Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2025 22:16
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
bedf425c4a05bbe1630911df57e7df6a
-
SHA1
4a9a36f51659ae39c9df7a43f509eccc948395b3
-
SHA256
acc6975d71b6a5d2c58b54133f607cf3ecae828b2c92dde00870e48bf95b50ae
-
SHA512
aa95f53cc3f4a1ecfec8a5ffc9763279768cb4f45109d583549dc2aa3caf63ed37811f97e5c70954aec31cdf199974860f60dc42421ba0160711b63b229eb814
-
SSDEEP
49152:bv3I22SsaNYfdPBldt698dBcjHQ0W+sizoGdK0THHB72eh2NT:bv422SsaNYfdPBldt6+dBcjHTW+s26
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
first
C2
ZyloX-37288.portmap.host:4782
Mutex
44382739-6e8e-4a03-b838-6ed9f8f4bf36
Attributes
-
encryption_key
59DD70006F5E5424ACBA442199524AA9815F439E
-
install_name
Calculator.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
RtkAudUService86
-
subdirectory
Calculator_UWP
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/4036-1-0x0000000000290000-0x00000000005B4000-memory.dmp family_quasar behavioral1/files/0x0008000000023c02-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2724 Calculator.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1644 schtasks.exe 3144 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4048 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4036 Client-built.exe Token: SeDebugPrivilege 2724 Calculator.exe Token: SeDebugPrivilege 4048 taskmgr.exe Token: SeSystemProfilePrivilege 4048 taskmgr.exe Token: SeCreateGlobalPrivilege 4048 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2724 Calculator.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2724 Calculator.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe 4048 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4036 wrote to memory of 1644 4036 Client-built.exe 82 PID 4036 wrote to memory of 1644 4036 Client-built.exe 82 PID 4036 wrote to memory of 2724 4036 Client-built.exe 84 PID 4036 wrote to memory of 2724 4036 Client-built.exe 84 PID 2724 wrote to memory of 3144 2724 Calculator.exe 85 PID 2724 wrote to memory of 3144 2724 Calculator.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RtkAudUService86" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Calculator_UWP\Calculator.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1644
-
-
C:\Users\Admin\AppData\Roaming\Calculator_UWP\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator_UWP\Calculator.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RtkAudUService86" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Calculator_UWP\Calculator.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3144
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5bedf425c4a05bbe1630911df57e7df6a
SHA14a9a36f51659ae39c9df7a43f509eccc948395b3
SHA256acc6975d71b6a5d2c58b54133f607cf3ecae828b2c92dde00870e48bf95b50ae
SHA512aa95f53cc3f4a1ecfec8a5ffc9763279768cb4f45109d583549dc2aa3caf63ed37811f97e5c70954aec31cdf199974860f60dc42421ba0160711b63b229eb814