Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2025 22:18
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
4f64eac42f35da5bc722e9a490ed9634
-
SHA1
4367e4fc0003764d72152f2beb15c57f7d584143
-
SHA256
13db2b7d1a27240835fa508fedcfce9ec31f70f9c602260ac028d40c3185b6aa
-
SHA512
3e27569395107a0f84be223c5366ab0804ad3a096d84267549134957194d28a9fa358e1f149abd0d70617813ac1ea1d6a8d8c986808ca7c2d00cdac24292eeaf
-
SSDEEP
49152:Dv3I22SsaNYfdPBldt698dBcjHkW4w9HarHhoGdSGTHHB72eh2NT:Dv422SsaNYfdPBldt6+dBcjHt9+
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
first
C2
ZyloX-37288.portmap.host:37288
Mutex
44382739-6e8e-4a03-b838-6ed9f8f4bf36
Attributes
-
encryption_key
59DD70006F5E5424ACBA442199524AA9815F439E
-
install_name
Calculator.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
RtkAudUService86
-
subdirectory
Calculator_UWP
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/816-1-0x0000000000270000-0x0000000000594000-memory.dmp family_quasar behavioral1/files/0x0007000000023cb6-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 1360 Calculator.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4588 schtasks.exe 3604 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4100 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 816 Client-built.exe Token: SeDebugPrivilege 1360 Calculator.exe Token: SeDebugPrivilege 4100 taskmgr.exe Token: SeSystemProfilePrivilege 4100 taskmgr.exe Token: SeCreateGlobalPrivilege 4100 taskmgr.exe Token: SeDebugPrivilege 1676 Client-built.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1360 Calculator.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1360 Calculator.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe 4100 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 816 wrote to memory of 4588 816 Client-built.exe 82 PID 816 wrote to memory of 4588 816 Client-built.exe 82 PID 816 wrote to memory of 1360 816 Client-built.exe 84 PID 816 wrote to memory of 1360 816 Client-built.exe 84 PID 1360 wrote to memory of 3604 1360 Calculator.exe 85 PID 1360 wrote to memory of 3604 1360 Calculator.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RtkAudUService86" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Calculator_UWP\Calculator.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4588
-
-
C:\Users\Admin\AppData\Roaming\Calculator_UWP\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator_UWP\Calculator.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RtkAudUService86" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Calculator_UWP\Calculator.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3604
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4100
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
3.1MB
MD54f64eac42f35da5bc722e9a490ed9634
SHA14367e4fc0003764d72152f2beb15c57f7d584143
SHA25613db2b7d1a27240835fa508fedcfce9ec31f70f9c602260ac028d40c3185b6aa
SHA5123e27569395107a0f84be223c5366ab0804ad3a096d84267549134957194d28a9fa358e1f149abd0d70617813ac1ea1d6a8d8c986808ca7c2d00cdac24292eeaf