Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
18-06-2024 15:29
Behavioral task
behavioral1
Sample
164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe
Resource
win10v2004-20240508-en
General
-
Target
164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe
-
Size
3.1MB
-
MD5
1b27e622f4edbbdd8fc93a0d1c129607
-
SHA1
3e7b42dd10c01f632f158cc96701f6ba49ebec48
-
SHA256
164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f
-
SHA512
bd6d609019f06649db920244a91ef5a2f105ea81055cdd53df72e737e1aae75b340060f45cb56383d201c154591a0a297fd69e1d09c5239b96ea5765a823ef5c
-
SSDEEP
49152:kvHI22SsaNYfdPBldt698dBcjHn30LdBhJo2d/UTHHB72eh2NT:kvo22SsaNYfdPBldt6+dBcjH30nv
Malware Config
Extracted
quasar
1.4.1
Office04
94.228.166.40:4782
172a89d7-b9b2-4d82-b5ed-6beb5326f544
-
encryption_key
7970C2029EDBB83E6BD65073BE18684AC9FF3F48
-
install_name
KR6nDu9fLhop1bFe.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Defender.proces
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3024-1-0x0000000000E70000-0x0000000001194000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
KR6nDu9fLhop1bFe.exepid process 2064 KR6nDu9fLhop1bFe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3184 schtasks.exe 228 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exeKR6nDu9fLhop1bFe.exedescription pid process Token: SeDebugPrivilege 3024 164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe Token: SeDebugPrivilege 2064 KR6nDu9fLhop1bFe.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
KR6nDu9fLhop1bFe.exepid process 2064 KR6nDu9fLhop1bFe.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
KR6nDu9fLhop1bFe.exepid process 2064 KR6nDu9fLhop1bFe.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
KR6nDu9fLhop1bFe.exepid process 2064 KR6nDu9fLhop1bFe.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exeKR6nDu9fLhop1bFe.exedescription pid process target process PID 3024 wrote to memory of 3184 3024 164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe schtasks.exe PID 3024 wrote to memory of 3184 3024 164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe schtasks.exe PID 3024 wrote to memory of 2064 3024 164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe KR6nDu9fLhop1bFe.exe PID 3024 wrote to memory of 2064 3024 164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe KR6nDu9fLhop1bFe.exe PID 2064 wrote to memory of 228 2064 KR6nDu9fLhop1bFe.exe schtasks.exe PID 2064 wrote to memory of 228 2064 KR6nDu9fLhop1bFe.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe"C:\Users\Admin\AppData\Local\Temp\164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Defender.proces" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe"C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Defender.proces" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exeFilesize
3.1MB
MD51b27e622f4edbbdd8fc93a0d1c129607
SHA13e7b42dd10c01f632f158cc96701f6ba49ebec48
SHA256164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f
SHA512bd6d609019f06649db920244a91ef5a2f105ea81055cdd53df72e737e1aae75b340060f45cb56383d201c154591a0a297fd69e1d09c5239b96ea5765a823ef5c
-
memory/2064-9-0x00007FF8651F0000-0x00007FF865CB2000-memory.dmpFilesize
10.8MB
-
memory/2064-11-0x00007FF8651F0000-0x00007FF865CB2000-memory.dmpFilesize
10.8MB
-
memory/2064-12-0x000000001BCA0000-0x000000001BCF0000-memory.dmpFilesize
320KB
-
memory/2064-13-0x000000001BDB0000-0x000000001BE62000-memory.dmpFilesize
712KB
-
memory/2064-14-0x00007FF8651F0000-0x00007FF865CB2000-memory.dmpFilesize
10.8MB
-
memory/3024-0-0x00007FF8651F3000-0x00007FF8651F5000-memory.dmpFilesize
8KB
-
memory/3024-1-0x0000000000E70000-0x0000000001194000-memory.dmpFilesize
3.1MB
-
memory/3024-2-0x00007FF8651F0000-0x00007FF865CB2000-memory.dmpFilesize
10.8MB
-
memory/3024-10-0x00007FF8651F0000-0x00007FF865CB2000-memory.dmpFilesize
10.8MB