Analysis
-
max time kernel
128s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 06:37
Behavioral task
behavioral1
Sample
installer.exe
Resource
win7-20240903-en
General
-
Target
installer.exe
-
Size
3.1MB
-
MD5
dbde842faf140037f07cad5bd09771e9
-
SHA1
64dbcaf7d1e664556b5fd82e0e8b8efeae38dea0
-
SHA256
9b4a5a44a932c5c42086a5989f87a5261ab8e6e96bc8ea2c0cf7ca6de68bc7ad
-
SHA512
8a970a2ef3e0bcf378acce7a748289b8cdc68c5ff7b50d940dd4ce1f94c9790e9be6a440e1baf57e5fab8a6d767d4a1ddbe6b2244c23a95f91f553af32339885
-
SSDEEP
49152:hveI22SsaNYfdPBldt698dBcjHDCG1JELoGdXTHHB72eh2NT:hvT22SsaNYfdPBldt6+dBcjHDC3
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.68.104:4782
93aae856-95a8-4f87-bb5a-e035e00ec571
-
encryption_key
A9BD88FEF9A2EA52A07F5C37D168C315C868BC60
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Antimalware Core Service
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/3128-1-0x0000000000C40000-0x0000000000F64000-memory.dmp family_quasar behavioral2/files/0x000a000000023b9d-7.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 976 Client.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1920 schtasks.exe 4840 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3128 installer.exe Token: SeDebugPrivilege 976 Client.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 976 Client.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 976 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 976 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3128 wrote to memory of 1920 3128 installer.exe 82 PID 3128 wrote to memory of 1920 3128 installer.exe 82 PID 3128 wrote to memory of 976 3128 installer.exe 84 PID 3128 wrote to memory of 976 3128 installer.exe 84 PID 976 wrote to memory of 4840 976 Client.exe 85 PID 976 wrote to memory of 4840 976 Client.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\installer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Antimalware Core Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1920
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Antimalware Core Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4840
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5dbde842faf140037f07cad5bd09771e9
SHA164dbcaf7d1e664556b5fd82e0e8b8efeae38dea0
SHA2569b4a5a44a932c5c42086a5989f87a5261ab8e6e96bc8ea2c0cf7ca6de68bc7ad
SHA5128a970a2ef3e0bcf378acce7a748289b8cdc68c5ff7b50d940dd4ce1f94c9790e9be6a440e1baf57e5fab8a6d767d4a1ddbe6b2244c23a95f91f553af32339885