Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 13:54
Behavioral task
behavioral1
Sample
781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553.exe
Resource
win10v2004-20241007-en
General
-
Target
781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553.exe
-
Size
3.1MB
-
MD5
7b168e023b1876cd9163d58f98f3b67c
-
SHA1
906a5cfacd3797c603f3efe863aaedeabacb5918
-
SHA256
781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553
-
SHA512
bed18054e9fce2cdc185e4536386d042f20d98c9354e1603bb87b8747403e63bdbabfb88e72708dcdfb3468860655dcb34b237024d3395782c092dd772fec518
-
SSDEEP
49152:avkt62XlaSFNWPjljiFa2RoUYIlBRJ63bR3LoGdGFTHHB72eh2NT:av462XlaSFNWPjljiFXRoUYIlBRJ6J
Malware Config
Extracted
quasar
1.4.1
RunTimeBroker
98.51.190.130:20
11bbf22e-826e-486b-b024-adbd86228a9e
-
encryption_key
7A589EDBC6A581E125BF830EF0D05FC74BB75E30
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
ctfmon
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/2104-1-0x0000000000E80000-0x00000000011A4000-memory.dmp family_quasar behavioral1/files/0x0008000000015d59-7.dat family_quasar behavioral1/memory/2288-10-0x00000000009D0000-0x0000000000CF4000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2288 Client.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2016 schtasks.exe 2384 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2104 781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553.exe Token: SeDebugPrivilege 2288 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2288 Client.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2384 2104 781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553.exe 30 PID 2104 wrote to memory of 2384 2104 781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553.exe 30 PID 2104 wrote to memory of 2384 2104 781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553.exe 30 PID 2104 wrote to memory of 2288 2104 781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553.exe 32 PID 2104 wrote to memory of 2288 2104 781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553.exe 32 PID 2104 wrote to memory of 2288 2104 781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553.exe 32 PID 2288 wrote to memory of 2016 2288 Client.exe 33 PID 2288 wrote to memory of 2016 2288 Client.exe 33 PID 2288 wrote to memory of 2016 2288 Client.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553.exe"C:\Users\Admin\AppData\Local\Temp\781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2384
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2016
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD57b168e023b1876cd9163d58f98f3b67c
SHA1906a5cfacd3797c603f3efe863aaedeabacb5918
SHA256781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553
SHA512bed18054e9fce2cdc185e4536386d042f20d98c9354e1603bb87b8747403e63bdbabfb88e72708dcdfb3468860655dcb34b237024d3395782c092dd772fec518