Analysis
-
max time kernel
127s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 01:34
Behavioral task
behavioral1
Sample
90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962.exe
Resource
win7-20240508-en
General
-
Target
90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962.exe
-
Size
409KB
-
MD5
808d880b4fc7f865fb607337690b5575
-
SHA1
7782ec3da7a6f8ed196d4431c59d50690580ac39
-
SHA256
90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962
-
SHA512
7a7ee833835d9469a1a5b48a5cbf9c902f362d82ad37b2ba99944e692b4322c140d770dc7be30f8ace7b84d6508e4d2e5f2007294ca3c07094bbfca8120ec6a8
-
SSDEEP
12288:KpsD64e1Muxkk3abqow6dL+32oJN/nSjCt1hw:OsG4kMUQU6E3NN/nk
Malware Config
Extracted
quasar
3.1.5
SeroXen
feel-barcelona.gl.at.ply.gg:47655
$Sxr-GV6wZsGZZMeZ3qfenc
-
encryption_key
OyypB9RDbCUrmPK8uTim
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Defender Anti-Malware Disable Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3296-1-0x0000000000120000-0x000000000018C000-memory.dmp family_quasar -
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3296-1-0x0000000000120000-0x000000000018C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962.exedescription pid process Token: SeDebugPrivilege 3296 90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962.exepid process 3296 90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962.exedescription pid process target process PID 3296 wrote to memory of 3780 3296 90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962.exe schtasks.exe PID 3296 wrote to memory of 3780 3296 90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962.exe schtasks.exe PID 3296 wrote to memory of 3780 3296 90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962.exe"C:\Users\Admin\AppData\Local\Temp\90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Defender Anti-Malware Disable Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1300,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3296-0-0x00000000750AE000-0x00000000750AF000-memory.dmpFilesize
4KB
-
memory/3296-1-0x0000000000120000-0x000000000018C000-memory.dmpFilesize
432KB
-
memory/3296-2-0x00000000050B0000-0x0000000005654000-memory.dmpFilesize
5.6MB
-
memory/3296-3-0x0000000004C10000-0x0000000004CA2000-memory.dmpFilesize
584KB
-
memory/3296-4-0x00000000750A0000-0x0000000075850000-memory.dmpFilesize
7.7MB
-
memory/3296-5-0x0000000004B90000-0x0000000004BF6000-memory.dmpFilesize
408KB
-
memory/3296-6-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/3296-7-0x0000000005DE0000-0x0000000005E1C000-memory.dmpFilesize
240KB
-
memory/3296-9-0x00000000062B0000-0x00000000062BA000-memory.dmpFilesize
40KB
-
memory/3296-10-0x00000000750AE000-0x00000000750AF000-memory.dmpFilesize
4KB
-
memory/3296-11-0x00000000750A0000-0x0000000075850000-memory.dmpFilesize
7.7MB