Analysis
-
max time kernel
20s -
max time network
30s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
22-12-2024 17:45
Static task
static1
General
-
Target
Aimbot MTA.zip
-
Size
1.1MB
-
MD5
daa57cdeeab30823f89e5349b832a817
-
SHA1
feb679856d7a4a04d5e1a26e741dd6deb5ee0e88
-
SHA256
129c9712c6553669392a034fc14842a4045df98bb8abce95a6b74ecf9760a4de
-
SHA512
1403f94c54374a91e8d9e29b594b490ff49c16b4bd404148157e7b2a7eb57beced3459e612045433e3b4a0f78aca93d34fe2f4c198fc5669dee85c139273f376
-
SSDEEP
24576:3bPC4RI32t9KyRPCKNJrYjWj1JkpsnWvWjI7mBPJiOMSeFAPNuHWE:rKsIm3K8voCApsnBnFJirjSU2E
Malware Config
Extracted
quasar
1.4.1
Office04
azxq0ap.localto.net:3425
e51e2b65-e963-4051-9736-67d57ed46798
-
encryption_key
AEA258EF65BF1786F0F767C0BE2497ECC304C46F
-
install_name
WindowsUpdate.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
WindowsUpdate
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/files/0x002800000004607f-2.dat family_quasar behavioral1/memory/1052-5-0x0000000000010000-0x0000000000366000-memory.dmp family_quasar -
Executes dropped EXE 2 IoCs
pid Process 1052 Aimbot MTA.exe 4696 WindowsUpdate.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1184 schtasks.exe 4944 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeRestorePrivilege 4836 7zFM.exe Token: 35 4836 7zFM.exe Token: SeSecurityPrivilege 4836 7zFM.exe Token: SeDebugPrivilege 1052 Aimbot MTA.exe Token: SeDebugPrivilege 4696 WindowsUpdate.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4836 7zFM.exe 4836 7zFM.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4696 WindowsUpdate.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1052 wrote to memory of 1184 1052 Aimbot MTA.exe 91 PID 1052 wrote to memory of 1184 1052 Aimbot MTA.exe 91 PID 1052 wrote to memory of 4696 1052 Aimbot MTA.exe 93 PID 1052 wrote to memory of 4696 1052 Aimbot MTA.exe 93 PID 4696 wrote to memory of 4944 4696 WindowsUpdate.exe 94 PID 4696 wrote to memory of 4944 4696 WindowsUpdate.exe 94 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Aimbot MTA.zip"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4836
-
C:\Users\Admin\Desktop\Aimbot MTA.exe"C:\Users\Admin\Desktop\Aimbot MTA.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1184
-
-
C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4944
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD5232fbce8fc20397039e7115d6736c5f4
SHA1ec3f9e41474a0e2597c5aec4be25158ccd2d4c68
SHA256f9a036faaf0d8069cad71070e3327f2b6318e7026338c32eb46dc23c18ab1291
SHA512b00d44a3fc0685b917a50008d66efd44c697692a7f02b2bc18f3c325642a8bb94d5966bd66d21fa045aa24d02a88600b3b66122e3a3f6309b3854f6820bc41de