Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
11-02-2025 23:50
Behavioral task
behavioral1
Sample
RedEngine.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
General
-
Target
RedEngine.exe
-
Size
502KB
-
MD5
7178d81c9afdabb202f31315f7eed7e2
-
SHA1
527a063588b3e4d3acc04cf211d9b0df33f5ade2
-
SHA256
67e35ca53e1ee18113207c2edf4b165ae9158cfed151e08bac627327f9c60f21
-
SHA512
80b770bd2d3541400386c4aa446da8840823864a62d73554dd62ea08d5e9596f2b737fa8046eb6fb892690d115eb928022cdb1d24f4f8d9cf2e449adfd0809a5
-
SSDEEP
6144:9TEgdc0Y5XAGbgiIN2RSBTuYNzBlh/gKeFwQHocEhyb8F9ODx2cTR30:9TEgdfYVbg/uOiFwR12x2cd0
Malware Config
Extracted
Family
quasar
Version
1.4.0
Botnet
TRAINING
C2
185.241.208.185:16145
Mutex
22073971-8d9a-4364-9916-abbb09ac9d8b
Attributes
-
encryption_key
7A9A8376440E3257DB2B54403642F366A5FBE14A
-
install_name
Starter Module.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Starter Module
-
subdirectory
Modules
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/3248-1-0x0000000000670000-0x00000000006F4000-memory.dmp family_quasar behavioral2/files/0x000b000000023cda-5.dat family_quasar -
Downloads MZ/PE file 1 IoCs
flow pid Process 38 3884 Process not Found -
Executes dropped EXE 1 IoCs
pid Process 4388 Starter Module.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\Modules\Starter Module.exe RedEngine.exe File opened for modification C:\Windows\system32\Modules RedEngine.exe File opened for modification C:\Windows\system32\Modules\Starter Module.exe Starter Module.exe File opened for modification C:\Windows\system32\Modules Starter Module.exe File created C:\Windows\system32\Modules\Starter Module.exe RedEngine.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3652 MicrosoftEdgeUpdate.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2676 schtasks.exe 3608 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4400 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3248 RedEngine.exe Token: SeDebugPrivilege 4388 Starter Module.exe Token: SeDebugPrivilege 4400 taskmgr.exe Token: SeSystemProfilePrivilege 4400 taskmgr.exe Token: SeCreateGlobalPrivilege 4400 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4388 Starter Module.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4388 Starter Module.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe 4400 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4388 Starter Module.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3248 wrote to memory of 2676 3248 RedEngine.exe 89 PID 3248 wrote to memory of 2676 3248 RedEngine.exe 89 PID 3248 wrote to memory of 4388 3248 RedEngine.exe 91 PID 3248 wrote to memory of 4388 3248 RedEngine.exe 91 PID 4388 wrote to memory of 3608 4388 Starter Module.exe 93 PID 4388 wrote to memory of 3608 4388 Starter Module.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RedEngine.exe"C:\Users\Admin\AppData\Local\Temp\RedEngine.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Starter Module" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\RedEngine.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2676
-
-
C:\Windows\system32\Modules\Starter Module.exe"C:\Windows\system32\Modules\Starter Module.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Starter Module" /sc ONLOGON /tr "C:\Windows\system32\Modules\Starter Module.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3608
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUJGREFFNkYtMEY0Ni00QkExLTkzNDUtMUI3RTFGMUU1MzZFfSIgdXNlcmlkPSJ7NjU4Q0RGODItQ0Q2Mi00NTAwLUIwMjEtMkEwNDFFRUJCNzA4fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RjQ1RTlCRjktNTAxRS00QTA1LTkzODQtQkYwRUI0MzY1MURDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5ODUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODQ0NDQzNjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTEyNzgzMjkxIi8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3652
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
502KB
MD57178d81c9afdabb202f31315f7eed7e2
SHA1527a063588b3e4d3acc04cf211d9b0df33f5ade2
SHA25667e35ca53e1ee18113207c2edf4b165ae9158cfed151e08bac627327f9c60f21
SHA51280b770bd2d3541400386c4aa446da8840823864a62d73554dd62ea08d5e9596f2b737fa8046eb6fb892690d115eb928022cdb1d24f4f8d9cf2e449adfd0809a5