Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 06:44
Behavioral task
behavioral1
Sample
executablelol.exe
Resource
win7-20240903-en
General
-
Target
executablelol.exe
-
Size
3.1MB
-
MD5
7aa529f2db5a30ed1b868c90e872ec57
-
SHA1
f384f3c375411eea2c72cdc15c6252102535656a
-
SHA256
1df46d513e053da3765c3b5572fda399872f69f734a8eaf9345948a6331eefa1
-
SHA512
404f3ba56677f362129b8352f0585e13f86e8f6a6570ca1deaed9551f01fea43b523d0318e314d5d99b371a2c44ac8ed9a4dae19788b10df325147b17d0a2120
-
SSDEEP
49152:avht62XlaSFNWPjljiFa2RoUYIb3RJ6PbR3LoGdarTHHB72eh2NT:avL62XlaSFNWPjljiFXRoUYIb3RJ6h
Malware Config
Extracted
quasar
1.4.1
Office04
0.tcp.us-cal-1.ngrok.io:15579
11bbf22e-826e-486b-b024-adbd86228a9e
-
encryption_key
7A589EDBC6A581E125BF830EF0D05FC74BB75E30
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
ctfmon
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2420-1-0x0000000000B00000-0x0000000000E24000-memory.dmp family_quasar behavioral1/files/0x0008000000017409-6.dat family_quasar behavioral1/memory/2996-9-0x0000000000B80000-0x0000000000EA4000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2996 Client.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 24 0.tcp.us-cal-1.ngrok.io 2 0.tcp.us-cal-1.ngrok.io 15 0.tcp.us-cal-1.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2800 schtasks.exe 2836 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2420 executablelol.exe Token: SeDebugPrivilege 2996 Client.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2996 Client.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2996 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2996 Client.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2800 2420 executablelol.exe 30 PID 2420 wrote to memory of 2800 2420 executablelol.exe 30 PID 2420 wrote to memory of 2800 2420 executablelol.exe 30 PID 2420 wrote to memory of 2996 2420 executablelol.exe 32 PID 2420 wrote to memory of 2996 2420 executablelol.exe 32 PID 2420 wrote to memory of 2996 2420 executablelol.exe 32 PID 2996 wrote to memory of 2836 2996 Client.exe 33 PID 2996 wrote to memory of 2836 2996 Client.exe 33 PID 2996 wrote to memory of 2836 2996 Client.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\executablelol.exe"C:\Users\Admin\AppData\Local\Temp\executablelol.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2800
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2836
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD57aa529f2db5a30ed1b868c90e872ec57
SHA1f384f3c375411eea2c72cdc15c6252102535656a
SHA2561df46d513e053da3765c3b5572fda399872f69f734a8eaf9345948a6331eefa1
SHA512404f3ba56677f362129b8352f0585e13f86e8f6a6570ca1deaed9551f01fea43b523d0318e314d5d99b371a2c44ac8ed9a4dae19788b10df325147b17d0a2120