Analysis
-
max time kernel
125s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 01:57
Behavioral task
behavioral1
Sample
ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exe
Resource
win7-20240221-en
General
-
Target
ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exe
-
Size
3.1MB
-
MD5
1633db1ce0d5eae8b246019541b00372
-
SHA1
00b8f4ede2ca86fd53b3012e4a317318a20dd39b
-
SHA256
ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862
-
SHA512
3843b4ad7b2a6d7dd8220f4dd30952a3f6d9918c1391234d3fc2abfcd2adcfd33a6d161a9ad562df661149dedaf5b0589484eb053fdb35c3f41983066e22751a
-
SSDEEP
49152:rvzlL26AaNeWgPhlmVqvMQ7XSKY9BSPnaMYLowdseTHHB72eh2NT:rvpL26AaNeWgPhlmVqkQ7XSK+oPY
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.111:4782
1f5e43b0-2e6e-4529-bedf-628650591bdf
-
encryption_key
0FF1E4E83CF341CB74C4BB8B5D7980A41A9AF65B
-
install_name
DescryptMain.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1688-1-0x0000000000E70000-0x0000000001194000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\DescryptMain.exe family_quasar behavioral1/memory/2544-10-0x0000000000230000-0x0000000000554000-memory.dmp family_quasar -
Detects Windows executables referencing non-Windows User-Agents 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1688-1-0x0000000000E70000-0x0000000001194000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\AppData\Roaming\SubDir\DescryptMain.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2544-10-0x0000000000230000-0x0000000000554000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1688-1-0x0000000000E70000-0x0000000001194000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers C:\Users\Admin\AppData\Roaming\SubDir\DescryptMain.exe INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2544-10-0x0000000000230000-0x0000000000554000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables containing common artifacts observed in infostealers 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1688-1-0x0000000000E70000-0x0000000001194000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer C:\Users\Admin\AppData\Roaming\SubDir\DescryptMain.exe INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2544-10-0x0000000000230000-0x0000000000554000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer -
Executes dropped EXE 1 IoCs
Processes:
DescryptMain.exepid process 2544 DescryptMain.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2728 schtasks.exe 2976 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exeDescryptMain.exedescription pid process Token: SeDebugPrivilege 1688 ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exe Token: SeDebugPrivilege 2544 DescryptMain.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
DescryptMain.exepid process 2544 DescryptMain.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exeDescryptMain.exedescription pid process target process PID 1688 wrote to memory of 2728 1688 ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exe schtasks.exe PID 1688 wrote to memory of 2728 1688 ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exe schtasks.exe PID 1688 wrote to memory of 2728 1688 ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exe schtasks.exe PID 1688 wrote to memory of 2544 1688 ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exe DescryptMain.exe PID 1688 wrote to memory of 2544 1688 ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exe DescryptMain.exe PID 1688 wrote to memory of 2544 1688 ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exe DescryptMain.exe PID 2544 wrote to memory of 2976 2544 DescryptMain.exe schtasks.exe PID 2544 wrote to memory of 2976 2544 DescryptMain.exe schtasks.exe PID 2544 wrote to memory of 2976 2544 DescryptMain.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exe"C:\Users\Admin\AppData\Local\Temp\ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\DescryptMain.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\SubDir\DescryptMain.exe"C:\Users\Admin\AppData\Roaming\SubDir\DescryptMain.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\DescryptMain.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\DescryptMain.exeFilesize
3.1MB
MD51633db1ce0d5eae8b246019541b00372
SHA100b8f4ede2ca86fd53b3012e4a317318a20dd39b
SHA256ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862
SHA5123843b4ad7b2a6d7dd8220f4dd30952a3f6d9918c1391234d3fc2abfcd2adcfd33a6d161a9ad562df661149dedaf5b0589484eb053fdb35c3f41983066e22751a
-
memory/1688-0-0x000007FEF51A3000-0x000007FEF51A4000-memory.dmpFilesize
4KB
-
memory/1688-1-0x0000000000E70000-0x0000000001194000-memory.dmpFilesize
3.1MB
-
memory/1688-2-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmpFilesize
9.9MB
-
memory/1688-9-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmpFilesize
9.9MB
-
memory/2544-8-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmpFilesize
9.9MB
-
memory/2544-10-0x0000000000230000-0x0000000000554000-memory.dmpFilesize
3.1MB
-
memory/2544-11-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmpFilesize
9.9MB
-
memory/2544-12-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmpFilesize
9.9MB