Analysis
-
max time kernel
133s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
02-07-2024 17:42
Behavioral task
behavioral1
Sample
Uni.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Uni.exe
Resource
win10v2004-20240508-en
General
-
Target
Uni.exe
-
Size
348KB
-
MD5
d98814e594224fa06fb9bf4fbfc6ee90
-
SHA1
db74c6e773f5575b9b4b05ae206c21827f9bae57
-
SHA256
85a3c4d50a0e17ddc581206e4ac1a2f1220c16d562d6e894f5068972159ddca0
-
SHA512
3436b3f7c6dc4c7696ccc4d4efaebd9cada8f4d2ee9b711bbe523e26813919fb58a265ea3f3195c45dde3930f2995fc1951e387eab7437198ce060b97fce96ee
-
SSDEEP
6144:UzL3HRsM+OFZcZt3bfTGksNFbp1xzpCSgJuzKkgfzT:CVP+MMsNh97gJuzKkWzT
Malware Config
Extracted
quasar
15.5.0
SeroXen
paris-itself.gl.at.ply.gg:49485
QSR_MUTEX_9sjCnkSDYeXTl5L2qC
-
encryption_key
jKIJSX0QMuirSu2Asapm
-
install_name
$sxr-powershell.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
-
startup_key
Taskmgr
-
subdirectory
$sxr-seroxen2
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2192-1-0x0000000000400000-0x000000000045E000-memory.dmp family_quasar -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Uni.exedescription pid process Token: SeDebugPrivilege 2192 Uni.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Uni.exepid process 2192 Uni.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2192-0-0x00000000734DE000-0x00000000734DF000-memory.dmpFilesize
4KB
-
memory/2192-1-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/2192-2-0x00000000052C0000-0x00000000057BE000-memory.dmpFilesize
5.0MB
-
memory/2192-3-0x0000000004DC0000-0x0000000004E52000-memory.dmpFilesize
584KB
-
memory/2192-4-0x00000000734D0000-0x0000000073BBE000-memory.dmpFilesize
6.9MB
-
memory/2192-5-0x0000000004CD0000-0x0000000004D36000-memory.dmpFilesize
408KB
-
memory/2192-6-0x0000000005220000-0x0000000005232000-memory.dmpFilesize
72KB
-
memory/2192-7-0x0000000005D10000-0x0000000005D4E000-memory.dmpFilesize
248KB
-
memory/2192-9-0x0000000006190000-0x000000000619A000-memory.dmpFilesize
40KB
-
memory/2192-10-0x00000000734DE000-0x00000000734DF000-memory.dmpFilesize
4KB
-
memory/2192-11-0x00000000734D0000-0x0000000073BBE000-memory.dmpFilesize
6.9MB