Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 06:10
Behavioral task
behavioral1
Sample
SerialChecker.exe
Resource
win7-20240903-en
General
-
Target
SerialChecker.exe
-
Size
3.1MB
-
MD5
70fa564a25bdd50a78764228f591f9a0
-
SHA1
2d025703005c25bc35b4755321844f3adc41c974
-
SHA256
9fda62581f43e3936e371ced328374f97a7ede2b9fff3748bf618977b1da495a
-
SHA512
ce33af378f45752148de566ec1281a4e212b5af8e9d9d942f833f8d35a5c5d84f8657f17dc053d4bd56ae6ea556122de8039d0cab8c37d6eb5af9f89041eaff3
-
SSDEEP
49152:Ovkt62XlaSFNWPjljiFa2RoUYIbnp9nr1oGdI2THHB72eh2NT:Ov462XlaSFNWPjljiFXRoUYI7p9nZ
Malware Config
Extracted
quasar
1.4.1
FN
192.168.1.217:4782
5c3e1592-9532-4a55-9a67-38ea1d723d1f
-
encryption_key
53C48FEB4994411E81FCC7855A2076C90E2AC3C1
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Update
-
subdirectory
FN
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/4816-1-0x0000000000470000-0x0000000000794000-memory.dmp family_quasar behavioral2/files/0x0009000000023ca4-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 3516 Client.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4060 schtasks.exe 1048 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4816 SerialChecker.exe Token: SeDebugPrivilege 3516 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3516 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4816 wrote to memory of 4060 4816 SerialChecker.exe 82 PID 4816 wrote to memory of 4060 4816 SerialChecker.exe 82 PID 4816 wrote to memory of 3516 4816 SerialChecker.exe 84 PID 4816 wrote to memory of 3516 4816 SerialChecker.exe 84 PID 3516 wrote to memory of 1048 3516 Client.exe 85 PID 3516 wrote to memory of 1048 3516 Client.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SerialChecker.exe"C:\Users\Admin\AppData\Local\Temp\SerialChecker.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\FN\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4060
-
-
C:\Users\Admin\AppData\Roaming\FN\Client.exe"C:\Users\Admin\AppData\Roaming\FN\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\FN\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1048
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD570fa564a25bdd50a78764228f591f9a0
SHA12d025703005c25bc35b4755321844f3adc41c974
SHA2569fda62581f43e3936e371ced328374f97a7ede2b9fff3748bf618977b1da495a
SHA512ce33af378f45752148de566ec1281a4e212b5af8e9d9d942f833f8d35a5c5d84f8657f17dc053d4bd56ae6ea556122de8039d0cab8c37d6eb5af9f89041eaff3