Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2024 06:25
Behavioral task
behavioral1
Sample
a92b1b7ad45113f22a22e554d3b0521b2d1c10528ff6d541836cac16c0eddc26.exe
Resource
win7-20240508-en
General
-
Target
a92b1b7ad45113f22a22e554d3b0521b2d1c10528ff6d541836cac16c0eddc26.exe
-
Size
3.1MB
-
MD5
8499a3b1d99e207ebebbb8baafa0da1e
-
SHA1
df21c8f1385a708fd6d142db3c4af2f1417a4aa1
-
SHA256
a92b1b7ad45113f22a22e554d3b0521b2d1c10528ff6d541836cac16c0eddc26
-
SHA512
254362c9ca87f5dbd40578a26b8b3e44bc09d86d7f2351e46a8e7559d3d865b993d08d42c68b53222f713adf812b4a7ad32204c6f5a24e6eb59b718ff36dd8c5
-
SSDEEP
98304:Sv462XlaSFNWPjljiFXRoUYIwxj1uZsvi:UwZY5M6
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.6:4782
7e39441d-bf3c-4e76-b218-17218a11a5ae
-
encryption_key
4228EF6C98C943B084BBAB0B946094AB34DE7807
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Win32
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2704-1-0x0000000000B20000-0x0000000000E44000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Client.exepid process 4540 Client.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3112 schtasks.exe 4732 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a92b1b7ad45113f22a22e554d3b0521b2d1c10528ff6d541836cac16c0eddc26.exeClient.exedescription pid process Token: SeDebugPrivilege 2704 a92b1b7ad45113f22a22e554d3b0521b2d1c10528ff6d541836cac16c0eddc26.exe Token: SeDebugPrivilege 4540 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 4540 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a92b1b7ad45113f22a22e554d3b0521b2d1c10528ff6d541836cac16c0eddc26.exeClient.exedescription pid process target process PID 2704 wrote to memory of 4732 2704 a92b1b7ad45113f22a22e554d3b0521b2d1c10528ff6d541836cac16c0eddc26.exe schtasks.exe PID 2704 wrote to memory of 4732 2704 a92b1b7ad45113f22a22e554d3b0521b2d1c10528ff6d541836cac16c0eddc26.exe schtasks.exe PID 2704 wrote to memory of 4540 2704 a92b1b7ad45113f22a22e554d3b0521b2d1c10528ff6d541836cac16c0eddc26.exe Client.exe PID 2704 wrote to memory of 4540 2704 a92b1b7ad45113f22a22e554d3b0521b2d1c10528ff6d541836cac16c0eddc26.exe Client.exe PID 4540 wrote to memory of 3112 4540 Client.exe schtasks.exe PID 4540 wrote to memory of 3112 4540 Client.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a92b1b7ad45113f22a22e554d3b0521b2d1c10528ff6d541836cac16c0eddc26.exe"C:\Users\Admin\AppData\Local\Temp\a92b1b7ad45113f22a22e554d3b0521b2d1c10528ff6d541836cac16c0eddc26.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Win32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Win32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
3.1MB
MD58499a3b1d99e207ebebbb8baafa0da1e
SHA1df21c8f1385a708fd6d142db3c4af2f1417a4aa1
SHA256a92b1b7ad45113f22a22e554d3b0521b2d1c10528ff6d541836cac16c0eddc26
SHA512254362c9ca87f5dbd40578a26b8b3e44bc09d86d7f2351e46a8e7559d3d865b993d08d42c68b53222f713adf812b4a7ad32204c6f5a24e6eb59b718ff36dd8c5
-
memory/2704-0-0x00007FFCEE8A3000-0x00007FFCEE8A5000-memory.dmpFilesize
8KB
-
memory/2704-1-0x0000000000B20000-0x0000000000E44000-memory.dmpFilesize
3.1MB
-
memory/2704-2-0x00007FFCEE8A0000-0x00007FFCEF361000-memory.dmpFilesize
10.8MB
-
memory/2704-10-0x00007FFCEE8A0000-0x00007FFCEF361000-memory.dmpFilesize
10.8MB
-
memory/4540-9-0x00007FFCEE8A0000-0x00007FFCEF361000-memory.dmpFilesize
10.8MB
-
memory/4540-11-0x00007FFCEE8A0000-0x00007FFCEF361000-memory.dmpFilesize
10.8MB
-
memory/4540-12-0x000000001B970000-0x000000001B9C0000-memory.dmpFilesize
320KB
-
memory/4540-13-0x000000001C2D0000-0x000000001C382000-memory.dmpFilesize
712KB
-
memory/4540-14-0x00007FFCEE8A0000-0x00007FFCEF361000-memory.dmpFilesize
10.8MB