General
-
Target
ImageLoggerV12.exe
-
Size
67.2MB
-
Sample
240614-e7engsvfqb
-
MD5
c32642c9ee6b0645a1b8e79827d3b527
-
SHA1
c91233c4cb87e810989c4135aa5956aadb74240a
-
SHA256
427895a73d7150c8f132f251c230ae0686ee0b89e13e46258f40b0de1cc5e638
-
SHA512
6447dc0a21efe22b7b80143e34aeba0e0a788a6d7802f16ae9430fb2040284ea8254b4740da84229447410e4ddbadc235b1cebcf8d797915b66c83aa88c8b2fc
-
SSDEEP
1572864:132XjX2pJxhQnieFTnt9bN4bfZDbNmkXfSWd+Ut8y4:1N7iTn2dDJF6WDO
Static task
static1
Behavioral task
behavioral1
Sample
ImageLoggerV12.exe
Resource
win7-20240221-en
Malware Config
Extracted
quasar
1.4.1
Office04
NareReti-40382.portmap.host:40382
1f3547a3-6112-47d5-9c48-4fb1bd3d6344
-
encryption_key
CE886B4F24E457903274F7555F940215147255CD
-
install_name
CasNic.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Google Chrome
-
subdirectory
SubDir
Targets
-
-
Target
ImageLoggerV12.exe
-
Size
67.2MB
-
MD5
c32642c9ee6b0645a1b8e79827d3b527
-
SHA1
c91233c4cb87e810989c4135aa5956aadb74240a
-
SHA256
427895a73d7150c8f132f251c230ae0686ee0b89e13e46258f40b0de1cc5e638
-
SHA512
6447dc0a21efe22b7b80143e34aeba0e0a788a6d7802f16ae9430fb2040284ea8254b4740da84229447410e4ddbadc235b1cebcf8d797915b66c83aa88c8b2fc
-
SSDEEP
1572864:132XjX2pJxhQnieFTnt9bN4bfZDbNmkXfSWd+Ut8y4:1N7iTn2dDJF6WDO
-
Quasar payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
XMRig Miner payload
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-