Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-12-2024 08:10
Behavioral task
behavioral1
Sample
LicenciaXHXX.exe
Resource
win7-20240903-en
General
-
Target
LicenciaXHXX.exe
-
Size
3.1MB
-
MD5
16656861d60be66d91ef29c455276669
-
SHA1
8d21d8e02398f67be2abd30d6162b9c990c9da44
-
SHA256
5e66f2e25b980485b49cbaaccf16eb6b39495e356eea2d4a9e51c3a81ca15f4b
-
SHA512
0bd5138730a6cc7fbc56271d9364ef3104c24b5442b7549b59b3ea662e918897ab79e510eb764315c0cec7e576250391ae43cc9754c6199bcef379ddb60a389a
-
SSDEEP
49152:6vSI22SsaNYfdPBldt698dBcjHr6+n8yhLoGdb8+THHB72eh2NT:6v/22SsaNYfdPBldt6+dBcjHr6+Lr8
Malware Config
Extracted
quasar
1.4.1
Office04
azxq0ap.localto.net:3425
e51e2b65-e963-4051-9736-67d57ed46798
-
encryption_key
AEA258EF65BF1786F0F767C0BE2497ECC304C46F
-
install_name
WindowsUpdate.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
WindowsUpdate
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/memory/1732-1-0x0000000001080000-0x00000000013A6000-memory.dmp family_quasar behavioral1/files/0x000a000000015d79-6.dat family_quasar behavioral1/memory/2240-9-0x0000000001060000-0x0000000001386000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2240 WindowsUpdate.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1524 schtasks.exe 2268 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1732 LicenciaXHXX.exe Token: SeDebugPrivilege 2240 WindowsUpdate.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2240 WindowsUpdate.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1524 1732 LicenciaXHXX.exe 30 PID 1732 wrote to memory of 1524 1732 LicenciaXHXX.exe 30 PID 1732 wrote to memory of 1524 1732 LicenciaXHXX.exe 30 PID 1732 wrote to memory of 2240 1732 LicenciaXHXX.exe 32 PID 1732 wrote to memory of 2240 1732 LicenciaXHXX.exe 32 PID 1732 wrote to memory of 2240 1732 LicenciaXHXX.exe 32 PID 2240 wrote to memory of 2268 2240 WindowsUpdate.exe 33 PID 2240 wrote to memory of 2268 2240 WindowsUpdate.exe 33 PID 2240 wrote to memory of 2268 2240 WindowsUpdate.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\LicenciaXHXX.exe"C:\Users\Admin\AppData\Local\Temp\LicenciaXHXX.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1524
-
-
C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2268
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD516656861d60be66d91ef29c455276669
SHA18d21d8e02398f67be2abd30d6162b9c990c9da44
SHA2565e66f2e25b980485b49cbaaccf16eb6b39495e356eea2d4a9e51c3a81ca15f4b
SHA5120bd5138730a6cc7fbc56271d9364ef3104c24b5442b7549b59b3ea662e918897ab79e510eb764315c0cec7e576250391ae43cc9754c6199bcef379ddb60a389a