Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 06:43
Behavioral task
behavioral1
Sample
lmao.exe
Resource
win7-20240729-en
General
-
Target
lmao.exe
-
Size
3.1MB
-
MD5
942d7d99678d584c4481278378741d51
-
SHA1
97efb624cfa34da0c5583e61a5982fd496de8e2d
-
SHA256
4119dedd1d6408f80505394a374cde76124a736913f958c878f54c16c98986e3
-
SHA512
0c1798628d5c90eaa6cf54277ab917408b5921e4f39ece0505510d9b7241df6748a365bc2a0a1cdaa24771f4ac56a9973a6515a0e32a14a66a9ed98c2871dfba
-
SSDEEP
49152:yvht62XlaSFNWPjljiFa2RoUYI4CZ1J5LoGdQPTHHB72eh2NT:yvL62XlaSFNWPjljiFXRoUYI4CT
Malware Config
Extracted
quasar
1.4.1
Office04
4.tcp.us-cal-1.ngrok.io:18092
11bbf22e-826e-486b-b024-adbd86228a9e
-
encryption_key
7A589EDBC6A581E125BF830EF0D05FC74BB75E30
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
ctfmon
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/2180-1-0x0000000000630000-0x0000000000954000-memory.dmp family_quasar behavioral2/files/0x000a000000023c97-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 5052 Client.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 12 4.tcp.us-cal-1.ngrok.io 47 4.tcp.us-cal-1.ngrok.io 57 4.tcp.us-cal-1.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 216 schtasks.exe 3700 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2180 lmao.exe Token: SeDebugPrivilege 5052 Client.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5052 Client.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5052 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5052 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2180 wrote to memory of 3700 2180 lmao.exe 82 PID 2180 wrote to memory of 3700 2180 lmao.exe 82 PID 2180 wrote to memory of 5052 2180 lmao.exe 84 PID 2180 wrote to memory of 5052 2180 lmao.exe 84 PID 5052 wrote to memory of 216 5052 Client.exe 85 PID 5052 wrote to memory of 216 5052 Client.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\lmao.exe"C:\Users\Admin\AppData\Local\Temp\lmao.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3700
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:216
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5942d7d99678d584c4481278378741d51
SHA197efb624cfa34da0c5583e61a5982fd496de8e2d
SHA2564119dedd1d6408f80505394a374cde76124a736913f958c878f54c16c98986e3
SHA5120c1798628d5c90eaa6cf54277ab917408b5921e4f39ece0505510d9b7241df6748a365bc2a0a1cdaa24771f4ac56a9973a6515a0e32a14a66a9ed98c2871dfba