Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 06:34
Behavioral task
behavioral1
Sample
svhost.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
svhost.exe
Resource
win10v2004-20241007-en
General
-
Target
svhost.exe
-
Size
3.1MB
-
MD5
c80f9809068b2d6af93f3f30d8e5bd6d
-
SHA1
c1f5e71198cfcc328acf4c2b62d7782f15ebe55c
-
SHA256
ded57e1b9960e3bb53db62cfc1539d91179a6eb2b1d16e8eca2e6903205caeed
-
SHA512
10bfa7c1398822252a094890a1d6b6c27d0c80a36614fb7e2d258337e697732424a47541e2f2007d01eff91a5b4c3b39f7677d03232706b307f9fad1aa24ed9c
-
SSDEEP
49152:SvbI22SsaNYfdPBldt698dBcjHmZ/g8dB0KoBdW/THHB72eh2NT:Svk22SsaNYfdPBldt6+dBcjHm9g0Z
Malware Config
Extracted
quasar
1.4.1
Windows Client
148.163.102.170:4782
4c18e02c-7c39-4a5e-bbef-16fe13828101
-
encryption_key
73B0A3AC50C78E243EA93BF9E60C9BC63D63CA26
-
install_name
Sever Startup.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Startup
-
subdirectory
Windows Startup
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2244-1-0x00000000012C0000-0x00000000015E4000-memory.dmp family_quasar behavioral1/files/0x0031000000018bbf-6.dat family_quasar behavioral1/memory/2948-9-0x0000000000A40000-0x0000000000D64000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2948 Sever Startup.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2876 schtasks.exe 3012 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2244 svhost.exe Token: SeDebugPrivilege 2948 Sever Startup.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2948 Sever Startup.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2948 Sever Startup.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2948 Sever Startup.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2876 2244 svhost.exe 30 PID 2244 wrote to memory of 2876 2244 svhost.exe 30 PID 2244 wrote to memory of 2876 2244 svhost.exe 30 PID 2244 wrote to memory of 2948 2244 svhost.exe 32 PID 2244 wrote to memory of 2948 2244 svhost.exe 32 PID 2244 wrote to memory of 2948 2244 svhost.exe 32 PID 2948 wrote to memory of 3012 2948 Sever Startup.exe 33 PID 2948 wrote to memory of 3012 2948 Sever Startup.exe 33 PID 2948 wrote to memory of 3012 2948 Sever Startup.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2876
-
-
C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe"C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3012
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5c80f9809068b2d6af93f3f30d8e5bd6d
SHA1c1f5e71198cfcc328acf4c2b62d7782f15ebe55c
SHA256ded57e1b9960e3bb53db62cfc1539d91179a6eb2b1d16e8eca2e6903205caeed
SHA51210bfa7c1398822252a094890a1d6b6c27d0c80a36614fb7e2d258337e697732424a47541e2f2007d01eff91a5b4c3b39f7677d03232706b307f9fad1aa24ed9c