Analysis
-
max time kernel
62s -
max time network
64s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 20:53
General
-
Target
Cyber-Security Nuker (UPDATED).exe
-
Size
3.1MB
-
MD5
ac73e69fc419907a58784fd50471168d
-
SHA1
c936621828f889a8123f6057eb66fc38ebd6f293
-
SHA256
371530ba596376ff7fd76425f681d102ab2d171675620070035cbb0e1d1a0516
-
SHA512
74416db9fef10e50ab5acae785fbd005ecf16ce94022eb8a7d18d3f1bfc23242e7b5a180d6ff825281ae64fc1df513040ac87be7cb79060df96ca609e78b030e
-
SSDEEP
49152:rvyI22SsaNYfdPBldt698dBcjHbdIR9karHNoGdjKTHHB72eh2NT:rvf22SsaNYfdPBldt6+dBcjHC97
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.68.67:4782
dcb0af0e-4f78-426b-9489-43ea356dc0f7
-
encryption_key
0807120B930C7C14B2B5A7F6550477313E81C7B9
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1476-1-0x0000000000200000-0x0000000000524000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Client.exepid process 4660 Client.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3036 schtasks.exe 2428 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
taskmgr.exepid process 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
Cyber-Security Nuker (UPDATED).exeClient.exetaskmgr.exesvchost.exedescription pid process Token: SeDebugPrivilege 1476 Cyber-Security Nuker (UPDATED).exe Token: SeDebugPrivilege 4660 Client.exe Token: SeDebugPrivilege 1888 taskmgr.exe Token: SeSystemProfilePrivilege 1888 taskmgr.exe Token: SeCreateGlobalPrivilege 1888 taskmgr.exe Token: SeSecurityPrivilege 1888 taskmgr.exe Token: SeTakeOwnershipPrivilege 1888 taskmgr.exe Token: SeBackupPrivilege 2004 svchost.exe Token: SeRestorePrivilege 2004 svchost.exe Token: SeSecurityPrivilege 2004 svchost.exe Token: SeTakeOwnershipPrivilege 2004 svchost.exe Token: 35 2004 svchost.exe Token: 33 1888 taskmgr.exe Token: SeIncBasePriorityPrivilege 1888 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 4660 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Cyber-Security Nuker (UPDATED).exeClient.exedescription pid process target process PID 1476 wrote to memory of 3036 1476 Cyber-Security Nuker (UPDATED).exe schtasks.exe PID 1476 wrote to memory of 3036 1476 Cyber-Security Nuker (UPDATED).exe schtasks.exe PID 1476 wrote to memory of 4660 1476 Cyber-Security Nuker (UPDATED).exe Client.exe PID 1476 wrote to memory of 4660 1476 Cyber-Security Nuker (UPDATED).exe Client.exe PID 4660 wrote to memory of 2428 4660 Client.exe schtasks.exe PID 4660 wrote to memory of 2428 4660 Client.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cyber-Security Nuker (UPDATED).exe"C:\Users\Admin\AppData\Local\Temp\Cyber-Security Nuker (UPDATED).exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
3.1MB
MD5ac73e69fc419907a58784fd50471168d
SHA1c936621828f889a8123f6057eb66fc38ebd6f293
SHA256371530ba596376ff7fd76425f681d102ab2d171675620070035cbb0e1d1a0516
SHA51274416db9fef10e50ab5acae785fbd005ecf16ce94022eb8a7d18d3f1bfc23242e7b5a180d6ff825281ae64fc1df513040ac87be7cb79060df96ca609e78b030e
-
memory/1476-0-0x00007FFE76233000-0x00007FFE76235000-memory.dmpFilesize
8KB
-
memory/1476-1-0x0000000000200000-0x0000000000524000-memory.dmpFilesize
3.1MB
-
memory/1476-2-0x00007FFE76230000-0x00007FFE76CF1000-memory.dmpFilesize
10.8MB
-
memory/1476-26-0x00007FFE76230000-0x00007FFE76CF1000-memory.dmpFilesize
10.8MB
-
memory/1888-22-0x00000218D55E0000-0x00000218D55E1000-memory.dmpFilesize
4KB
-
memory/1888-23-0x00000218D55E0000-0x00000218D55E1000-memory.dmpFilesize
4KB
-
memory/1888-34-0x00000218D7100000-0x00000218D7110000-memory.dmpFilesize
64KB
-
memory/1888-13-0x00000218D55E0000-0x00000218D55E1000-memory.dmpFilesize
4KB
-
memory/1888-14-0x00000218D55E0000-0x00000218D55E1000-memory.dmpFilesize
4KB
-
memory/1888-15-0x00000218D55E0000-0x00000218D55E1000-memory.dmpFilesize
4KB
-
memory/1888-21-0x00000218D55E0000-0x00000218D55E1000-memory.dmpFilesize
4KB
-
memory/1888-25-0x00000218D55E0000-0x00000218D55E1000-memory.dmpFilesize
4KB
-
memory/1888-24-0x00000218D55E0000-0x00000218D55E1000-memory.dmpFilesize
4KB
-
memory/1888-28-0x00000218D70A0000-0x00000218D70B0000-memory.dmpFilesize
64KB
-
memory/1888-20-0x00000218D55E0000-0x00000218D55E1000-memory.dmpFilesize
4KB
-
memory/1888-19-0x00000218D55E0000-0x00000218D55E1000-memory.dmpFilesize
4KB
-
memory/4660-10-0x00007FFE76230000-0x00007FFE76CF1000-memory.dmpFilesize
10.8MB
-
memory/4660-9-0x00007FFE76230000-0x00007FFE76CF1000-memory.dmpFilesize
10.8MB
-
memory/4660-27-0x00007FFE76230000-0x00007FFE76CF1000-memory.dmpFilesize
10.8MB
-
memory/4660-11-0x000000001B9C0000-0x000000001BA10000-memory.dmpFilesize
320KB
-
memory/4660-12-0x000000001BAD0000-0x000000001BB82000-memory.dmpFilesize
712KB
-
memory/4660-40-0x00007FFE76230000-0x00007FFE76CF1000-memory.dmpFilesize
10.8MB