Analysis
-
max time kernel
451s -
max time network
526s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 21:06
General
-
Target
512.exe
-
Size
3.1MB
-
MD5
317a46786b73fccfafa5b5678c1a21a1
-
SHA1
e72c0001fb47a477514f5abdb348ae489de65f72
-
SHA256
1dba5015247e9e52949d62c60c23713657123b7786cb790d6f1534126936c1b2
-
SHA512
237b4b626c30911e1f705ac9765d33446f6948630e2a4179d444391cd4e8338e34691da69a8f044b329889c3680aa9cc19108482abe51f179c354d81c8ce678f
-
SSDEEP
49152:Sv6I22SsaNYfdPBldt698dBcjH3mRJ6SbR3LoGdmTHHB72eh2NT:Sv322SsaNYfdPBldt6+dBcjH3mRJ6M
Malware Config
Extracted
quasar
1.4.1
Office04
pringelsy-51954.portmap.host:51954
ed30a1b2-d1a0-4e30-a860-b77fa3f71c40
-
encryption_key
49F9D3CAD835E70C60B54E401E356C16B3822AE8
-
install_name
Opera GX.exe
-
log_directory
Logs
-
reconnect_delay
1000
-
startup_key
OperaVPN
-
subdirectory
common Files
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/668-1-0x0000000000230000-0x0000000000554000-memory.dmp family_quasar C:\Program Files\Common Files\Opera GX.exe family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Opera GX.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Opera GX.exe -
Executes dropped EXE 1 IoCs
Processes:
Opera GX.exepid process 4484 Opera GX.exe -
Drops file in Program Files directory 5 IoCs
Processes:
512.exeOpera GX.exedescription ioc process File opened for modification C:\Program Files\common Files\Opera GX.exe 512.exe File opened for modification C:\Program Files\common Files 512.exe File opened for modification C:\Program Files\common Files\Opera GX.exe Opera GX.exe File opened for modification C:\Program Files\common Files Opera GX.exe File created C:\Program Files\common Files\Opera GX.exe 512.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 792 schtasks.exe 2888 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
512.exeOpera GX.exedescription pid process Token: SeDebugPrivilege 668 512.exe Token: SeDebugPrivilege 4484 Opera GX.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Opera GX.exepid process 4484 Opera GX.exe 4484 Opera GX.exe 4484 Opera GX.exe 4484 Opera GX.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Opera GX.exepid process 4484 Opera GX.exe 4484 Opera GX.exe 4484 Opera GX.exe 4484 Opera GX.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Opera GX.exepid process 4484 Opera GX.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
512.exeOpera GX.execmd.exedescription pid process target process PID 668 wrote to memory of 2888 668 512.exe schtasks.exe PID 668 wrote to memory of 2888 668 512.exe schtasks.exe PID 668 wrote to memory of 4484 668 512.exe Opera GX.exe PID 668 wrote to memory of 4484 668 512.exe Opera GX.exe PID 4484 wrote to memory of 792 4484 Opera GX.exe schtasks.exe PID 4484 wrote to memory of 792 4484 Opera GX.exe schtasks.exe PID 4484 wrote to memory of 2968 4484 Opera GX.exe schtasks.exe PID 4484 wrote to memory of 2968 4484 Opera GX.exe schtasks.exe PID 4484 wrote to memory of 5084 4484 Opera GX.exe cmd.exe PID 4484 wrote to memory of 5084 4484 Opera GX.exe cmd.exe PID 5084 wrote to memory of 5056 5084 cmd.exe chcp.com PID 5084 wrote to memory of 5056 5084 cmd.exe chcp.com PID 5084 wrote to memory of 3452 5084 cmd.exe PING.EXE PID 5084 wrote to memory of 3452 5084 cmd.exe PING.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\512.exe"C:\Users\Admin\AppData\Local\Temp\512.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\common Files\Opera GX.exe"C:\Program Files\common Files\Opera GX.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "OperaVPN" /sc ONLOGON /tr "C:\Program Files\common Files\Opera GX.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /delete /tn "OperaVPN" /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9zIfO7mjNnMb.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\Opera GX.exeFilesize
3.1MB
MD5317a46786b73fccfafa5b5678c1a21a1
SHA1e72c0001fb47a477514f5abdb348ae489de65f72
SHA2561dba5015247e9e52949d62c60c23713657123b7786cb790d6f1534126936c1b2
SHA512237b4b626c30911e1f705ac9765d33446f6948630e2a4179d444391cd4e8338e34691da69a8f044b329889c3680aa9cc19108482abe51f179c354d81c8ce678f
-
C:\Users\Admin\AppData\Local\Temp\9zIfO7mjNnMb.batFilesize
205B
MD5e564aadbb88c270eefaa2a024c339c6e
SHA141c2644cff47f5114220e10ddd223729b6beae06
SHA256d91a4c88097874d711b5206e4049ae746359e9e54fe0213dbc8275bd97029178
SHA51265ce7f9016e297ffeecb4dae6c03a7c4d03c58c410c5a8cc2dde0462382383bd9f5a8de98a27e7fc46c487c43eadcab3d9506f1327a136ed71be71f20c5a14ba
-
memory/668-0-0x00007FFF04093000-0x00007FFF04095000-memory.dmpFilesize
8KB
-
memory/668-1-0x0000000000230000-0x0000000000554000-memory.dmpFilesize
3.1MB
-
memory/668-2-0x00007FFF04090000-0x00007FFF04B51000-memory.dmpFilesize
10.8MB
-
memory/668-9-0x00007FFF04090000-0x00007FFF04B51000-memory.dmpFilesize
10.8MB
-
memory/4484-11-0x00007FFF04090000-0x00007FFF04B51000-memory.dmpFilesize
10.8MB
-
memory/4484-12-0x000000001C530000-0x000000001C580000-memory.dmpFilesize
320KB
-
memory/4484-13-0x000000001C640000-0x000000001C6F2000-memory.dmpFilesize
712KB
-
memory/4484-16-0x000000001C5C0000-0x000000001C5D2000-memory.dmpFilesize
72KB
-
memory/4484-17-0x000000001D140000-0x000000001D17C000-memory.dmpFilesize
240KB
-
memory/4484-18-0x00007FFF04090000-0x00007FFF04B51000-memory.dmpFilesize
10.8MB
-
memory/4484-24-0x00007FFF04090000-0x00007FFF04B51000-memory.dmpFilesize
10.8MB
-
memory/4484-10-0x00007FFF04090000-0x00007FFF04B51000-memory.dmpFilesize
10.8MB