Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05-01-2025 15:02
Behavioral task
behavioral1
Sample
Cleaner.exe
Resource
win7-20241023-en
General
-
Target
Cleaner.exe
-
Size
3.1MB
-
MD5
f1f656fdd0c4224b3900a4c2d50443e6
-
SHA1
9b2879d91a63e6437ec7b47a5c39dd5cc64c9df3
-
SHA256
e278b36305e60e18a29c4b388248a78bd9c58fabc17fa9943392c43e7a49588e
-
SHA512
2b8ea438b308c94d463f06c8a04da1fa292f448b6f024e59423a1df5f5693b4957d12ffef6d03679f2d4a0c93d93ba16d8acf5c74f694f3a1a5b91aae1d378cf
-
SSDEEP
49152:GvyI22SsaNYfdPBldt698dBcjHlCy1JzLoGdZTHHB72eh2NT:Gvf22SsaNYfdPBldt6+dBcjHlCm
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.145:4782
9d952f82-b8b7-4948-b2b7-53c225a63ebb
-
encryption_key
AAB9DCB0841C8C889A6BCA76764D0770416B2FE1
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/1224-1-0x0000000000920000-0x0000000000C44000-memory.dmp family_quasar behavioral2/files/0x000a000000023b68-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 4464 Client.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2068 schtasks.exe 4924 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1224 Cleaner.exe Token: SeDebugPrivilege 4464 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4464 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1224 wrote to memory of 2068 1224 Cleaner.exe 82 PID 1224 wrote to memory of 2068 1224 Cleaner.exe 82 PID 1224 wrote to memory of 4464 1224 Cleaner.exe 84 PID 1224 wrote to memory of 4464 1224 Cleaner.exe 84 PID 4464 wrote to memory of 4924 4464 Client.exe 85 PID 4464 wrote to memory of 4924 4464 Client.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\Cleaner.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2068
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4924
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5f1f656fdd0c4224b3900a4c2d50443e6
SHA19b2879d91a63e6437ec7b47a5c39dd5cc64c9df3
SHA256e278b36305e60e18a29c4b388248a78bd9c58fabc17fa9943392c43e7a49588e
SHA5122b8ea438b308c94d463f06c8a04da1fa292f448b6f024e59423a1df5f5693b4957d12ffef6d03679f2d4a0c93d93ba16d8acf5c74f694f3a1a5b91aae1d378cf