Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 09:23
Static task
static1
Behavioral task
behavioral1
Sample
x.ps1
Resource
win7-20240708-en
General
-
Target
x.ps1
-
Size
2.0MB
-
MD5
97646b99bb7245a7be3bbe8a0ff06348
-
SHA1
33edac8a75cac4a0a1d084174b3dc912b9744386
-
SHA256
3496b253962f9fad33450751e615e676ad8f847d11c50df45a35647b2534755d
-
SHA512
066b635e03bf515f75327388d7118560fbf84fe4d5b64740c3b5a101123650ccb9d9252597301b78bf3a4849a57d73bd3f12192531e856fc6fbbce4b66571b2b
-
SSDEEP
24576:bSgmuyXfET5YN3b2LLG1z/7E4/KpdMJczdsrbI8:biMSNKLq1zjA2
Malware Config
Extracted
quasar
1.3.0.0
MuGz
feature-ssa.mywire.org:1177
QSR_MUTEX_nCFXZUEaa8h2uJHNCI
-
encryption_key
1aBF7porNDMtf63sHjM2
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/3116-33-0x0000000000400000-0x000000000041A000-memory.dmp family_quasar -
Executes dropped EXE 2 IoCs
pid Process 3652 AutoHotkey64.exe 4772 AutoHotkey64.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
Suspicious use of SetThreadContext 10 IoCs
description pid Process procid_target PID 3652 set thread context of 5076 3652 AutoHotkey64.exe 85 PID 3652 set thread context of 3304 3652 AutoHotkey64.exe 86 PID 3652 set thread context of 3368 3652 AutoHotkey64.exe 87 PID 3652 set thread context of 3116 3652 AutoHotkey64.exe 88 PID 3652 set thread context of 1108 3652 AutoHotkey64.exe 89 PID 4772 set thread context of 4244 4772 AutoHotkey64.exe 100 PID 4772 set thread context of 1248 4772 AutoHotkey64.exe 101 PID 4772 set thread context of 1624 4772 AutoHotkey64.exe 102 PID 4772 set thread context of 4972 4772 AutoHotkey64.exe 103 PID 4772 set thread context of 4396 4772 AutoHotkey64.exe 104 -
pid Process 3980 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3460 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3980 powershell.exe 3980 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3980 powershell.exe Token: SeDebugPrivilege 3304 AddInProcess32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3652 AutoHotkey64.exe 3652 AutoHotkey64.exe 4772 AutoHotkey64.exe 4772 AutoHotkey64.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 3652 AutoHotkey64.exe 3652 AutoHotkey64.exe 4772 AutoHotkey64.exe 4772 AutoHotkey64.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3304 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3980 wrote to memory of 3652 3980 powershell.exe 83 PID 3980 wrote to memory of 3652 3980 powershell.exe 83 PID 3980 wrote to memory of 3460 3980 powershell.exe 84 PID 3980 wrote to memory of 3460 3980 powershell.exe 84 PID 3652 wrote to memory of 5076 3652 AutoHotkey64.exe 85 PID 3652 wrote to memory of 5076 3652 AutoHotkey64.exe 85 PID 3652 wrote to memory of 5076 3652 AutoHotkey64.exe 85 PID 3652 wrote to memory of 5076 3652 AutoHotkey64.exe 85 PID 3652 wrote to memory of 5076 3652 AutoHotkey64.exe 85 PID 3652 wrote to memory of 5076 3652 AutoHotkey64.exe 85 PID 3652 wrote to memory of 5076 3652 AutoHotkey64.exe 85 PID 3652 wrote to memory of 5076 3652 AutoHotkey64.exe 85 PID 3652 wrote to memory of 3304 3652 AutoHotkey64.exe 86 PID 3652 wrote to memory of 3304 3652 AutoHotkey64.exe 86 PID 3652 wrote to memory of 3304 3652 AutoHotkey64.exe 86 PID 3652 wrote to memory of 3304 3652 AutoHotkey64.exe 86 PID 3652 wrote to memory of 3304 3652 AutoHotkey64.exe 86 PID 3652 wrote to memory of 3304 3652 AutoHotkey64.exe 86 PID 3652 wrote to memory of 3304 3652 AutoHotkey64.exe 86 PID 3652 wrote to memory of 3304 3652 AutoHotkey64.exe 86 PID 3652 wrote to memory of 3368 3652 AutoHotkey64.exe 87 PID 3652 wrote to memory of 3368 3652 AutoHotkey64.exe 87 PID 3652 wrote to memory of 3368 3652 AutoHotkey64.exe 87 PID 3652 wrote to memory of 3368 3652 AutoHotkey64.exe 87 PID 3652 wrote to memory of 3368 3652 AutoHotkey64.exe 87 PID 3652 wrote to memory of 3368 3652 AutoHotkey64.exe 87 PID 3652 wrote to memory of 3368 3652 AutoHotkey64.exe 87 PID 3652 wrote to memory of 3368 3652 AutoHotkey64.exe 87 PID 3652 wrote to memory of 3116 3652 AutoHotkey64.exe 88 PID 3652 wrote to memory of 3116 3652 AutoHotkey64.exe 88 PID 3652 wrote to memory of 3116 3652 AutoHotkey64.exe 88 PID 3652 wrote to memory of 3116 3652 AutoHotkey64.exe 88 PID 3652 wrote to memory of 3116 3652 AutoHotkey64.exe 88 PID 3652 wrote to memory of 3116 3652 AutoHotkey64.exe 88 PID 3652 wrote to memory of 3116 3652 AutoHotkey64.exe 88 PID 3652 wrote to memory of 3116 3652 AutoHotkey64.exe 88 PID 3652 wrote to memory of 1108 3652 AutoHotkey64.exe 89 PID 3652 wrote to memory of 1108 3652 AutoHotkey64.exe 89 PID 3652 wrote to memory of 1108 3652 AutoHotkey64.exe 89 PID 3652 wrote to memory of 1108 3652 AutoHotkey64.exe 89 PID 3652 wrote to memory of 1108 3652 AutoHotkey64.exe 89 PID 3652 wrote to memory of 1108 3652 AutoHotkey64.exe 89 PID 3652 wrote to memory of 1108 3652 AutoHotkey64.exe 89 PID 3652 wrote to memory of 1108 3652 AutoHotkey64.exe 89 PID 4772 wrote to memory of 4244 4772 AutoHotkey64.exe 100 PID 4772 wrote to memory of 4244 4772 AutoHotkey64.exe 100 PID 4772 wrote to memory of 4244 4772 AutoHotkey64.exe 100 PID 4772 wrote to memory of 4244 4772 AutoHotkey64.exe 100 PID 4772 wrote to memory of 4244 4772 AutoHotkey64.exe 100 PID 4772 wrote to memory of 4244 4772 AutoHotkey64.exe 100 PID 4772 wrote to memory of 4244 4772 AutoHotkey64.exe 100 PID 4772 wrote to memory of 4244 4772 AutoHotkey64.exe 100 PID 4772 wrote to memory of 1248 4772 AutoHotkey64.exe 101 PID 4772 wrote to memory of 1248 4772 AutoHotkey64.exe 101 PID 4772 wrote to memory of 1248 4772 AutoHotkey64.exe 101 PID 4772 wrote to memory of 1248 4772 AutoHotkey64.exe 101 PID 4772 wrote to memory of 1248 4772 AutoHotkey64.exe 101 PID 4772 wrote to memory of 1248 4772 AutoHotkey64.exe 101 PID 4772 wrote to memory of 1248 4772 AutoHotkey64.exe 101 PID 4772 wrote to memory of 1248 4772 AutoHotkey64.exe 101 PID 4772 wrote to memory of 1624 4772 AutoHotkey64.exe 102 PID 4772 wrote to memory of 1624 4772 AutoHotkey64.exe 102 PID 4772 wrote to memory of 1624 4772 AutoHotkey64.exe 102 PID 4772 wrote to memory of 1624 4772 AutoHotkey64.exe 102 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\x.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Public\Documents\AutoHotkey64.exe"C:\Users\Public\Documents\AutoHotkey64.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
PID:5076
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3304
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3368
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3116
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1108
-
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 09:25 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3460
-
-
C:\Users\Public\Documents\AutoHotkey64.exeC:\Users\Public\Documents\AutoHotkey64.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4244
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1248
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1624
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4972
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
609B
MD5f78129c2d7c98a4397fa4931b11feef4
SHA1ea26f38d12515741651ff161ea8393d5fa41a5bd
SHA25629830390784d06271342237443b6224bb98be0539e34b64e7344c78d7cdd93d9
SHA512cbca1d486c2bd7655752930b9020ccf3f8ae67a67dcb2cca51c31763a51fea8fb951d617c31a3746680303a8c6d45361c120f15ef06c30b417202949728b5b35
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
335KB
MD59b901a1386e04b0b0e5cc79a145c0e61
SHA153555bc6be482b80dce9bb175474abf48b72bd40
SHA25617409213d1370b4b30c07cd73b33ec7ee7ceb78245082654831bcd35b555b290
SHA5128572814fb3b14fb3adf2f36263c13d7a38603e53754bdba78ae16fa908a921c8c36f110a45778a76152c0698f545538454a5eef2fb2daca3146985b35b43ec36
-
Filesize
6KB
MD5a51d3cc02396652ac39de494e7d725d6
SHA1e4659a4561ac38659f7786f78485086aa1573036
SHA256d2fb28bbafa9b105bed3334225778451529cbb2f847594021cccfab7f7d69c5d
SHA512a4d2d3ca7d4d7ca7dcdcd8f7a46004ade1cff22f335b488972070d83602fb30d0b684fda4cd2677ccefb7afdabceb1d642152759b2f6c1796f3011dad272dda8
-
Filesize
1.3MB
MD52d0600fe2b1b3bdc45d833ca32a37fdb
SHA1e9a7411bfef54050de3b485833556f84cabd6e41
SHA256effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696
SHA5129891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703