Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 04:27
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Bootstrapper.exe
Resource
win10v2004-20241007-en
General
-
Target
Bootstrapper.exe
-
Size
3.1MB
-
MD5
972d7bcd3eb4daaa0ef69215d91e41d9
-
SHA1
d3bcc25f8585405642a113ae6bae503648a765a2
-
SHA256
bfb28a852b12a795fb4d21fbe2b2f4c56e9742cbeace1cf9564b97bda1d08e55
-
SHA512
17433b55a5f0f61b0db42e22f975c4fa96298bc79a7a15b34d5342057bbf97a5229b23a7a12cc4a02afb48e485a2ae4ff05892b132ef19d145f2997814885cf0
-
SSDEEP
49152:bvblL26AaNeWgPhlmVqvMQ7XSKjBOEEqk7k/8FFoGdRnggTHHB72eh2NT:bvBL26AaNeWgPhlmVqkQ7XSKjBOjT
Malware Config
Extracted
quasar
1.4.1
rat client
AMNSALKSamongus-47679.portmap.host:4782
d3bc3858-ff4a-4aa8-97ec-67721ddcdeeb
-
encryption_key
C8D618C9B5D2F91FFC94B6E9C868ECF80EB774F8
-
install_name
Client.exe
-
log_directory
ratted client
-
reconnect_delay
3000
-
startup_key
RedTiger Tool v6.1
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/4380-1-0x00000000000F0000-0x0000000000414000-memory.dmp family_quasar behavioral2/files/0x0007000000023cb6-5.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 4700 Client.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1008 schtasks.exe 2800 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4380 Bootstrapper.exe Token: SeDebugPrivilege 4700 Client.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4700 Client.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4700 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4700 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4380 wrote to memory of 1008 4380 Bootstrapper.exe 82 PID 4380 wrote to memory of 1008 4380 Bootstrapper.exe 82 PID 4380 wrote to memory of 4700 4380 Bootstrapper.exe 84 PID 4380 wrote to memory of 4700 4380 Bootstrapper.exe 84 PID 4700 wrote to memory of 2800 4700 Client.exe 85 PID 4700 wrote to memory of 2800 4700 Client.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RedTiger Tool v6.1" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1008
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RedTiger Tool v6.1" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2800
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5972d7bcd3eb4daaa0ef69215d91e41d9
SHA1d3bcc25f8585405642a113ae6bae503648a765a2
SHA256bfb28a852b12a795fb4d21fbe2b2f4c56e9742cbeace1cf9564b97bda1d08e55
SHA51217433b55a5f0f61b0db42e22f975c4fa96298bc79a7a15b34d5342057bbf97a5229b23a7a12cc4a02afb48e485a2ae4ff05892b132ef19d145f2997814885cf0