Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 06:34
Behavioral task
behavioral1
Sample
svhost.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
svhost.exe
Resource
win10v2004-20241007-en
General
-
Target
svhost.exe
-
Size
3.1MB
-
MD5
c80f9809068b2d6af93f3f30d8e5bd6d
-
SHA1
c1f5e71198cfcc328acf4c2b62d7782f15ebe55c
-
SHA256
ded57e1b9960e3bb53db62cfc1539d91179a6eb2b1d16e8eca2e6903205caeed
-
SHA512
10bfa7c1398822252a094890a1d6b6c27d0c80a36614fb7e2d258337e697732424a47541e2f2007d01eff91a5b4c3b39f7677d03232706b307f9fad1aa24ed9c
-
SSDEEP
49152:SvbI22SsaNYfdPBldt698dBcjHmZ/g8dB0KoBdW/THHB72eh2NT:Svk22SsaNYfdPBldt6+dBcjHm9g0Z
Malware Config
Extracted
quasar
1.4.1
Windows Client
148.163.102.170:4782
4c18e02c-7c39-4a5e-bbef-16fe13828101
-
encryption_key
73B0A3AC50C78E243EA93BF9E60C9BC63D63CA26
-
install_name
Sever Startup.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Startup
-
subdirectory
Windows Startup
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/3880-1-0x00000000007B0000-0x0000000000AD4000-memory.dmp family_quasar behavioral2/files/0x000300000001e5b2-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 3092 Sever Startup.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3416 schtasks.exe 1436 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3880 svhost.exe Token: SeDebugPrivilege 3092 Sever Startup.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3092 Sever Startup.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3092 Sever Startup.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3092 Sever Startup.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3880 wrote to memory of 3416 3880 svhost.exe 85 PID 3880 wrote to memory of 3416 3880 svhost.exe 85 PID 3880 wrote to memory of 3092 3880 svhost.exe 87 PID 3880 wrote to memory of 3092 3880 svhost.exe 87 PID 3092 wrote to memory of 1436 3092 Sever Startup.exe 88 PID 3092 wrote to memory of 1436 3092 Sever Startup.exe 88 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3416
-
-
C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe"C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1436
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5c80f9809068b2d6af93f3f30d8e5bd6d
SHA1c1f5e71198cfcc328acf4c2b62d7782f15ebe55c
SHA256ded57e1b9960e3bb53db62cfc1539d91179a6eb2b1d16e8eca2e6903205caeed
SHA51210bfa7c1398822252a094890a1d6b6c27d0c80a36614fb7e2d258337e697732424a47541e2f2007d01eff91a5b4c3b39f7677d03232706b307f9fad1aa24ed9c