Analysis
-
max time kernel
122s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
02-07-2024 17:43
Behavioral task
behavioral1
Sample
Uni.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Uni.exe
Resource
win10v2004-20240508-en
General
-
Target
Uni.exe
-
Size
348KB
-
MD5
d98814e594224fa06fb9bf4fbfc6ee90
-
SHA1
db74c6e773f5575b9b4b05ae206c21827f9bae57
-
SHA256
85a3c4d50a0e17ddc581206e4ac1a2f1220c16d562d6e894f5068972159ddca0
-
SHA512
3436b3f7c6dc4c7696ccc4d4efaebd9cada8f4d2ee9b711bbe523e26813919fb58a265ea3f3195c45dde3930f2995fc1951e387eab7437198ce060b97fce96ee
-
SSDEEP
6144:UzL3HRsM+OFZcZt3bfTGksNFbp1xzpCSgJuzKkgfzT:CVP+MMsNh97gJuzKkWzT
Malware Config
Extracted
quasar
15.5.0
SeroXen
paris-itself.gl.at.ply.gg:49485
QSR_MUTEX_9sjCnkSDYeXTl5L2qC
-
encryption_key
jKIJSX0QMuirSu2Asapm
-
install_name
$sxr-powershell.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
-
startup_key
Taskmgr
-
subdirectory
$sxr-seroxen2
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral3/memory/4200-1-0x0000000000020000-0x000000000007E000-memory.dmp family_quasar -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Uni.exedescription pid process Token: SeDebugPrivilege 4200 Uni.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Uni.exepid process 4200 Uni.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4200-0-0x0000000074EFE000-0x0000000074EFF000-memory.dmpFilesize
4KB
-
memory/4200-1-0x0000000000020000-0x000000000007E000-memory.dmpFilesize
376KB
-
memory/4200-2-0x00000000050C0000-0x0000000005666000-memory.dmpFilesize
5.6MB
-
memory/4200-3-0x0000000004C50000-0x0000000004CE2000-memory.dmpFilesize
584KB
-
memory/4200-4-0x0000000074EF0000-0x00000000756A1000-memory.dmpFilesize
7.7MB
-
memory/4200-5-0x0000000004BB0000-0x0000000004C16000-memory.dmpFilesize
408KB
-
memory/4200-6-0x0000000005870000-0x0000000005882000-memory.dmpFilesize
72KB
-
memory/4200-7-0x0000000005DA0000-0x0000000005DDC000-memory.dmpFilesize
240KB
-
memory/4200-9-0x0000000006120000-0x000000000612A000-memory.dmpFilesize
40KB
-
memory/4200-10-0x0000000074EFE000-0x0000000074EFF000-memory.dmpFilesize
4KB
-
memory/4200-11-0x0000000074EF0000-0x00000000756A1000-memory.dmpFilesize
7.7MB