Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 19:08
Behavioral task
behavioral1
Sample
hopefully working.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
hopefully working.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
hopefully working.exe
Resource
win11-20241007-en
windows11-21h2-x64
9 signatures
150 seconds
General
-
Target
hopefully working.exe
-
Size
3.1MB
-
MD5
d99ad666c46f6027182170b415628651
-
SHA1
95e57ce111b72ea7b062e3d87165416eb6ee6141
-
SHA256
3d8d2e7e8d205f96165c848b68671b13fc419ae0429a6079999344a925f44d41
-
SHA512
af808083c25b323120bcee39189fc06391a97f54dc11724c33070dfe6bddf32dbd2fef4543a8202eec5d77a7b2d25a76dcb952de48d5c5b81bc0cae8d4bddacc
-
SSDEEP
49152:HvIcfX2hcawDEhPLl8r/ptXpga584hxOEMkak/Jx3oGdq7sfTHHB72eh2NT:HvBv2hcawDEhPLl8r/XXpga584hx99
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
minecraft_updater
C2
98.97.12.133:631
98.97.12.133:41685
98.97.12.133:5353
98.97.12.133:34735
Mutex
182d06ff-972f-4a96-b344-59a01694d374
Attributes
-
encryption_key
C5904FDD788EA00F921C538B9FE80C0B0A0DE728
-
install_name
MinecraftUpdater.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
MinecraftUpdater
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/2404-1-0x0000000000DF0000-0x0000000001114000-memory.dmp family_quasar behavioral2/files/0x000a000000023b8e-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 4048 MinecraftUpdater.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4908 schtasks.exe 2316 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4968 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2404 hopefully working.exe Token: SeDebugPrivilege 4048 MinecraftUpdater.exe Token: SeDebugPrivilege 4968 taskmgr.exe Token: SeSystemProfilePrivilege 4968 taskmgr.exe Token: SeCreateGlobalPrivilege 4968 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe 4968 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4048 MinecraftUpdater.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2404 wrote to memory of 4908 2404 hopefully working.exe 83 PID 2404 wrote to memory of 4908 2404 hopefully working.exe 83 PID 2404 wrote to memory of 4048 2404 hopefully working.exe 85 PID 2404 wrote to memory of 4048 2404 hopefully working.exe 85 PID 4048 wrote to memory of 2316 4048 MinecraftUpdater.exe 86 PID 4048 wrote to memory of 2316 4048 MinecraftUpdater.exe 86 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\hopefully working.exe"C:\Users\Admin\AppData\Local\Temp\hopefully working.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MinecraftUpdater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\MinecraftUpdater.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4908
-
-
C:\Users\Admin\AppData\Roaming\SubDir\MinecraftUpdater.exe"C:\Users\Admin\AppData\Roaming\SubDir\MinecraftUpdater.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MinecraftUpdater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\MinecraftUpdater.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2316
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5d99ad666c46f6027182170b415628651
SHA195e57ce111b72ea7b062e3d87165416eb6ee6141
SHA2563d8d2e7e8d205f96165c848b68671b13fc419ae0429a6079999344a925f44d41
SHA512af808083c25b323120bcee39189fc06391a97f54dc11724c33070dfe6bddf32dbd2fef4543a8202eec5d77a7b2d25a76dcb952de48d5c5b81bc0cae8d4bddacc