Resubmissions
09-01-2025 16:23
250109-tvy9pawpbk 10Analysis
-
max time kernel
134s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-01-2025 16:23
Behavioral task
behavioral1
Sample
ddnstest.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
300 seconds
General
-
Target
ddnstest.exe
-
Size
3.1MB
-
MD5
0b301a943083061bb0e95c688ad02dcf
-
SHA1
b26d04fcad24a618a422ae156774218d42538d88
-
SHA256
79b2e8bd0d46901502869063962252c0b80b77ff909f1e497bf4c04ae2f0ec71
-
SHA512
58e8fa3c6dd985d89fa2cd6a6f91ce87929165cee9d85b0fb1cbb70cfb33053567a333464da804ee7cee80f33bb5b065de4817812b114b9c7dbe5ef60e6ab923
-
SSDEEP
49152:avyI22SsaNYfdPBldt698dBcjHF2tjmzeEoGdzTHHB72eh2NT:avf22SsaNYfdPBldt6+dBcjHF2te
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
hiimbob.ddnsking.com:9112
Mutex
91f1b164-f669-47a1-b3ec-59976d66b33a
Attributes
-
encryption_key
FD9ED3A6AE6574CE5C854385C6AC2FC432580344
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/4520-1-0x00000000002A0000-0x00000000005C4000-memory.dmp family_quasar -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4520 ddnstest.exe Token: SeDebugPrivilege 1832 taskmgr.exe Token: SeSystemProfilePrivilege 1832 taskmgr.exe Token: SeCreateGlobalPrivilege 1832 taskmgr.exe Token: 33 1832 taskmgr.exe Token: SeIncBasePriorityPrivilege 1832 taskmgr.exe -
Suspicious use of FindShellTrayWindow 60 IoCs
pid Process 4520 ddnstest.exe 4520 ddnstest.exe 4520 ddnstest.exe 4520 ddnstest.exe 4520 ddnstest.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe -
Suspicious use of SendNotifyMessage 60 IoCs
pid Process 4520 ddnstest.exe 4520 ddnstest.exe 4520 ddnstest.exe 4520 ddnstest.exe 4520 ddnstest.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4520 ddnstest.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddnstest.exe"C:\Users\Admin\AppData\Local\Temp\ddnstest.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4520
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1832