quasar | 2801e23864a2d65490e0ef7663d0d0e4292242f84d8368f0cdeefa868c375521

General

Target
KaWcg8Hm.exe
Size 348KB
Sample200913-1dasfhrj5e
SHA256 2801e23864a2d65490e0ef7663d0d0e4292242f84d8368f0cdeefa868c375521
MD5 cf2e2d8687103a7bde4a9ce4878e34d8
SHA1 82b22cadbb848b13087a925aa6cdedb44947d434
SHA512 b1265e5591605cc3777b72dfcf8ce6ecee26cfb95a065dcc71d67766d4669a314924b1dcce98253634913eb5fd1a75cbdcd6aba2b12344bf3dc61b207539c357
MD5 SHA1 SHA512

Score

10^/10

trojan spyware quasar

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Executes dropped EXE 1 IoCs

pid	Process
3464	Client.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3964	schtasks.exe
1476	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3840	PING.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	KaWcg8Hm.exe
Token: SeDebugPrivilege	3464	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3464	Client.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 3964	2608	KaWcg8Hm.exe	73
PID 2608 wrote to memory of 3964	2608	KaWcg8Hm.exe	73
PID 2608 wrote to memory of 3964	2608	KaWcg8Hm.exe	73
PID 2608 wrote to memory of 3464	2608	KaWcg8Hm.exe	75
PID 2608 wrote to memory of 3464	2608	KaWcg8Hm.exe	75
PID 2608 wrote to memory of 3464	2608	KaWcg8Hm.exe	75
PID 3464 wrote to memory of 1476	3464	Client.exe	78
PID 3464 wrote to memory of 1476	3464	Client.exe	78
PID 3464 wrote to memory of 1476	3464	Client.exe	78
PID 3464 wrote to memory of 1244	3464	Client.exe	81
PID 3464 wrote to memory of 1244	3464	Client.exe	81
PID 3464 wrote to memory of 1244	3464	Client.exe	81
PID 3464 wrote to memory of 3724	3464	Client.exe	83
PID 3464 wrote to memory of 3724	3464	Client.exe	83
PID 3464 wrote to memory of 3724	3464	Client.exe	83
PID 3724 wrote to memory of 3948	3724	cmd.exe	85
PID 3724 wrote to memory of 3948	3724	cmd.exe	85
PID 3724 wrote to memory of 3948	3724	cmd.exe	85
PID 3724 wrote to memory of 3840	3724	cmd.exe	86
PID 3724 wrote to memory of 3840	3724	cmd.exe	86
PID 3724 wrote to memory of 3840	3724	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\KaWcg8Hm.exe
"C:\Users\Admin\AppData\Local\Temp\KaWcg8Hm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "cmd.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\KaWcg8Hm.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3964
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "cmd.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1476
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /delete /tn "cmd.exe" /f
    3⤵
    PID:1244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\y7Fc71DqwzRP.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3724
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:3948
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:3840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2608-6-0x00000000063E0000-0x00000000063E1000-memory.dmp

Download

memory/2608-3-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

Download

memory/2608-1-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/2608-7-0x00000000067D0000-0x00000000067D1000-memory.dmp

Download

memory/2608-0-0x0000000073B30000-0x000000007421E000-memory.dmp

Download

memory/2608-4-0x00000000056A0000-0x00000000056A1000-memory.dmp

Download

memory/2608-5-0x0000000005740000-0x0000000005741000-memory.dmp

Download

memory/3464-21-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

Download

memory/3464-12-0x0000000073B30000-0x000000007421E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads