Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2025, 22:12
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
7d9c6de47c31429b7cf08f07627add9f
-
SHA1
956c88efb80cd32f927bb9b5b25cfc9003b3dffa
-
SHA256
eaa4c2ef6a75906268f1ab8747ac150393f6487b0f6f57572536925481e00a73
-
SHA512
6ed87cde8eef630d9262817a6cab8c8af5163a12cef18dc21a5717386861c611f9e393a7993750dda128284bf1d1ffc1b4748a6e1f1d3569d4fbea877e23e12e
-
SSDEEP
49152:uviI22SsaNYfdPBldt698dBcjH4Ge2EGHBk/uV+oGdJTTHHB72eh2NT:uvv22SsaNYfdPBldt6+dBcjH4GewI
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
193.161.193.99:1194
Mutex
971d5aa2-233d-46c4-98c1-1812990742ad
Attributes
-
encryption_key
151D6A9E126EFB6E3B926F9127D87D6BF4A4C605
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
SecurityHealthSystray.exe
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral1/memory/2984-1-0x00000000004C0000-0x00000000007E4000-memory.dmp family_quasar -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 232 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2984 Client-built.exe Token: SeDebugPrivilege 116 taskmgr.exe Token: SeSystemProfilePrivilege 116 taskmgr.exe Token: SeCreateGlobalPrivilege 116 taskmgr.exe Token: 33 116 taskmgr.exe Token: SeIncBasePriorityPrivilege 116 taskmgr.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 2984 Client-built.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe -
Suspicious use of SendNotifyMessage 50 IoCs
pid Process 2984 Client-built.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe 116 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2984 wrote to memory of 232 2984 Client-built.exe 85 PID 2984 wrote to memory of 232 2984 Client-built.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SecurityHealthSystray.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:232
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:116