quasar | 758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e

General

Target
758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe
Size 3.0MB
Sample201109-hs97vmf7c2
SHA256 758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e
MD5 a7c6d51e2d25248a53fbb968015c2fa9
SHA1 b1b4116e6a8916e952dc3a9d1c00777a56d59ec1
SHA512 8b0d0f57fca53c84156cb2b1e351d2943dea1bcbb14a6aab59de9f7f19070572b93d41e0b0b1966c8857c58efbde13b736e33a6e270a9eaff59083c7b0e58e33
MD5 SHA1 SHA512

Score

10^/10

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Executes dropped EXE 1 IoCs

pid	Process
464	Defender.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Defender.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Defender.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Wine	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe
Key opened	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Wine	Defender.exe

Loads dropped DLL 1 IoCs

pid	Process
1924	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1924	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe
464	Defender.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\Defender.exe	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\Defender.exe	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\Defender.exe	Defender.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1184	schtasks.exe
1608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1924	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe
464	Defender.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1924	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe
Token: SeDebugPrivilege	464	Defender.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1184	1924	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe	30
PID 1924 wrote to memory of 1184	1924	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe	30
PID 1924 wrote to memory of 1184	1924	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe	30
PID 1924 wrote to memory of 1184	1924	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe	30
PID 1924 wrote to memory of 464	1924	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe	32
PID 1924 wrote to memory of 464	1924	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe	32
PID 1924 wrote to memory of 464	1924	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe	32
PID 1924 wrote to memory of 464	1924	758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe	32
PID 464 wrote to memory of 1608	464	Defender.exe	33
PID 464 wrote to memory of 1608	464	Defender.exe	33
PID 464 wrote to memory of 1608	464	Defender.exe	33
PID 464 wrote to memory of 1608	464	Defender.exe	33

C:\Users\Admin\AppData\Local\Temp\758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe
"C:\Users\Admin\AppData\Local\Temp\758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe"
1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\758c9e9642b467c181548b07d7d47e32e2e37ce7298e0d89674fdbcbe13eb50e.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1184
- C:\Program Files (x86)\Windows Defender\Defender.exe
  "C:\Program Files (x86)\Windows Defender\Defender.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Program Files (x86)\Windows Defender\Defender.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1608