Analysis
-
max time kernel
125s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-06-2024 01:07
Behavioral task
behavioral1
Sample
164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe
Resource
win7-20240508-en
General
-
Target
164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe
-
Size
3.1MB
-
MD5
1b27e622f4edbbdd8fc93a0d1c129607
-
SHA1
3e7b42dd10c01f632f158cc96701f6ba49ebec48
-
SHA256
164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f
-
SHA512
bd6d609019f06649db920244a91ef5a2f105ea81055cdd53df72e737e1aae75b340060f45cb56383d201c154591a0a297fd69e1d09c5239b96ea5765a823ef5c
-
SSDEEP
49152:kvHI22SsaNYfdPBldt698dBcjHn30LdBhJo2d/UTHHB72eh2NT:kvo22SsaNYfdPBldt6+dBcjH30nv
Malware Config
Extracted
quasar
1.4.1
Office04
94.228.166.40:4782
172a89d7-b9b2-4d82-b5ed-6beb5326f544
-
encryption_key
7970C2029EDBB83E6BD65073BE18684AC9FF3F48
-
install_name
KR6nDu9fLhop1bFe.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Defender.proces
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4812-1-0x0000000000AF0000-0x0000000000E14000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe family_quasar -
Detects Windows executables referencing non-Windows User-Agents 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4812-1-0x0000000000AF0000-0x0000000000E14000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4812-1-0x0000000000AF0000-0x0000000000E14000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables containing common artifacts observed in infostealers 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4812-1-0x0000000000AF0000-0x0000000000E14000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe INDICATOR_SUSPICIOUS_GENInfoStealer -
Executes dropped EXE 1 IoCs
Processes:
KR6nDu9fLhop1bFe.exepid process 4856 KR6nDu9fLhop1bFe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4172 schtasks.exe 4484 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exeKR6nDu9fLhop1bFe.exedescription pid process Token: SeDebugPrivilege 4812 164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe Token: SeDebugPrivilege 4856 KR6nDu9fLhop1bFe.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
KR6nDu9fLhop1bFe.exepid process 4856 KR6nDu9fLhop1bFe.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
KR6nDu9fLhop1bFe.exepid process 4856 KR6nDu9fLhop1bFe.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
KR6nDu9fLhop1bFe.exepid process 4856 KR6nDu9fLhop1bFe.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exeKR6nDu9fLhop1bFe.exedescription pid process target process PID 4812 wrote to memory of 4172 4812 164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe schtasks.exe PID 4812 wrote to memory of 4172 4812 164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe schtasks.exe PID 4812 wrote to memory of 4856 4812 164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe KR6nDu9fLhop1bFe.exe PID 4812 wrote to memory of 4856 4812 164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe KR6nDu9fLhop1bFe.exe PID 4856 wrote to memory of 4484 4856 KR6nDu9fLhop1bFe.exe schtasks.exe PID 4856 wrote to memory of 4484 4856 KR6nDu9fLhop1bFe.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe"C:\Users\Admin\AppData\Local\Temp\164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Defender.proces" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe"C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Defender.proces" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\KR6nDu9fLhop1bFe.exeFilesize
3.1MB
MD51b27e622f4edbbdd8fc93a0d1c129607
SHA13e7b42dd10c01f632f158cc96701f6ba49ebec48
SHA256164e19d48c8d3ed423d4d4c68dff47899f375b6ef4f2a27005562e16b3a8d33f
SHA512bd6d609019f06649db920244a91ef5a2f105ea81055cdd53df72e737e1aae75b340060f45cb56383d201c154591a0a297fd69e1d09c5239b96ea5765a823ef5c
-
memory/4812-0-0x00007FF9F65B3000-0x00007FF9F65B5000-memory.dmpFilesize
8KB
-
memory/4812-1-0x0000000000AF0000-0x0000000000E14000-memory.dmpFilesize
3.1MB
-
memory/4812-2-0x00007FF9F65B0000-0x00007FF9F7071000-memory.dmpFilesize
10.8MB
-
memory/4812-9-0x00007FF9F65B0000-0x00007FF9F7071000-memory.dmpFilesize
10.8MB
-
memory/4856-10-0x00007FF9F65B0000-0x00007FF9F7071000-memory.dmpFilesize
10.8MB
-
memory/4856-11-0x00007FF9F65B0000-0x00007FF9F7071000-memory.dmpFilesize
10.8MB
-
memory/4856-12-0x000000001DD40000-0x000000001DD90000-memory.dmpFilesize
320KB
-
memory/4856-13-0x000000001DE50000-0x000000001DF02000-memory.dmpFilesize
712KB
-
memory/4856-14-0x00007FF9F65B0000-0x00007FF9F7071000-memory.dmpFilesize
10.8MB