Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 21:50
Behavioral task
behavioral1
Sample
5a1c61fc913ba7293c85c7b4ad28e88f1683ec2158897eab5a5212d4059ab959.exe
Resource
win7-20231129-en
General
-
Target
5a1c61fc913ba7293c85c7b4ad28e88f1683ec2158897eab5a5212d4059ab959.exe
-
Size
3.1MB
-
MD5
4f107e95a9c20b41ef4e602ec661d3f1
-
SHA1
429db6828d2152b818f5db9f0574e867dcaf2f6b
-
SHA256
5a1c61fc913ba7293c85c7b4ad28e88f1683ec2158897eab5a5212d4059ab959
-
SHA512
b8bc51d250bd443347a52211b4bb1075c8a7b89d3e190d0efd093b3f74e7d2e2c041eaea62798484ab0a9d7da4a81c62f42172b6dacd190bd5a54de706b75f13
-
SSDEEP
49152:avkt62XlaSFNWPjljiFa2RoUYI6se2ErsSk/uhaoGdS/THHB72eh2NT:av462XlaSFNWPjljiFXRoUYI6seP8i
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.0.217:4782
3945cd6c-7a48-4953-891b-b572e6546d28
-
encryption_key
0424D13FAB664773413CCE167A339263D182142D
-
install_name
Sigma.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Javaxxx
-
subdirectory
SubDir
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1716-1-0x00000000001E0000-0x0000000000504000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Sigma.exe family_quasar behavioral1/memory/2056-8-0x0000000001110000-0x0000000001434000-memory.dmp family_quasar -
Detects Windows executables referencing non-Windows User-Agents 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1716-1-0x00000000001E0000-0x0000000000504000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\AppData\Roaming\SubDir\Sigma.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2056-8-0x0000000001110000-0x0000000001434000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1716-1-0x00000000001E0000-0x0000000000504000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers C:\Users\Admin\AppData\Roaming\SubDir\Sigma.exe INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2056-8-0x0000000001110000-0x0000000001434000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables containing common artifacts observed in infostealers 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1716-1-0x00000000001E0000-0x0000000000504000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer C:\Users\Admin\AppData\Roaming\SubDir\Sigma.exe INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2056-8-0x0000000001110000-0x0000000001434000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer -
Executes dropped EXE 1 IoCs
Processes:
Sigma.exepid process 2056 Sigma.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2976 schtasks.exe 2676 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5a1c61fc913ba7293c85c7b4ad28e88f1683ec2158897eab5a5212d4059ab959.exeSigma.exedescription pid process Token: SeDebugPrivilege 1716 5a1c61fc913ba7293c85c7b4ad28e88f1683ec2158897eab5a5212d4059ab959.exe Token: SeDebugPrivilege 2056 Sigma.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
5a1c61fc913ba7293c85c7b4ad28e88f1683ec2158897eab5a5212d4059ab959.exeSigma.exedescription pid process target process PID 1716 wrote to memory of 2976 1716 5a1c61fc913ba7293c85c7b4ad28e88f1683ec2158897eab5a5212d4059ab959.exe schtasks.exe PID 1716 wrote to memory of 2976 1716 5a1c61fc913ba7293c85c7b4ad28e88f1683ec2158897eab5a5212d4059ab959.exe schtasks.exe PID 1716 wrote to memory of 2976 1716 5a1c61fc913ba7293c85c7b4ad28e88f1683ec2158897eab5a5212d4059ab959.exe schtasks.exe PID 1716 wrote to memory of 2056 1716 5a1c61fc913ba7293c85c7b4ad28e88f1683ec2158897eab5a5212d4059ab959.exe Sigma.exe PID 1716 wrote to memory of 2056 1716 5a1c61fc913ba7293c85c7b4ad28e88f1683ec2158897eab5a5212d4059ab959.exe Sigma.exe PID 1716 wrote to memory of 2056 1716 5a1c61fc913ba7293c85c7b4ad28e88f1683ec2158897eab5a5212d4059ab959.exe Sigma.exe PID 2056 wrote to memory of 2676 2056 Sigma.exe schtasks.exe PID 2056 wrote to memory of 2676 2056 Sigma.exe schtasks.exe PID 2056 wrote to memory of 2676 2056 Sigma.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a1c61fc913ba7293c85c7b4ad28e88f1683ec2158897eab5a5212d4059ab959.exe"C:\Users\Admin\AppData\Local\Temp\5a1c61fc913ba7293c85c7b4ad28e88f1683ec2158897eab5a5212d4059ab959.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Javaxxx" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Sigma.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\SubDir\Sigma.exe"C:\Users\Admin\AppData\Roaming\SubDir\Sigma.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Javaxxx" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Sigma.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\Sigma.exeFilesize
3.1MB
MD54f107e95a9c20b41ef4e602ec661d3f1
SHA1429db6828d2152b818f5db9f0574e867dcaf2f6b
SHA2565a1c61fc913ba7293c85c7b4ad28e88f1683ec2158897eab5a5212d4059ab959
SHA512b8bc51d250bd443347a52211b4bb1075c8a7b89d3e190d0efd093b3f74e7d2e2c041eaea62798484ab0a9d7da4a81c62f42172b6dacd190bd5a54de706b75f13
-
memory/1716-0-0x000007FEF5CE3000-0x000007FEF5CE4000-memory.dmpFilesize
4KB
-
memory/1716-1-0x00000000001E0000-0x0000000000504000-memory.dmpFilesize
3.1MB
-
memory/1716-2-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmpFilesize
9.9MB
-
memory/1716-7-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmpFilesize
9.9MB
-
memory/2056-8-0x0000000001110000-0x0000000001434000-memory.dmpFilesize
3.1MB
-
memory/2056-9-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmpFilesize
9.9MB
-
memory/2056-10-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmpFilesize
9.9MB
-
memory/2056-11-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmpFilesize
9.9MB