Analysis
-
max time kernel
92s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 04:48
Static task
static1
Behavioral task
behavioral1
Sample
f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe
Resource
win7-20240221-en
General
-
Target
f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe
-
Size
3.2MB
-
MD5
e9ed2adca7e63a58d0895179fc1e121f
-
SHA1
ae23767acd8d4a88b7c69d84e4df5f9733653662
-
SHA256
f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7
-
SHA512
7fc5de0e2d85c85592ff935faa5ffa10e33615c8b2d274d28c322764706c2847ee40a9f15c3867cf278981fe2ac3778cbb9b3bd400f6c4064691f9c7c9ff51b0
-
SSDEEP
98304:visDo5sRzG+RVgbtHSB2MqlcY+kd4204+N1o:6uRq+8btHSdA/N
Malware Config
Extracted
quasar
1.4.1
Stereo
nickhill112-30910.portmap.host:30910
c93b672f-8b8c-48b8-a712-e952d64b741a
-
encryption_key
985DB7D034DB1B5D52F524873569DDDE4080F31C
-
install_name
Stereo.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
update.exe
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3588-45-0x0000000000400000-0x0000000000726000-memory.dmp family_quasar -
Detects .NET executables utilizing NyanX-CAT C# Loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4052-1-0x0000000000D30000-0x0000000001066000-memory.dmp INDICATOR_EXE_Packed_NyanXCat_CSharpLoader behavioral2/memory/3152-13-0x0000000000400000-0x000000000072C000-memory.dmp INDICATOR_EXE_Packed_NyanXCat_CSharpLoader -
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3588-45-0x0000000000400000-0x0000000000726000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3588-45-0x0000000000400000-0x0000000000726000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables containing common artifacts observed in infostealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3588-45-0x0000000000400000-0x0000000000726000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer -
Executes dropped EXE 1 IoCs
Processes:
Stereo.exepid process 2688 Stereo.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exeRegSvcs.exedescription pid process target process PID 4052 set thread context of 3152 4052 f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe RegSvcs.exe PID 3152 set thread context of 3588 3152 RegSvcs.exe RegAsm.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exeRegSvcs.exepid process 432 powershell.exe 432 powershell.exe 3152 RegSvcs.exe 3152 RegSvcs.exe 3152 RegSvcs.exe 3152 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeRegSvcs.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 432 powershell.exe Token: SeDebugPrivilege 3152 RegSvcs.exe Token: SeDebugPrivilege 3588 RegAsm.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exeRegSvcs.exeRegAsm.exedescription pid process target process PID 4052 wrote to memory of 432 4052 f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe powershell.exe PID 4052 wrote to memory of 432 4052 f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe powershell.exe PID 4052 wrote to memory of 432 4052 f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe powershell.exe PID 4052 wrote to memory of 3152 4052 f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe RegSvcs.exe PID 4052 wrote to memory of 3152 4052 f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe RegSvcs.exe PID 4052 wrote to memory of 3152 4052 f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe RegSvcs.exe PID 4052 wrote to memory of 3152 4052 f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe RegSvcs.exe PID 4052 wrote to memory of 3152 4052 f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe RegSvcs.exe PID 4052 wrote to memory of 3152 4052 f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe RegSvcs.exe PID 4052 wrote to memory of 3152 4052 f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe RegSvcs.exe PID 4052 wrote to memory of 3152 4052 f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe RegSvcs.exe PID 3152 wrote to memory of 1960 3152 RegSvcs.exe RegAsm.exe PID 3152 wrote to memory of 1960 3152 RegSvcs.exe RegAsm.exe PID 3152 wrote to memory of 1960 3152 RegSvcs.exe RegAsm.exe PID 3152 wrote to memory of 1804 3152 RegSvcs.exe RegAsm.exe PID 3152 wrote to memory of 1804 3152 RegSvcs.exe RegAsm.exe PID 3152 wrote to memory of 1804 3152 RegSvcs.exe RegAsm.exe PID 3152 wrote to memory of 3588 3152 RegSvcs.exe RegAsm.exe PID 3152 wrote to memory of 3588 3152 RegSvcs.exe RegAsm.exe PID 3152 wrote to memory of 3588 3152 RegSvcs.exe RegAsm.exe PID 3152 wrote to memory of 3588 3152 RegSvcs.exe RegAsm.exe PID 3152 wrote to memory of 3588 3152 RegSvcs.exe RegAsm.exe PID 3152 wrote to memory of 3588 3152 RegSvcs.exe RegAsm.exe PID 3152 wrote to memory of 3588 3152 RegSvcs.exe RegAsm.exe PID 3152 wrote to memory of 3588 3152 RegSvcs.exe RegAsm.exe PID 3588 wrote to memory of 3612 3588 RegAsm.exe schtasks.exe PID 3588 wrote to memory of 3612 3588 RegAsm.exe schtasks.exe PID 3588 wrote to memory of 3612 3588 RegAsm.exe schtasks.exe PID 3588 wrote to memory of 2688 3588 RegAsm.exe Stereo.exe PID 3588 wrote to memory of 2688 3588 RegAsm.exe Stereo.exe PID 3588 wrote to memory of 2688 3588 RegAsm.exe Stereo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe"C:\Users\Admin\AppData\Local\Temp\f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '' -Value '"C:\Users\Admin\AppData\Roaming\.exe"' -PropertyType 'String'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "update.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Stereo.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\SubDir\Stereo.exe"C:\Users\Admin\AppData\Roaming\SubDir\Stereo.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s1tcl3o5.mgz.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\SubDir\Stereo.exeFilesize
63KB
MD50d5df43af2916f47d00c1573797c1a13
SHA1230ab5559e806574d26b4c20847c368ed55483b0
SHA256c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
-
memory/432-39-0x00000000067E0000-0x0000000006802000-memory.dmpFilesize
136KB
-
memory/432-24-0x0000000005450000-0x00000000054B6000-memory.dmpFilesize
408KB
-
memory/432-20-0x0000000074780000-0x0000000074F30000-memory.dmpFilesize
7.7MB
-
memory/432-23-0x00000000053E0000-0x0000000005446000-memory.dmpFilesize
408KB
-
memory/432-30-0x0000000005B80000-0x0000000005ED4000-memory.dmpFilesize
3.3MB
-
memory/432-22-0x0000000005340000-0x0000000005362000-memory.dmpFilesize
136KB
-
memory/432-36-0x00000000066F0000-0x000000000673C000-memory.dmpFilesize
304KB
-
memory/432-42-0x0000000074780000-0x0000000074F30000-memory.dmpFilesize
7.7MB
-
memory/432-38-0x0000000006790000-0x00000000067AA000-memory.dmpFilesize
104KB
-
memory/432-12-0x00000000029B0000-0x00000000029E6000-memory.dmpFilesize
216KB
-
memory/432-37-0x00000000074E0000-0x0000000007576000-memory.dmpFilesize
600KB
-
memory/432-14-0x0000000074780000-0x0000000074F30000-memory.dmpFilesize
7.7MB
-
memory/432-16-0x00000000054D0000-0x0000000005AF8000-memory.dmpFilesize
6.2MB
-
memory/432-35-0x00000000062D0000-0x00000000062EE000-memory.dmpFilesize
120KB
-
memory/432-17-0x0000000074780000-0x0000000074F30000-memory.dmpFilesize
7.7MB
-
memory/2688-54-0x0000000000190000-0x00000000001A2000-memory.dmpFilesize
72KB
-
memory/3152-18-0x0000000074780000-0x0000000074F30000-memory.dmpFilesize
7.7MB
-
memory/3152-13-0x0000000000400000-0x000000000072C000-memory.dmpFilesize
3.2MB
-
memory/3152-43-0x0000000074780000-0x0000000074F30000-memory.dmpFilesize
7.7MB
-
memory/3152-44-0x00000000060C0000-0x00000000063EA000-memory.dmpFilesize
3.2MB
-
memory/3152-47-0x0000000074780000-0x0000000074F30000-memory.dmpFilesize
7.7MB
-
memory/3152-21-0x0000000074780000-0x0000000074F30000-memory.dmpFilesize
7.7MB
-
memory/3588-45-0x0000000000400000-0x0000000000726000-memory.dmpFilesize
3.1MB
-
memory/4052-5-0x0000000005B10000-0x0000000005B1A000-memory.dmpFilesize
40KB
-
memory/4052-2-0x00000000060E0000-0x0000000006684000-memory.dmpFilesize
5.6MB
-
memory/4052-0-0x000000007478E000-0x000000007478F000-memory.dmpFilesize
4KB
-
memory/4052-7-0x000000007478E000-0x000000007478F000-memory.dmpFilesize
4KB
-
memory/4052-3-0x0000000005A50000-0x0000000005AE2000-memory.dmpFilesize
584KB
-
memory/4052-19-0x0000000074780000-0x0000000074F30000-memory.dmpFilesize
7.7MB
-
memory/4052-10-0x0000000006090000-0x00000000060AE000-memory.dmpFilesize
120KB
-
memory/4052-9-0x0000000005D40000-0x000000000606E000-memory.dmpFilesize
3.2MB
-
memory/4052-8-0x0000000074780000-0x0000000074F30000-memory.dmpFilesize
7.7MB
-
memory/4052-6-0x0000000005CC0000-0x0000000005D36000-memory.dmpFilesize
472KB
-
memory/4052-4-0x0000000074780000-0x0000000074F30000-memory.dmpFilesize
7.7MB
-
memory/4052-1-0x0000000000D30000-0x0000000001066000-memory.dmpFilesize
3.2MB