Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 06:43
Behavioral task
behavioral1
Sample
lmao.exe
Resource
win7-20240729-en
General
-
Target
lmao.exe
-
Size
3.1MB
-
MD5
942d7d99678d584c4481278378741d51
-
SHA1
97efb624cfa34da0c5583e61a5982fd496de8e2d
-
SHA256
4119dedd1d6408f80505394a374cde76124a736913f958c878f54c16c98986e3
-
SHA512
0c1798628d5c90eaa6cf54277ab917408b5921e4f39ece0505510d9b7241df6748a365bc2a0a1cdaa24771f4ac56a9973a6515a0e32a14a66a9ed98c2871dfba
-
SSDEEP
49152:yvht62XlaSFNWPjljiFa2RoUYI4CZ1J5LoGdQPTHHB72eh2NT:yvL62XlaSFNWPjljiFXRoUYI4CT
Malware Config
Extracted
quasar
1.4.1
Office04
4.tcp.us-cal-1.ngrok.io:18092
11bbf22e-826e-486b-b024-adbd86228a9e
-
encryption_key
7A589EDBC6A581E125BF830EF0D05FC74BB75E30
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
ctfmon
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2412-1-0x0000000000AD0000-0x0000000000DF4000-memory.dmp family_quasar behavioral1/files/0x00070000000186d9-6.dat family_quasar behavioral1/memory/2684-10-0x0000000000CE0000-0x0000000001004000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2684 Client.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 2 4.tcp.us-cal-1.ngrok.io 10 4.tcp.us-cal-1.ngrok.io 20 4.tcp.us-cal-1.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2852 schtasks.exe 2752 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2412 lmao.exe Token: SeDebugPrivilege 2684 Client.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2684 Client.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2684 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2684 Client.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2852 2412 lmao.exe 30 PID 2412 wrote to memory of 2852 2412 lmao.exe 30 PID 2412 wrote to memory of 2852 2412 lmao.exe 30 PID 2412 wrote to memory of 2684 2412 lmao.exe 32 PID 2412 wrote to memory of 2684 2412 lmao.exe 32 PID 2412 wrote to memory of 2684 2412 lmao.exe 32 PID 2684 wrote to memory of 2752 2684 Client.exe 33 PID 2684 wrote to memory of 2752 2684 Client.exe 33 PID 2684 wrote to memory of 2752 2684 Client.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\lmao.exe"C:\Users\Admin\AppData\Local\Temp\lmao.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2852
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2752
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5942d7d99678d584c4481278378741d51
SHA197efb624cfa34da0c5583e61a5982fd496de8e2d
SHA2564119dedd1d6408f80505394a374cde76124a736913f958c878f54c16c98986e3
SHA5120c1798628d5c90eaa6cf54277ab917408b5921e4f39ece0505510d9b7241df6748a365bc2a0a1cdaa24771f4ac56a9973a6515a0e32a14a66a9ed98c2871dfba