Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 06:34
Behavioral task
behavioral1
Sample
negarque.exe
Resource
win7-20240903-en
General
-
Target
negarque.exe
-
Size
3.1MB
-
MD5
2fd750229aa6122c30607bb59293a909
-
SHA1
0feb9d22c13e6c2d19942788a49721db23e48d35
-
SHA256
5420cbc5d6be7831ccd48e8c7860f7d5c1060db80ed82063258f81c777aca8f1
-
SHA512
772b515f3efcff2a0fde47c125f9531d50028394a6c758e45e54743298714d118edaa94c6a67034a8a1cdce06f68342acee5b0fc0bc5ca610d28e8b8a6f52dec
-
SSDEEP
49152:Dvht62XlaSFNWPjljiFa2RoUYImsRJ6abR3LoGdlTHHB72eh2NT:DvL62XlaSFNWPjljiFXRoUYImsRJ60
Malware Config
Extracted
quasar
1.4.1
Office04
0.tcp.us-cal-1.ngrok.io:11837
11bbf22e-826e-486b-b024-adbd86228a9e
-
encryption_key
7A589EDBC6A581E125BF830EF0D05FC74BB75E30
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
ctfmon
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/4700-1-0x0000000000240000-0x0000000000564000-memory.dmp family_quasar behavioral2/files/0x000b000000023b61-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 1992 Client.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 13 0.tcp.us-cal-1.ngrok.io 50 0.tcp.us-cal-1.ngrok.io 65 0.tcp.us-cal-1.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3020 schtasks.exe 2708 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4700 negarque.exe Token: SeDebugPrivilege 1992 Client.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1992 Client.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1992 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1992 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4700 wrote to memory of 2708 4700 negarque.exe 83 PID 4700 wrote to memory of 2708 4700 negarque.exe 83 PID 4700 wrote to memory of 1992 4700 negarque.exe 85 PID 4700 wrote to memory of 1992 4700 negarque.exe 85 PID 1992 wrote to memory of 3020 1992 Client.exe 86 PID 1992 wrote to memory of 3020 1992 Client.exe 86 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\negarque.exe"C:\Users\Admin\AppData\Local\Temp\negarque.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2708
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3020
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD52fd750229aa6122c30607bb59293a909
SHA10feb9d22c13e6c2d19942788a49721db23e48d35
SHA2565420cbc5d6be7831ccd48e8c7860f7d5c1060db80ed82063258f81c777aca8f1
SHA512772b515f3efcff2a0fde47c125f9531d50028394a6c758e45e54743298714d118edaa94c6a67034a8a1cdce06f68342acee5b0fc0bc5ca610d28e8b8a6f52dec