Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 06:36
Behavioral task
behavioral1
Sample
LB2FI_Client-built.exe
Resource
win7-20240903-en
General
-
Target
LB2FI_Client-built.exe
-
Size
3.1MB
-
MD5
8f5bd87ff24f2310b9c803b764fdae24
-
SHA1
ac5b97def6b237c077c7cbb26a44b813cd40dfbd
-
SHA256
77244092e7dd606f04a3f38af9050f91e6cd78989526e56440a8fa3f5ece758f
-
SHA512
9a216ee4eaef4200ef6264ad5d79a555c2487b8577ff4dce69dd1c37ed00b8ca87f239068c1f36f546faa7b962e9415fc80f8bbe03d1187f87f4fbb1cf9ca22c
-
SSDEEP
49152:Cvkt62XlaSFNWPjljiFa2RoUYIr4mWmzuLoGdNVaTHHB72eh2NT:Cv462XlaSFNWPjljiFXRoUYIr4msd
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.43.241:4782
0d40e7a7-49fe-45a6-9c6d-b8affa11f503
-
encryption_key
6095BF6D5D58D02597F98370DFD1CCEB782F1EDD
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svhost
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/684-1-0x0000000000BF0000-0x0000000000F14000-memory.dmp family_quasar behavioral1/files/0x0033000000015db1-6.dat family_quasar behavioral1/memory/2656-9-0x0000000000C80000-0x0000000000FA4000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2656 Client.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2796 schtasks.exe 2560 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 684 LB2FI_Client-built.exe Token: SeDebugPrivilege 2656 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2656 Client.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 684 wrote to memory of 2796 684 LB2FI_Client-built.exe 30 PID 684 wrote to memory of 2796 684 LB2FI_Client-built.exe 30 PID 684 wrote to memory of 2796 684 LB2FI_Client-built.exe 30 PID 684 wrote to memory of 2656 684 LB2FI_Client-built.exe 32 PID 684 wrote to memory of 2656 684 LB2FI_Client-built.exe 32 PID 684 wrote to memory of 2656 684 LB2FI_Client-built.exe 32 PID 2656 wrote to memory of 2560 2656 Client.exe 33 PID 2656 wrote to memory of 2560 2656 Client.exe 33 PID 2656 wrote to memory of 2560 2656 Client.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB2FI_Client-built.exe"C:\Users\Admin\AppData\Local\Temp\LB2FI_Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2796
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2560
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD58f5bd87ff24f2310b9c803b764fdae24
SHA1ac5b97def6b237c077c7cbb26a44b813cd40dfbd
SHA25677244092e7dd606f04a3f38af9050f91e6cd78989526e56440a8fa3f5ece758f
SHA5129a216ee4eaef4200ef6264ad5d79a555c2487b8577ff4dce69dd1c37ed00b8ca87f239068c1f36f546faa7b962e9415fc80f8bbe03d1187f87f4fbb1cf9ca22c