quasar | a7e7de656010612d8f5741491c7f5e4480d8face10c5f1c445fdfda6d70b4908

Analysis

max time kernel
139s
max time network
139s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Qoutation order34323892.exe
Size 580KB
Sample201109-vfydpanfbx
SHA256 a7e7de656010612d8f5741491c7f5e4480d8face10c5f1c445fdfda6d70b4908
MD5 081fb4b7f8a59eaba1704f9009da7443
SHA1 d37d48c1da18c1f5d055e747bc6e36d2c6e1cfad
SHA512 28c8a1ffac0b8e036d43140534c738eff329dddfa4ae0aebc4433b7228b49c808ba8a66ffec460f1a1d02bd70ac15256113e8a7f837d01576e55504191739309
MD5 SHA1 SHA512

Score

10^/10

quasar coreentity persistence rezer0 spyware trojan

Malware Config

Signatures

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

resource	yara_rule
behavioral2/memory/4684-7-0x0000000004FC0000-0x0000000004FC3000-memory.dmp	coreentity

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

ServiceHost packer 18 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/2504-63-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-62-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-64-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-65-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-66-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-67-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-68-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-69-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-70-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-71-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-72-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-73-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-74-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-76-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-77-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-75-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-78-0x000000000044943E-mapping.dmp	servicehost
behavioral2/memory/2504-79-0x000000000044943E-mapping.dmp	servicehost

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral2/memory/4684-8-0x000000000A320000-0x000000000A370000-memory.dmp	rezer0

Executes dropped EXE 8 IoCs

pid	Process
1412	Client9w.exe
2504	Client9w.exe
984	Client9w.exe
2160	Client9w.exe
3740	Client9w.exe
4900	Client9w.exe
3832	Client9w.exe
2196	Client9w.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quasat Client Startup = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client9w.exe\""	Client9w.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com

Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4684 set thread context of 3188	4684	Qoutation order34323892.exe	78
PID 1412 set thread context of 2504	1412	Client9w.exe	86
PID 984 set thread context of 4900	984	Client9w.exe	103
PID 3832 set thread context of 2196	3832	Client9w.exe	107

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4660	2504	WerFault.exe	86

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2144	schtasks.exe
4036	schtasks.exe
1776	schtasks.exe
3892	schtasks.exe
4240	schtasks.exe
3992	schtasks.exe
992	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4640	PING.EXE

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4684	Qoutation order34323892.exe
4684	Qoutation order34323892.exe
4684	Qoutation order34323892.exe
4684	Qoutation order34323892.exe
4684	Qoutation order34323892.exe
4684	Qoutation order34323892.exe
1412	Client9w.exe
1412	Client9w.exe
1412	Client9w.exe
4660	WerFault.exe
4660	WerFault.exe
4660	WerFault.exe
4660	WerFault.exe
4660	WerFault.exe
4660	WerFault.exe
4660	WerFault.exe
4660	WerFault.exe
4660	WerFault.exe
4660	WerFault.exe
4660	WerFault.exe
4660	WerFault.exe
4660	WerFault.exe
4660	WerFault.exe
4660	WerFault.exe
984	Client9w.exe
984	Client9w.exe
2160	Client9w.exe
2160	Client9w.exe
2160	Client9w.exe
984	Client9w.exe
984	Client9w.exe
984	Client9w.exe
3832	Client9w.exe
3832	Client9w.exe
3832	Client9w.exe
3832	Client9w.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4684	Qoutation order34323892.exe
Token: SeDebugPrivilege	3188	Qoutation order34323892.exe
Token: SeDebugPrivilege	1412	Client9w.exe
Token: SeDebugPrivilege	2504	Client9w.exe
Token: SeRestorePrivilege	4660	WerFault.exe
Token: SeBackupPrivilege	4660	WerFault.exe
Token: SeDebugPrivilege	4660	WerFault.exe
Token: SeDebugPrivilege	984	Client9w.exe
Token: SeDebugPrivilege	2160	Client9w.exe
Token: SeDebugPrivilege	3832	Client9w.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2504	Client9w.exe

Suspicious use of WriteProcessMemory 74 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 3992	4684	Qoutation order34323892.exe	75
PID 4684 wrote to memory of 3992	4684	Qoutation order34323892.exe	75
PID 4684 wrote to memory of 3992	4684	Qoutation order34323892.exe	75
PID 4684 wrote to memory of 3848	4684	Qoutation order34323892.exe	77
PID 4684 wrote to memory of 3848	4684	Qoutation order34323892.exe	77
PID 4684 wrote to memory of 3848	4684	Qoutation order34323892.exe	77
PID 4684 wrote to memory of 3188	4684	Qoutation order34323892.exe	78
PID 4684 wrote to memory of 3188	4684	Qoutation order34323892.exe	78
PID 4684 wrote to memory of 3188	4684	Qoutation order34323892.exe	78
PID 4684 wrote to memory of 3188	4684	Qoutation order34323892.exe	78
PID 4684 wrote to memory of 3188	4684	Qoutation order34323892.exe	78
PID 4684 wrote to memory of 3188	4684	Qoutation order34323892.exe	78
PID 4684 wrote to memory of 3188	4684	Qoutation order34323892.exe	78
PID 4684 wrote to memory of 3188	4684	Qoutation order34323892.exe	78
PID 3188 wrote to memory of 992	3188	Qoutation order34323892.exe	79
PID 3188 wrote to memory of 992	3188	Qoutation order34323892.exe	79
PID 3188 wrote to memory of 992	3188	Qoutation order34323892.exe	79
PID 3188 wrote to memory of 1412	3188	Qoutation order34323892.exe	83
PID 3188 wrote to memory of 1412	3188	Qoutation order34323892.exe	83
PID 3188 wrote to memory of 1412	3188	Qoutation order34323892.exe	83
PID 1412 wrote to memory of 2144	1412	Client9w.exe	84
PID 1412 wrote to memory of 2144	1412	Client9w.exe	84
PID 1412 wrote to memory of 2144	1412	Client9w.exe	84
PID 1412 wrote to memory of 2504	1412	Client9w.exe	86
PID 1412 wrote to memory of 2504	1412	Client9w.exe	86
PID 1412 wrote to memory of 2504	1412	Client9w.exe	86
PID 1412 wrote to memory of 2504	1412	Client9w.exe	86
PID 1412 wrote to memory of 2504	1412	Client9w.exe	86
PID 1412 wrote to memory of 2504	1412	Client9w.exe	86
PID 1412 wrote to memory of 2504	1412	Client9w.exe	86
PID 1412 wrote to memory of 2504	1412	Client9w.exe	86
PID 2504 wrote to memory of 4036	2504	Client9w.exe	88
PID 2504 wrote to memory of 4036	2504	Client9w.exe	88
PID 2504 wrote to memory of 4036	2504	Client9w.exe	88
PID 2504 wrote to memory of 1776	2504	Client9w.exe	90
PID 2504 wrote to memory of 1776	2504	Client9w.exe	90
PID 2504 wrote to memory of 1776	2504	Client9w.exe	90
PID 2504 wrote to memory of 4496	2504	Client9w.exe	92
PID 2504 wrote to memory of 4496	2504	Client9w.exe	92
PID 2504 wrote to memory of 4496	2504	Client9w.exe	92
PID 4496 wrote to memory of 4512	4496	cmd.exe	94
PID 4496 wrote to memory of 4512	4496	cmd.exe	94
PID 4496 wrote to memory of 4512	4496	cmd.exe	94
PID 4496 wrote to memory of 4640	4496	cmd.exe	96
PID 4496 wrote to memory of 4640	4496	cmd.exe	96
PID 4496 wrote to memory of 4640	4496	cmd.exe	96
PID 4496 wrote to memory of 984	4496	cmd.exe	98
PID 4496 wrote to memory of 984	4496	cmd.exe	98
PID 4496 wrote to memory of 984	4496	cmd.exe	98
PID 984 wrote to memory of 3892	984	Client9w.exe	100
PID 984 wrote to memory of 3892	984	Client9w.exe	100
PID 984 wrote to memory of 3892	984	Client9w.exe	100
PID 984 wrote to memory of 3740	984	Client9w.exe	102
PID 984 wrote to memory of 3740	984	Client9w.exe	102
PID 984 wrote to memory of 3740	984	Client9w.exe	102
PID 984 wrote to memory of 4900	984	Client9w.exe	103
PID 984 wrote to memory of 4900	984	Client9w.exe	103
PID 984 wrote to memory of 4900	984	Client9w.exe	103
PID 984 wrote to memory of 4900	984	Client9w.exe	103
PID 984 wrote to memory of 4900	984	Client9w.exe	103
PID 984 wrote to memory of 4900	984	Client9w.exe	103
PID 984 wrote to memory of 4900	984	Client9w.exe	103
PID 984 wrote to memory of 4900	984	Client9w.exe	103
PID 3832 wrote to memory of 4240	3832	Client9w.exe	105
PID 3832 wrote to memory of 4240	3832	Client9w.exe	105
PID 3832 wrote to memory of 4240	3832	Client9w.exe	105
PID 3832 wrote to memory of 2196	3832	Client9w.exe	107
PID 3832 wrote to memory of 2196	3832	Client9w.exe	107
PID 3832 wrote to memory of 2196	3832	Client9w.exe	107
PID 3832 wrote to memory of 2196	3832	Client9w.exe	107
PID 3832 wrote to memory of 2196	3832	Client9w.exe	107
PID 3832 wrote to memory of 2196	3832	Client9w.exe	107
PID 3832 wrote to memory of 2196	3832	Client9w.exe	107
PID 3832 wrote to memory of 2196	3832	Client9w.exe	107

C:\Users\Admin\AppData\Local\Temp\Qoutation order34323892.exe
"C:\Users\Admin\AppData\Local\Temp\Qoutation order34323892.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rDxwCNkmKn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp72E4.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3992
- C:\Users\Admin\AppData\Local\Temp\Qoutation order34323892.exe
  "{path}"
  2⤵
  PID:3848
- C:\Users\Admin\AppData\Local\Temp\Qoutation order34323892.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Quasat Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Qoutation order34323892.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:992
- - C:\Users\Admin\AppData\Roaming\SubDir\Client9w.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client9w.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rDxwCNkmKn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8D22.tmp"
      4⤵
      Creates scheduled task(s)
      PID:2144
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client9w.exe
      "{path}"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2504
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Quasat Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client9w.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:4036
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "WINDOWSSYSTEMHOST" /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client9w.exe" /sc MINUTE /MO 1
        5⤵
        Creates scheduled task(s)
        
        PID:1776
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C9IW1lZV63TB.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4496
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4512
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:4640
      - C:\Users\Admin\AppData\Roaming\SubDir\Client9w.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client9w.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:984
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rDxwCNkmKn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3D39.tmp"
        7⤵
        Creates scheduled task(s)
        
        PID:3892
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client9w.exe
        
        "{path}"
        7⤵
        Executes dropped EXE
        
        PID:3740
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client9w.exe
        
        "{path}"
        7⤵
        Executes dropped EXE
        
        PID:4900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 2228
        5⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4660

C:\Users\Admin\AppData\Roaming\SubDir\Client9w.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client9w.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Users\Admin\AppData\Roaming\SubDir\Client9w.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client9w.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rDxwCNkmKn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4419.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4240
- C:\Users\Admin\AppData\Roaming\SubDir\Client9w.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  PID:2196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/984-84-0x0000000073430000-0x0000000073B1E000-memory.dmp

Download

memory/1412-27-0x0000000073430000-0x0000000073B1E000-memory.dmp

Download

memory/2160-93-0x0000000073430000-0x0000000073B1E000-memory.dmp

Download

memory/2196-133-0x0000000073430000-0x0000000073B1E000-memory.dmp

Download

memory/2504-43-0x0000000073430000-0x0000000073B1E000-memory.dmp

Download

memory/3188-12-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/3188-20-0x00000000056F0000-0x00000000056F1000-memory.dmp

Download

memory/3188-15-0x0000000073430000-0x0000000073B1E000-memory.dmp

Download

memory/3188-22-0x0000000006780000-0x0000000006781000-memory.dmp

Download

memory/3188-21-0x0000000006250000-0x0000000006251000-memory.dmp

Download

memory/3832-118-0x0000000073430000-0x0000000073B1E000-memory.dmp

Download

memory/4660-59-0x00000000045A0000-0x00000000045A1000-memory.dmp

Download

memory/4660-58-0x00000000045A0000-0x00000000045A1000-memory.dmp

Download

memory/4660-80-0x0000000004A60000-0x0000000004A61000-memory.dmp

Download

memory/4684-0-0x0000000073430000-0x0000000073B1E000-memory.dmp

Download

memory/4684-7-0x0000000004FC0000-0x0000000004FC3000-memory.dmp

Download

memory/4684-6-0x0000000007E40000-0x0000000007E41000-memory.dmp

Download

memory/4684-8-0x000000000A320000-0x000000000A370000-memory.dmp

Download

memory/4684-9-0x000000000A420000-0x000000000A421000-memory.dmp

Download

memory/4684-5-0x0000000007E70000-0x0000000007E71000-memory.dmp

Download

memory/4684-4-0x0000000008150000-0x0000000008151000-memory.dmp

Download

memory/4684-3-0x00000000079B0000-0x0000000007A04000-memory.dmp

Download

memory/4684-1-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4900-111-0x0000000073430000-0x0000000073B1E000-memory.dmp

Download