Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
08-01-2025 19:50
General
-
Target
ClientX.exe
-
Size
3.4MB
-
MD5
8142104d55fc9ffeb5e79b5639ac2f2b
-
SHA1
2e9c324236f682ad4dbe7b5ee967676a2f40635c
-
SHA256
d26249928948f80fb0d520d8515473e343eec4bec3e45a5dfd2f3db7e518ffd2
-
SHA512
33142888451fa4f1fd0967da541683c63d75adb74a9839f08d1d2540c6db3d3e38a05edb58745240c9c7868ffa8405bf8f975b7d94be52cccc4b3c17e06bbd0c
-
SSDEEP
49152:LvPlL26AaNeWgPhlmVqvMQ7XSKK+xNESEok/ilLoGdUeTHHB72eh2NT:LvdL26AaNeWgPhlmVqkQ7XSKHxf9
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
ClientX
C2
o0p2e195m0-34052.portmap.host:34052
Mutex
b0299f3a-cce4-49aa-845a-55429d915187
Attributes
-
encryption_key
CFE2CEC16AA74627FAD2363341BA64A4E9D48B7B
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
Client
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/644-1-0x00000000005B0000-0x0000000000916000-memory.dmp family_quasar behavioral1/files/0x001b00000002ab46-5.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2484 Client.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" BackgroundTransferHost.exe Key created \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\MuiCache BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix BackgroundTransferHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4836 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 644 ClientX.exe Token: SeDebugPrivilege 2484 Client.exe Token: SeDebugPrivilege 4836 taskmgr.exe Token: SeSystemProfilePrivilege 4836 taskmgr.exe Token: SeCreateGlobalPrivilege 4836 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe 4836 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2484 Client.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 644 wrote to memory of 2484 644 ClientX.exe 78 PID 644 wrote to memory of 2484 644 ClientX.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\ClientX.exe"C:\Users\Admin\AppData\Local\Temp\ClientX.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Roaming\Client\Client.exe"C:\Users\Admin\AppData\Roaming\Client\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2484
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4836
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3084
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
PID:2536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\ae56c693-b1a8-43f4-9ad7-318169428706.down_data
Filesize555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
Filesize
3.4MB
MD58142104d55fc9ffeb5e79b5639ac2f2b
SHA12e9c324236f682ad4dbe7b5ee967676a2f40635c
SHA256d26249928948f80fb0d520d8515473e343eec4bec3e45a5dfd2f3db7e518ffd2
SHA51233142888451fa4f1fd0967da541683c63d75adb74a9839f08d1d2540c6db3d3e38a05edb58745240c9c7868ffa8405bf8f975b7d94be52cccc4b3c17e06bbd0c