Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 06:34
Behavioral task
behavioral1
Sample
MMO 1.exe
Resource
win7-20240708-en
General
-
Target
MMO 1.exe
-
Size
3.1MB
-
MD5
5c585cd5a2d292a0cb0be6b10cace921
-
SHA1
84b90137c36d741a4291aa22f4450c470ed9bd89
-
SHA256
4c55655c8daeb51fb9592bfd3eb4e29e1a40fc89b13af090c52cbcd4b6390521
-
SHA512
958c91d84c7e163fd473caf91363680347aa452aebdae76a4c01b39da790d003c20af6462bec3663c0208e8680ae2a9042fbc2c8ed8960e062dd51070fa39b27
-
SSDEEP
49152:avCI22SsaNYfdPBldt698dBcjHQCv1JSpoGdTvTHHB72eh2NT:avP22SsaNYfdPBldt6+dBcjHQCa
Malware Config
Extracted
quasar
1.4.1
Office04
tieumao1995-51127.portmap.io:51127
4119a2e0-4ae4-4843-8534-99af91a2475d
-
encryption_key
DF6316067206E09C1F85138FCEBD56F5D94BF6AE
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/2108-1-0x0000000000BA0000-0x0000000000EC6000-memory.dmp family_quasar behavioral2/files/0x0007000000023c60-5.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2280 Client.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4056 schtasks.exe 3912 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2108 MMO 1.exe Token: SeDebugPrivilege 2280 Client.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2280 Client.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2280 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2280 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2108 wrote to memory of 4056 2108 MMO 1.exe 82 PID 2108 wrote to memory of 4056 2108 MMO 1.exe 82 PID 2108 wrote to memory of 2280 2108 MMO 1.exe 84 PID 2108 wrote to memory of 2280 2108 MMO 1.exe 84 PID 2280 wrote to memory of 3912 2280 Client.exe 85 PID 2280 wrote to memory of 3912 2280 Client.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MMO 1.exe"C:\Users\Admin\AppData\Local\Temp\MMO 1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4056
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3912
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD55c585cd5a2d292a0cb0be6b10cace921
SHA184b90137c36d741a4291aa22f4450c470ed9bd89
SHA2564c55655c8daeb51fb9592bfd3eb4e29e1a40fc89b13af090c52cbcd4b6390521
SHA512958c91d84c7e163fd473caf91363680347aa452aebdae76a4c01b39da790d003c20af6462bec3663c0208e8680ae2a9042fbc2c8ed8960e062dd51070fa39b27