Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 19:03
Behavioral task
behavioral1
Sample
clienbt.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
clienbt.exe
Resource
win11-20241007-en
windows11-21h2-x64
9 signatures
150 seconds
General
-
Target
clienbt.exe
-
Size
3.1MB
-
MD5
94f7204cc10fd667deb7368911210228
-
SHA1
93c8e0d5b2194b1ae39537bfd3fe8ebd687c2e23
-
SHA256
dbd77fcf6dbd2f136713cfe6b28d7f79d1f5f9cdbb77b4431d3c1f5ed9a487a2
-
SHA512
1724176ea2e394f829b78db21831481696ee612c4bea3daba4c4e86ddd3e3dc6de1a77a901ed28e416f9869a135bf0f18d705fea650c177cb0160eccf5a4f2d0
-
SSDEEP
49152:nvwhBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkaf7zboGdOTHHB72eh2NT:nvit2d5aKCuVPzlEmVQ0wvwff7H
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
minecraft_updater
C2
192.168.7.110:631
Mutex
182d06ff-972f-4a96-b344-59a01694d374
Attributes
-
encryption_key
C5904FDD788EA00F921C538B9FE80C0B0A0DE728
-
install_name
MinecraftUpdater.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
MinecraftUpdater
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/3108-1-0x0000000000B10000-0x0000000000E34000-memory.dmp family_quasar behavioral1/files/0x000b000000023b90-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2452 MinecraftUpdater.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4456 schtasks.exe 4940 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4052 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3108 clienbt.exe Token: SeDebugPrivilege 2452 MinecraftUpdater.exe Token: SeDebugPrivilege 4052 taskmgr.exe Token: SeSystemProfilePrivilege 4052 taskmgr.exe Token: SeCreateGlobalPrivilege 4052 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2452 MinecraftUpdater.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3108 wrote to memory of 4456 3108 clienbt.exe 83 PID 3108 wrote to memory of 4456 3108 clienbt.exe 83 PID 3108 wrote to memory of 2452 3108 clienbt.exe 85 PID 3108 wrote to memory of 2452 3108 clienbt.exe 85 PID 2452 wrote to memory of 4940 2452 MinecraftUpdater.exe 86 PID 2452 wrote to memory of 4940 2452 MinecraftUpdater.exe 86 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\clienbt.exe"C:\Users\Admin\AppData\Local\Temp\clienbt.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MinecraftUpdater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\MinecraftUpdater.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4456
-
-
C:\Users\Admin\AppData\Roaming\SubDir\MinecraftUpdater.exe"C:\Users\Admin\AppData\Roaming\SubDir\MinecraftUpdater.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MinecraftUpdater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\MinecraftUpdater.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4940
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD594f7204cc10fd667deb7368911210228
SHA193c8e0d5b2194b1ae39537bfd3fe8ebd687c2e23
SHA256dbd77fcf6dbd2f136713cfe6b28d7f79d1f5f9cdbb77b4431d3c1f5ed9a487a2
SHA5121724176ea2e394f829b78db21831481696ee612c4bea3daba4c4e86ddd3e3dc6de1a77a901ed28e416f9869a135bf0f18d705fea650c177cb0160eccf5a4f2d0