Analysis
-
max time kernel
92s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 03:34
Static task
static1
Behavioral task
behavioral1
Sample
UrMine2.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
UrMine2.exe
Resource
win10v2004-20241007-en
General
-
Target
UrMine2.exe
-
Size
3.2MB
-
MD5
7b9480d4a112833514e7bb79434ac910
-
SHA1
9050db3991eaa8a2ab8d0485877f54e096660036
-
SHA256
38fdd127d155587e46643e9ce269951ab8f3c41563437613dc5709aeadfceb32
-
SHA512
125e94039981aa6072a352dddcc531f58cdc3d9db9bb0557c3ba1561fcd40b7d0fea76b06701ec7e53248c4c0e6ac607c7d8e71dfde0a0221abff9eaa006b693
-
SSDEEP
98304:ZtiwNlunVqirIBmG9Li2JWrV2yM0SlNevauUaO/tCI:Zt9unlrIBT9LVJoV2yM0SlNevwC
Malware Config
Extracted
quasar
1.4.1
Axotrojan
eu-central-7075.packetriot.net:22342
167.71.56.116:22342
34892381-1dda-4b06-87a2-3e413b932ac8
-
encryption_key
4B13DC71783277444E966E1D66F9171ABFC15E88
-
install_name
Clientformyslut.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Axo startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/files/0x0017000000023c49-12.dat family_quasar behavioral2/memory/3556-24-0x00000000001B0000-0x00000000004D4000-memory.dmp family_quasar -
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 1708 netsh.exe 3664 netsh.exe 3488 netsh.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation UrMine2.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation pkriot3.exe -
Drops startup file 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24983f03fb74576bbc5af6aa1085b23dWindows Update.exe server.exe -
Executes dropped EXE 4 IoCs
pid Process 992 pkriot3.exe 3556 pkriot1.exe 2228 Clientformyslut.exe 2148 server.exe -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\SubDir\Clientformyslut.exe pkriot1.exe File opened for modification C:\Windows\system32\SubDir\Clientformyslut.exe pkriot1.exe File created C:\Windows\SysWOW64\Explower.exe server.exe File opened for modification C:\Windows\SysWOW64\Explower.exe server.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Explower.exe server.exe File opened for modification C:\Program Files (x86)\Explower.exe server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UrMine2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pkriot3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1220 schtasks.exe 3400 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4372 powershell.exe 4372 powershell.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe 2148 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2148 server.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 3556 pkriot1.exe Token: SeDebugPrivilege 4372 powershell.exe Token: SeDebugPrivilege 2228 Clientformyslut.exe Token: SeDebugPrivilege 2148 server.exe Token: 33 2148 server.exe Token: SeIncBasePriorityPrivilege 2148 server.exe Token: 33 2148 server.exe Token: SeIncBasePriorityPrivilege 2148 server.exe Token: 33 2148 server.exe Token: SeIncBasePriorityPrivilege 2148 server.exe Token: 33 2148 server.exe Token: SeIncBasePriorityPrivilege 2148 server.exe Token: 33 2148 server.exe Token: SeIncBasePriorityPrivilege 2148 server.exe Token: SeDebugPrivilege 404 taskmgr.exe Token: SeSystemProfilePrivilege 404 taskmgr.exe Token: SeCreateGlobalPrivilege 404 taskmgr.exe Token: 33 2148 server.exe Token: SeIncBasePriorityPrivilege 2148 server.exe Token: 33 2148 server.exe Token: SeIncBasePriorityPrivilege 2148 server.exe Token: 33 404 taskmgr.exe Token: SeIncBasePriorityPrivilege 404 taskmgr.exe Token: 33 2148 server.exe Token: SeIncBasePriorityPrivilege 2148 server.exe Token: 33 2148 server.exe Token: SeIncBasePriorityPrivilege 2148 server.exe Token: 33 2148 server.exe Token: SeIncBasePriorityPrivilege 2148 server.exe Token: 33 2148 server.exe Token: SeIncBasePriorityPrivilege 2148 server.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe -
Suspicious use of SendNotifyMessage 44 IoCs
pid Process 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe 404 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2228 Clientformyslut.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1388 wrote to memory of 4372 1388 UrMine2.exe 83 PID 1388 wrote to memory of 4372 1388 UrMine2.exe 83 PID 1388 wrote to memory of 4372 1388 UrMine2.exe 83 PID 1388 wrote to memory of 992 1388 UrMine2.exe 85 PID 1388 wrote to memory of 992 1388 UrMine2.exe 85 PID 1388 wrote to memory of 992 1388 UrMine2.exe 85 PID 1388 wrote to memory of 3556 1388 UrMine2.exe 86 PID 1388 wrote to memory of 3556 1388 UrMine2.exe 86 PID 3556 wrote to memory of 1220 3556 pkriot1.exe 87 PID 3556 wrote to memory of 1220 3556 pkriot1.exe 87 PID 3556 wrote to memory of 2228 3556 pkriot1.exe 89 PID 3556 wrote to memory of 2228 3556 pkriot1.exe 89 PID 992 wrote to memory of 2148 992 pkriot3.exe 90 PID 992 wrote to memory of 2148 992 pkriot3.exe 90 PID 992 wrote to memory of 2148 992 pkriot3.exe 90 PID 2228 wrote to memory of 3400 2228 Clientformyslut.exe 91 PID 2228 wrote to memory of 3400 2228 Clientformyslut.exe 91 PID 2148 wrote to memory of 1708 2148 server.exe 93 PID 2148 wrote to memory of 1708 2148 server.exe 93 PID 2148 wrote to memory of 1708 2148 server.exe 93 PID 2148 wrote to memory of 3664 2148 server.exe 95 PID 2148 wrote to memory of 3664 2148 server.exe 95 PID 2148 wrote to memory of 3664 2148 server.exe 95 PID 2148 wrote to memory of 3488 2148 server.exe 96 PID 2148 wrote to memory of 3488 2148 server.exe 96 PID 2148 wrote to memory of 3488 2148 server.exe 96 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\UrMine2.exe"C:\Users\Admin\AppData\Local\Temp\UrMine2.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AdgBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG0AcABiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGIAcQB1ACMAPgA="2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372
-
-
C:\Users\Admin\AppData\Local\Temp\pkriot3.exe"C:\Users\Admin\AppData\Local\Temp\pkriot3.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1708
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3664
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3488
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\pkriot1.exe"C:\Users\Admin\AppData\Local\Temp\pkriot1.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Axo startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Clientformyslut.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1220
-
-
C:\Windows\system32\SubDir\Clientformyslut.exe"C:\Windows\system32\SubDir\Clientformyslut.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Axo startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Clientformyslut.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
PID:3400
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:404
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3036
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Obfuscated Files or Information
1Command Obfuscation
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.1MB
MD59a3043abedc95a0a1c5d4fdb50e62d34
SHA12f432259c81f112905e24016191a1186e4fbdc88
SHA25618df830ce713c45edf04f76b23da7e5f1c57bcacd26b075ed94904da6bf94f74
SHA512fb7f692b1b035d732a175b40760baacc6f7ccfa88ca26da0f74eda2fb542a9e10c47c1309b60caf7169cb7a9035e8e2083ed5e5c2bc4292c9ef5e1c85ecf7c1c
-
Filesize
93KB
MD555e2016fcb659bdf0f46a24ef2876609
SHA15afb69f26ddf1884372643a2b00d16a481fc7c26
SHA2563825fe6fd9e8754b3d4a374b8c73884647c6898d5e1220a0fe89b1a3dc8e35c4
SHA5124de0fb035b904bd2557d48aacfea53346748e0dbda86b710ee86796c374c37fd35e50f4d8b05cd1c058f95665894629f8848f4bce45378c00ced771baaea3e46
-
Filesize
5B
MD5c2844bc9e1bd64168a727b0680ae4d90
SHA17bb263540de557f5a4e09c6c78b7dbb314a0df9a
SHA2569c9701ab918368b615fc6a0dbeb5efa286a232d751982ae70b48ad6914bf01e5
SHA512360953bb20d91539022fcb1becf4638970c4452816797a8dca65e3ae4a542302e6e89f0828087caaa63a0750aa78605f8034da7c8663fa4fc677c8f3e53655ed