Analysis
-
max time kernel
126s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 03:48
Behavioral task
behavioral1
Sample
cf1095129f08d9ac4235e307c45992d4.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
cf1095129f08d9ac4235e307c45992d4.exe
Resource
win10v2004-20240508-en
General
-
Target
cf1095129f08d9ac4235e307c45992d4.exe
-
Size
409KB
-
MD5
cf1095129f08d9ac4235e307c45992d4
-
SHA1
e452600b185b20b5aca7f277b20ee0ac283caa9a
-
SHA256
0ae8715511cac160bace9f8cc6d042de274573159d077846598c1626bd6b0d3d
-
SHA512
d55fa2399c2c566a32d7f6ae7c67db5b7be344e129f76e731298236b7d41639146b1dd120dc79b5fcd2ff261405423505c5d6604353b1736b10c82b8440d5df1
-
SSDEEP
12288:RpsD64e1MvzNU2hcPPHXN/x8N619mUBecXKe:vsG4kMThcPPHXD9NBT
Malware Config
Extracted
quasar
3.1.5
SeroXen | v3.1.5 |
hardware-morgan.gl.at.ply.gg:49331
$Sxr-jy6vh8CtEJL5ceZuIb
-
encryption_key
KNgpj87CUPQcxCMhHO0S
-
install_name
$sxr-powershell.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
-
startup_key
Powershell
-
subdirectory
$sxr-seroxen2
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1492-1-0x0000000000370000-0x00000000003DC000-memory.dmp family_quasar -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cf1095129f08d9ac4235e307c45992d4.exedescription pid process Token: SeDebugPrivilege 1492 cf1095129f08d9ac4235e307c45992d4.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cf1095129f08d9ac4235e307c45992d4.exepid process 1492 cf1095129f08d9ac4235e307c45992d4.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1492-0-0x0000000074E2E000-0x0000000074E2F000-memory.dmpFilesize
4KB
-
memory/1492-1-0x0000000000370000-0x00000000003DC000-memory.dmpFilesize
432KB
-
memory/1492-2-0x0000000074E20000-0x000000007550E000-memory.dmpFilesize
6.9MB
-
memory/1492-4-0x0000000074E2E000-0x0000000074E2F000-memory.dmpFilesize
4KB
-
memory/1492-5-0x0000000074E20000-0x000000007550E000-memory.dmpFilesize
6.9MB