Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 06:42
Behavioral task
behavioral1
Sample
skibidi.exe
Resource
win7-20241010-en
General
-
Target
skibidi.exe
-
Size
3.1MB
-
MD5
5c73e901190eb50c2794a879a354417d
-
SHA1
e7e0e5552b9656e3790aa748f9af8774b606ed66
-
SHA256
7ccfce0efe92cb5edd40257ce119bc91b50012c8081cb639aad6caab663a3ff6
-
SHA512
fc3bb5c1c6b2917e6169cfc7633f91335eda82c68518f801e26805fc6381afb54508dbc689eb7c946ebe5e6195b37daa1639243e3fef3ee2073dbb1aa8495fd6
-
SSDEEP
49152:Wvkt62XlaSFNWPjljiFa2RoUYIf1So1J/UoGd8zTHHB72eh2NT:Wv462XlaSFNWPjljiFXRoUYIf1SX
Malware Config
Extracted
quasar
1.4.1
Office04
hilol.zapto.org:20
11bbf22e-826e-486b-b024-adbd86228a9e
-
encryption_key
7A589EDBC6A581E125BF830EF0D05FC74BB75E30
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
ctfmon
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/3968-1-0x0000000000020000-0x0000000000344000-memory.dmp family_quasar behavioral2/files/0x0009000000023bd3-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 3980 Client.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4976 schtasks.exe 660 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3968 skibidi.exe Token: SeDebugPrivilege 3980 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3980 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3968 wrote to memory of 4976 3968 skibidi.exe 82 PID 3968 wrote to memory of 4976 3968 skibidi.exe 82 PID 3968 wrote to memory of 3980 3968 skibidi.exe 84 PID 3968 wrote to memory of 3980 3968 skibidi.exe 84 PID 3980 wrote to memory of 660 3980 Client.exe 85 PID 3980 wrote to memory of 660 3980 Client.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\skibidi.exe"C:\Users\Admin\AppData\Local\Temp\skibidi.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4976
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:660
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD55c73e901190eb50c2794a879a354417d
SHA1e7e0e5552b9656e3790aa748f9af8774b606ed66
SHA2567ccfce0efe92cb5edd40257ce119bc91b50012c8081cb639aad6caab663a3ff6
SHA512fc3bb5c1c6b2917e6169cfc7633f91335eda82c68518f801e26805fc6381afb54508dbc689eb7c946ebe5e6195b37daa1639243e3fef3ee2073dbb1aa8495fd6