Analysis
-
max time kernel
93s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-06-2024 15:29
Behavioral task
behavioral1
Sample
164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe
Resource
win10v2004-20240508-en
General
-
Target
164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe
-
Size
3.1MB
-
MD5
1b27e622f4edbbdd8fc93a0d1c129607
-
SHA1
3e7b42dd10c01f632f158cc96701f6ba49ebec48
-
SHA256
164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f
-
SHA512
bd6d609019f06649db920244a91ef5a2f105ea81055cdd53df72e737e1aae75b340060f45cb56383d201c154591a0a297fd69e1d09c5239b96ea5765a823ef5c
-
SSDEEP
49152:kvHI22SsaNYfdPBldt698dBcjHn30LdBhJo2d/UTHHB72eh2NT:kvo22SsaNYfdPBldt6+dBcjH30nv
Malware Config
Extracted
quasar
1.4.1
Office04
94.228.166.40:4782
172a89d7-b9b2-4d82-b5ed-6beb5326f544
-
encryption_key
7970C2029EDBB83E6BD65073BE18684AC9FF3F48
-
install_name
KR6nDu9fLhop1bFe.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Defender.proces
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1800-1-0x00000000000C0000-0x00000000003E4000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
KR6nDu9fLhop1bFe.exepid process 2196 KR6nDu9fLhop1bFe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3384 schtasks.exe 3076 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exeKR6nDu9fLhop1bFe.exedescription pid process Token: SeDebugPrivilege 1800 164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe Token: SeDebugPrivilege 2196 KR6nDu9fLhop1bFe.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
KR6nDu9fLhop1bFe.exepid process 2196 KR6nDu9fLhop1bFe.exe 2196 KR6nDu9fLhop1bFe.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
KR6nDu9fLhop1bFe.exepid process 2196 KR6nDu9fLhop1bFe.exe 2196 KR6nDu9fLhop1bFe.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
KR6nDu9fLhop1bFe.exepid process 2196 KR6nDu9fLhop1bFe.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exeKR6nDu9fLhop1bFe.exedescription pid process target process PID 1800 wrote to memory of 3384 1800 164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe schtasks.exe PID 1800 wrote to memory of 3384 1800 164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe schtasks.exe PID 1800 wrote to memory of 2196 1800 164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe KR6nDu9fLhop1bFe.exe PID 1800 wrote to memory of 2196 1800 164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe KR6nDu9fLhop1bFe.exe PID 2196 wrote to memory of 3076 2196 KR6nDu9fLhop1bFe.exe schtasks.exe PID 2196 wrote to memory of 3076 2196 KR6nDu9fLhop1bFe.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe"C:\Users\Admin\AppData\Local\Temp\164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Defender.proces" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe"C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Defender.proces" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exeFilesize
3.1MB
MD51b27e622f4edbbdd8fc93a0d1c129607
SHA13e7b42dd10c01f632f158cc96701f6ba49ebec48
SHA256164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f
SHA512bd6d609019f06649db920244a91ef5a2f105ea81055cdd53df72e737e1aae75b340060f45cb56383d201c154591a0a297fd69e1d09c5239b96ea5765a823ef5c
-
memory/1800-0-0x00007FF9BD1C3000-0x00007FF9BD1C5000-memory.dmpFilesize
8KB
-
memory/1800-1-0x00000000000C0000-0x00000000003E4000-memory.dmpFilesize
3.1MB
-
memory/1800-2-0x00007FF9BD1C0000-0x00007FF9BDC81000-memory.dmpFilesize
10.8MB
-
memory/1800-10-0x00007FF9BD1C0000-0x00007FF9BDC81000-memory.dmpFilesize
10.8MB
-
memory/2196-9-0x00007FF9BD1C0000-0x00007FF9BDC81000-memory.dmpFilesize
10.8MB
-
memory/2196-11-0x00007FF9BD1C0000-0x00007FF9BDC81000-memory.dmpFilesize
10.8MB
-
memory/2196-12-0x000000001BC70000-0x000000001BCC0000-memory.dmpFilesize
320KB
-
memory/2196-13-0x000000001BD80000-0x000000001BE32000-memory.dmpFilesize
712KB
-
memory/2196-16-0x000000001BD00000-0x000000001BD12000-memory.dmpFilesize
72KB
-
memory/2196-17-0x000000001C880000-0x000000001C8BC000-memory.dmpFilesize
240KB
-
memory/2196-18-0x00007FF9BD1C0000-0x00007FF9BDC81000-memory.dmpFilesize
10.8MB