Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 20:26
Behavioral task
behavioral1
Sample
77244092e7dd606f04a3f38af9050f91e6cd78989526e56440a8fa3f5ece758f.exe
Resource
win7-20240903-en
General
-
Target
77244092e7dd606f04a3f38af9050f91e6cd78989526e56440a8fa3f5ece758f.exe
-
Size
3.1MB
-
MD5
8f5bd87ff24f2310b9c803b764fdae24
-
SHA1
ac5b97def6b237c077c7cbb26a44b813cd40dfbd
-
SHA256
77244092e7dd606f04a3f38af9050f91e6cd78989526e56440a8fa3f5ece758f
-
SHA512
9a216ee4eaef4200ef6264ad5d79a555c2487b8577ff4dce69dd1c37ed00b8ca87f239068c1f36f546faa7b962e9415fc80f8bbe03d1187f87f4fbb1cf9ca22c
-
SSDEEP
49152:Cvkt62XlaSFNWPjljiFa2RoUYIr4mWmzuLoGdNVaTHHB72eh2NT:Cv462XlaSFNWPjljiFXRoUYIr4msd
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.43.241:4782
0d40e7a7-49fe-45a6-9c6d-b8affa11f503
-
encryption_key
6095BF6D5D58D02597F98370DFD1CCEB782F1EDD
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svhost
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2100-1-0x0000000000F30000-0x0000000001254000-memory.dmp family_quasar behavioral1/files/0x000700000001868b-6.dat family_quasar behavioral1/memory/1476-9-0x0000000000DC0000-0x00000000010E4000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 1476 Client.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3056 schtasks.exe 588 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2100 77244092e7dd606f04a3f38af9050f91e6cd78989526e56440a8fa3f5ece758f.exe Token: SeDebugPrivilege 1476 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1476 Client.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2100 wrote to memory of 3056 2100 77244092e7dd606f04a3f38af9050f91e6cd78989526e56440a8fa3f5ece758f.exe 31 PID 2100 wrote to memory of 3056 2100 77244092e7dd606f04a3f38af9050f91e6cd78989526e56440a8fa3f5ece758f.exe 31 PID 2100 wrote to memory of 3056 2100 77244092e7dd606f04a3f38af9050f91e6cd78989526e56440a8fa3f5ece758f.exe 31 PID 2100 wrote to memory of 1476 2100 77244092e7dd606f04a3f38af9050f91e6cd78989526e56440a8fa3f5ece758f.exe 33 PID 2100 wrote to memory of 1476 2100 77244092e7dd606f04a3f38af9050f91e6cd78989526e56440a8fa3f5ece758f.exe 33 PID 2100 wrote to memory of 1476 2100 77244092e7dd606f04a3f38af9050f91e6cd78989526e56440a8fa3f5ece758f.exe 33 PID 1476 wrote to memory of 588 1476 Client.exe 34 PID 1476 wrote to memory of 588 1476 Client.exe 34 PID 1476 wrote to memory of 588 1476 Client.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\77244092e7dd606f04a3f38af9050f91e6cd78989526e56440a8fa3f5ece758f.exe"C:\Users\Admin\AppData\Local\Temp\77244092e7dd606f04a3f38af9050f91e6cd78989526e56440a8fa3f5ece758f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3056
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:588
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD58f5bd87ff24f2310b9c803b764fdae24
SHA1ac5b97def6b237c077c7cbb26a44b813cd40dfbd
SHA25677244092e7dd606f04a3f38af9050f91e6cd78989526e56440a8fa3f5ece758f
SHA5129a216ee4eaef4200ef6264ad5d79a555c2487b8577ff4dce69dd1c37ed00b8ca87f239068c1f36f546faa7b962e9415fc80f8bbe03d1187f87f4fbb1cf9ca22c