Analysis
-
max time kernel
108s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system -
submitted
01/04/2025, 16:47
Behavioral task
behavioral1
Sample
Clientv2.exe
Resource
win10v2004-20250313-en
General
-
Target
Clientv2.exe
-
Size
3.2MB
-
MD5
f312e5b89c544d808859a09fbf8e6e9a
-
SHA1
917b95dc9c0f5ca7f089ad645c99395419914f37
-
SHA256
7b718d668fa3aed991ee8b9fc8f76fed543e5045f411369df659ee4cf09a0413
-
SHA512
2f894bb5f89e403fd22c2b2437043b8e79092f4d019a10fe13db3b89689374c6379af7372723bd343095b1b036b773d8ee3e1b95b955a452c46e0dac74c51b5b
-
SSDEEP
49152:wvdt62XlaSFNWPjljiFa2RoUYIzlRJ6MbR3LoGdkTHHB72eh2NT:wvf62XlaSFNWPjljiFXRoUYIzlRJ6W
Malware Config
Extracted
quasar
1.4.1
Quasarv2
178.83.80.11:4782
01be4b22-353e-48a7-a4fc-41ed4d3b5081
-
encryption_key
B729697B6EECAC23F05DCF0A1F0857B793DF22A5
-
install_name
WinStart.exe
-
log_directory
TempLogs
-
reconnect_delay
3000
-
startup_key
WinStart
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/2652-1-0x00000000009C0000-0x0000000000CF4000-memory.dmp family_quasar behavioral1/files/0x0008000000024248-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 3456 WinStart.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5096 schtasks.exe 4748 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4756 powershell.exe 4756 powershell.exe 4756 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2652 Clientv2.exe Token: SeDebugPrivilege 3456 WinStart.exe Token: SeDebugPrivilege 4756 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3456 WinStart.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2652 wrote to memory of 5096 2652 Clientv2.exe 90 PID 2652 wrote to memory of 5096 2652 Clientv2.exe 90 PID 2652 wrote to memory of 3456 2652 Clientv2.exe 92 PID 2652 wrote to memory of 3456 2652 Clientv2.exe 92 PID 3456 wrote to memory of 4748 3456 WinStart.exe 93 PID 3456 wrote to memory of 4748 3456 WinStart.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Clientv2.exe"C:\Users\Admin\AppData\Local\Temp\Clientv2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WinStart" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WinStart.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5096
-
-
C:\Users\Admin\AppData\Roaming\SubDir\WinStart.exe"C:\Users\Admin\AppData\Roaming\SubDir\WinStart.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WinStart" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WinStart.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4748
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.2MB
MD5f312e5b89c544d808859a09fbf8e6e9a
SHA1917b95dc9c0f5ca7f089ad645c99395419914f37
SHA2567b718d668fa3aed991ee8b9fc8f76fed543e5045f411369df659ee4cf09a0413
SHA5122f894bb5f89e403fd22c2b2437043b8e79092f4d019a10fe13db3b89689374c6379af7372723bd343095b1b036b773d8ee3e1b95b955a452c46e0dac74c51b5b