Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-12-2024 17:35
Behavioral task
behavioral1
Sample
89fa63d15ed2d1efecb7cea57600721b74f90e2f83e213f556759e788133a75d.exe
Resource
win7-20240903-en
General
-
Target
89fa63d15ed2d1efecb7cea57600721b74f90e2f83e213f556759e788133a75d.exe
-
Size
3.1MB
-
MD5
6d6b0853a2aac3f0fe8403826e778cfd
-
SHA1
2a7d910997330b2e00555252603b725af6a9a8bb
-
SHA256
89fa63d15ed2d1efecb7cea57600721b74f90e2f83e213f556759e788133a75d
-
SHA512
2d1b1af0c174c85f0c0be5f946a71826c8d18489d7b6c8a8f8d09a9709f1669c232e270fbce945d04740c5cfabf46e17e17a291d263c537a04dda8932e40ec28
-
SSDEEP
49152:Hv+I22SsaNYfdPBldt698dBcjHFFRJ6PbR3LoGd4hyTHHB72eh2NT:Hvz22SsaNYfdPBldt6+dBcjHFFRJ6hG
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.181.84:4782
1ed20179-691a-4881-806d-c5d12340d8e9
-
encryption_key
DF9BFB10D9C47294CB84A29DC07B28AE843D8C6F
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/320-1-0x0000000000A60000-0x0000000000D84000-memory.dmp family_quasar behavioral1/files/0x000800000001650a-6.dat family_quasar behavioral1/memory/1728-9-0x0000000000C60000-0x0000000000F84000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 1728 Client.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2380 schtasks.exe 2748 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 320 89fa63d15ed2d1efecb7cea57600721b74f90e2f83e213f556759e788133a75d.exe Token: SeDebugPrivilege 1728 Client.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1728 Client.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1728 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1728 Client.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 320 wrote to memory of 2380 320 89fa63d15ed2d1efecb7cea57600721b74f90e2f83e213f556759e788133a75d.exe 32 PID 320 wrote to memory of 2380 320 89fa63d15ed2d1efecb7cea57600721b74f90e2f83e213f556759e788133a75d.exe 32 PID 320 wrote to memory of 2380 320 89fa63d15ed2d1efecb7cea57600721b74f90e2f83e213f556759e788133a75d.exe 32 PID 320 wrote to memory of 1728 320 89fa63d15ed2d1efecb7cea57600721b74f90e2f83e213f556759e788133a75d.exe 34 PID 320 wrote to memory of 1728 320 89fa63d15ed2d1efecb7cea57600721b74f90e2f83e213f556759e788133a75d.exe 34 PID 320 wrote to memory of 1728 320 89fa63d15ed2d1efecb7cea57600721b74f90e2f83e213f556759e788133a75d.exe 34 PID 1728 wrote to memory of 2748 1728 Client.exe 35 PID 1728 wrote to memory of 2748 1728 Client.exe 35 PID 1728 wrote to memory of 2748 1728 Client.exe 35 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\89fa63d15ed2d1efecb7cea57600721b74f90e2f83e213f556759e788133a75d.exe"C:\Users\Admin\AppData\Local\Temp\89fa63d15ed2d1efecb7cea57600721b74f90e2f83e213f556759e788133a75d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2380
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2748
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD56d6b0853a2aac3f0fe8403826e778cfd
SHA12a7d910997330b2e00555252603b725af6a9a8bb
SHA25689fa63d15ed2d1efecb7cea57600721b74f90e2f83e213f556759e788133a75d
SHA5122d1b1af0c174c85f0c0be5f946a71826c8d18489d7b6c8a8f8d09a9709f1669c232e270fbce945d04740c5cfabf46e17e17a291d263c537a04dda8932e40ec28