Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2025 14:31
Static task
static1
Behavioral task
behavioral1
Sample
0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe
Resource
win7-20240903-en
General
-
Target
0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe
-
Size
3.7MB
-
MD5
c7e6c951ca20c04d0d11b0a7d429f6d4
-
SHA1
e8ec50949c6f6a4e8727a5091f3307381be82839
-
SHA256
0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657
-
SHA512
da37fb5599f0a7f405871aff2899c8ece589ff64df1081b2aa3bb563b7f505e4da25ab892094edf7c856fed34f77e0fcec9f5c285af0713d2c57e3d843a0fe67
-
SSDEEP
98304:01bQRm7L4+pqEYlPqQ5QvWvrfZt7qA7XZ7eFq8u:0mRm7LjpqzkUQvWvrr7qmeRu
Malware Config
Extracted
quasar
1.4.1
ES CODE
twart.myfirewall.org:9792
rency.ydns.eu:5287
wqo9.firewall-gateway.de:8841
code1.ydns.eu:5287
wqo9.firewall-gateway.de:9792
025351e291-5d1041-4fa37-932c7-8L69aeiQec514992
-
encryption_key
3145298725BA5E0DD56E87FFE3F8898EA81E6EDA
-
install_name
Excelworkbook.exe
-
log_directory
Logs
-
reconnect_delay
6000
-
startup_key
pdfdocument
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/540-11-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar -
Executes dropped EXE 3 IoCs
pid Process 4132 Excelworkbook.exe 3984 Excelworkbook.exe 2020 Excelworkbook.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4004 set thread context of 540 4004 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 95 PID 4132 set thread context of 2020 4132 Excelworkbook.exe 102 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Excelworkbook.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Excelworkbook.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3592 schtasks.exe 3908 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4004 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 4004 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 4132 Excelworkbook.exe 4132 Excelworkbook.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4004 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe Token: SeDebugPrivilege 540 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe Token: SeDebugPrivilege 4132 Excelworkbook.exe Token: SeDebugPrivilege 2020 Excelworkbook.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2020 Excelworkbook.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 4004 wrote to memory of 2200 4004 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 94 PID 4004 wrote to memory of 2200 4004 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 94 PID 4004 wrote to memory of 2200 4004 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 94 PID 4004 wrote to memory of 540 4004 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 95 PID 4004 wrote to memory of 540 4004 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 95 PID 4004 wrote to memory of 540 4004 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 95 PID 4004 wrote to memory of 540 4004 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 95 PID 4004 wrote to memory of 540 4004 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 95 PID 4004 wrote to memory of 540 4004 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 95 PID 4004 wrote to memory of 540 4004 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 95 PID 4004 wrote to memory of 540 4004 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 95 PID 540 wrote to memory of 3592 540 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 96 PID 540 wrote to memory of 3592 540 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 96 PID 540 wrote to memory of 3592 540 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 96 PID 540 wrote to memory of 4132 540 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 98 PID 540 wrote to memory of 4132 540 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 98 PID 540 wrote to memory of 4132 540 0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe 98 PID 4132 wrote to memory of 3984 4132 Excelworkbook.exe 101 PID 4132 wrote to memory of 3984 4132 Excelworkbook.exe 101 PID 4132 wrote to memory of 3984 4132 Excelworkbook.exe 101 PID 4132 wrote to memory of 2020 4132 Excelworkbook.exe 102 PID 4132 wrote to memory of 2020 4132 Excelworkbook.exe 102 PID 4132 wrote to memory of 2020 4132 Excelworkbook.exe 102 PID 4132 wrote to memory of 2020 4132 Excelworkbook.exe 102 PID 4132 wrote to memory of 2020 4132 Excelworkbook.exe 102 PID 4132 wrote to memory of 2020 4132 Excelworkbook.exe 102 PID 4132 wrote to memory of 2020 4132 Excelworkbook.exe 102 PID 4132 wrote to memory of 2020 4132 Excelworkbook.exe 102 PID 2020 wrote to memory of 3908 2020 Excelworkbook.exe 104 PID 2020 wrote to memory of 3908 2020 Excelworkbook.exe 104 PID 2020 wrote to memory of 3908 2020 Excelworkbook.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe"C:\Users\Admin\AppData\Local\Temp\0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe"C:\Users\Admin\AppData\Local\Temp\0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe"2⤵PID:2200
-
-
C:\Users\Admin\AppData\Local\Temp\0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe"C:\Users\Admin\AppData\Local\Temp\0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3592
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe"C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe"C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe"4⤵
- Executes dropped EXE
PID:3984
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe"C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe" /rl HIGHEST /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3908
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe.log
Filesize1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
3.7MB
MD5c7e6c951ca20c04d0d11b0a7d429f6d4
SHA1e8ec50949c6f6a4e8727a5091f3307381be82839
SHA2560d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657
SHA512da37fb5599f0a7f405871aff2899c8ece589ff64df1081b2aa3bb563b7f505e4da25ab892094edf7c856fed34f77e0fcec9f5c285af0713d2c57e3d843a0fe67