a098049a7ba1b6c78f2f02b6f1b9e80d149593f3103aafb6b215b8.exe 33 PID 1940 wrote to memory of 2752 1940 Client.exe 34 PID 1940 wrote to memory of 2752 1940 Client.exe 34 PID 1940 wrote to memory of 2752 1940 Client.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b961d39237a098049a7ba1b6c78f2f02b6f1b9e80d149593f3103aafb6b215b8.exe"C:\Users\Admin\AppData\Local\Temp\b961d39237a098049a7ba1b6c78f2f02b6f1b9e80d149593f3103aafb6b215b8.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "MS Build Tools" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft-Build-Tools\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:484
-
-
C:\Users\Admin\AppData\Roaming\Microsoft-Build-Tools\Client.exe"C:\Users\Admin\AppData\Roaming\Microsoft-Build-Tools\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "MS Build Tools" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft-Build-Tools\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2752
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD577de6e8143094a619804ebf2d59eb094
SHA1b87fc79d0825d979314c392781b0211087e78ca2
SHA256b961d39237a098049a7ba1b6c78f2f02b6f1b9e80d149593f3103aafb6b215b8
SHA512fa6dcd1d8b78548e12d22098a6b9107a744b9b85dd8276c18faf601f30ada97e7f023c6e376dc929c715c308a57b1105199acdd69697a0e6930bccd7afc2a6f9