Analysis
-
max time kernel
126s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 15:31
Behavioral task
behavioral1
Sample
87b488fc8f9760bc9182c32ef76be93c.exe
Resource
win7-20240903-en
General
-
Target
87b488fc8f9760bc9182c32ef76be93c.exe
-
Size
3.1MB
-
MD5
87b488fc8f9760bc9182c32ef76be93c
-
SHA1
16c3c1c53963cfedb800515b70e27ca2b7dd79fd
-
SHA256
457e291dc62946ab2dc1cb558ffca2e90e5ebbd4a27013c5a23930339aedb978
-
SHA512
30397f8eaf6444502e7e69463463c759711030b0b0ce6812f64f48dee7be6d4ba212045544396ef9e603248bb71a5e4a312eb70a6e7b541161a18301003d089c
-
SSDEEP
49152:evQI22SsaNYfdPBldt698dBcjHaLA3qarWboGdmhIOTHHB72eh2NT:evt22SsaNYfdPBldt6+dBcjHN3c
Malware Config
Extracted
quasar
1.4.1
Office04
43.138.147.74:4782
4b095ece-017a-46f8-874b-d1266394fa10
-
encryption_key
AB08BB6743A540F991F118F0E7BF74E3D06D95A1
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/1948-1-0x0000000000920000-0x0000000000C44000-memory.dmp family_quasar behavioral2/files/0x0007000000023cb1-5.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2712 Client.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\SubDir\Client.exe 87b488fc8f9760bc9182c32ef76be93c.exe File opened for modification C:\Windows\system32\SubDir\Client.exe 87b488fc8f9760bc9182c32ef76be93c.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4928 schtasks.exe 5008 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1948 87b488fc8f9760bc9182c32ef76be93c.exe Token: SeDebugPrivilege 2712 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2712 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1948 wrote to memory of 5008 1948 87b488fc8f9760bc9182c32ef76be93c.exe 82 PID 1948 wrote to memory of 5008 1948 87b488fc8f9760bc9182c32ef76be93c.exe 82 PID 1948 wrote to memory of 2712 1948 87b488fc8f9760bc9182c32ef76be93c.exe 84 PID 1948 wrote to memory of 2712 1948 87b488fc8f9760bc9182c32ef76be93c.exe 84 PID 2712 wrote to memory of 4928 2712 Client.exe 85 PID 2712 wrote to memory of 4928 2712 Client.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\87b488fc8f9760bc9182c32ef76be93c.exe"C:\Users\Admin\AppData\Local\Temp\87b488fc8f9760bc9182c32ef76be93c.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5008
-
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4928
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD587b488fc8f9760bc9182c32ef76be93c
SHA116c3c1c53963cfedb800515b70e27ca2b7dd79fd
SHA256457e291dc62946ab2dc1cb558ffca2e90e5ebbd4a27013c5a23930339aedb978
SHA51230397f8eaf6444502e7e69463463c759711030b0b0ce6812f64f48dee7be6d4ba212045544396ef9e603248bb71a5e4a312eb70a6e7b541161a18301003d089c