Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 19:06
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240903-en
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
4a0c6269f041778479be25c053014de1
-
SHA1
7474c9d50ab9e48e165df40cfb5d45873429c1b3
-
SHA256
f0b341cff383ba4f0143639eb0515fbdc023b8c98815a4f72191114ab75799b6
-
SHA512
24f9125960573e4a99c9407d6e7d543918c921bff1caabd7c394132eaea370c89b242735089af064639b4ccc070a6844b35785ef6be0db9d817ad26b55a1c65a
-
SSDEEP
49152:Kvjt62XlaSFNWPjljiFa2RoUYIgxDEDwCk/JxJoGdSTHHB72eh2NT:Kvx62XlaSFNWPjljiFXRoUYIgx3v
Malware Config
Extracted
quasar
1.4.1
Office04
x5sql-62870.portmap.host:62870
42098932-ec6f-4d72-ab22-06528c985236
-
encryption_key
3300C61943A333F53FD91D0A93268174467B5322
-
install_name
ntodsk.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Microsoft
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/1224-1-0x00000000004E0000-0x0000000000804000-memory.dmp family_quasar behavioral2/files/0x0007000000023cb6-7.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 1128 ntodsk.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\SubDir\ntodsk.exe Client-built.exe File opened for modification C:\Windows\system32\SubDir\ntodsk.exe Client-built.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1224 Client-built.exe Token: SeDebugPrivilege 1128 ntodsk.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1128 ntodsk.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1224 wrote to memory of 1128 1224 Client-built.exe 83 PID 1224 wrote to memory of 1128 1224 Client-built.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\system32\SubDir\ntodsk.exe"C:\Windows\system32\SubDir\ntodsk.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1128
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD54a0c6269f041778479be25c053014de1
SHA17474c9d50ab9e48e165df40cfb5d45873429c1b3
SHA256f0b341cff383ba4f0143639eb0515fbdc023b8c98815a4f72191114ab75799b6
SHA51224f9125960573e4a99c9407d6e7d543918c921bff1caabd7c394132eaea370c89b242735089af064639b4ccc070a6844b35785ef6be0db9d817ad26b55a1c65a