quasar | a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452

General

Target

a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe
Size

1.2MB
MD5

b7c64961404b11332ce76a067eb3d1d0
SHA1

7781a5b8c7d8f318514188d67b50000bcd022dfc
SHA256

a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452
SHA512

72a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6

Score

10^/10

quasar persistence spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Executes dropped EXE 2 IoCs

Processes:

wsapx.exewsapx.exe

pid process

940 wsapx.exe
2452 wsapx.exe

pid	process
940	wsapx.exe
2452	wsapx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wsapx.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\wsapx = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\wsapx.exe\""	wsapx.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3180 940 WerFault.exe wsapx.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2284 schtasks.exe
648 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3184 PING.EXE

flow	ioc
10	ip-api.com

pid	pid_target	process	target process
3180	940	WerFault.exe	wsapx.exe

pid	process
2284	schtasks.exe
648	schtasks.exe

pid	process
3184	PING.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

pid	process
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exewsapx.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	1032	a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe
Token: SeDebugPrivilege	940	wsapx.exe
Token: SeRestorePrivilege	3180	WerFault.exe
Token: SeBackupPrivilege	3180	WerFault.exe
Token: SeDebugPrivilege	3180	WerFault.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

wsapx.exe

pid process

940 wsapx.exe

pid	process
940	wsapx.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exewsapx.execmd.exe

description	pid	process	target process
PID 1032 wrote to memory of 2284	1032	a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe	schtasks.exe
PID 1032 wrote to memory of 2284	1032	a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe	schtasks.exe
PID 1032 wrote to memory of 2284	1032	a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe	schtasks.exe
PID 1032 wrote to memory of 940	1032	a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe	wsapx.exe
PID 1032 wrote to memory of 940	1032	a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe	wsapx.exe
PID 1032 wrote to memory of 940	1032	a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe	wsapx.exe
PID 940 wrote to memory of 648	940	wsapx.exe	schtasks.exe
PID 940 wrote to memory of 648	940	wsapx.exe	schtasks.exe
PID 940 wrote to memory of 648	940	wsapx.exe	schtasks.exe
PID 940 wrote to memory of 3960	940	wsapx.exe	cmd.exe
PID 940 wrote to memory of 3960	940	wsapx.exe	cmd.exe
PID 940 wrote to memory of 3960	940	wsapx.exe	cmd.exe
PID 3960 wrote to memory of 2592	3960	cmd.exe	chcp.com
PID 3960 wrote to memory of 2592	3960	cmd.exe	chcp.com
PID 3960 wrote to memory of 2592	3960	cmd.exe	chcp.com
PID 3960 wrote to memory of 3184	3960	cmd.exe	PING.EXE
PID 3960 wrote to memory of 3184	3960	cmd.exe	PING.EXE
PID 3960 wrote to memory of 3184	3960	cmd.exe	PING.EXE
PID 3960 wrote to memory of 2452	3960	cmd.exe	wsapx.exe
PID 3960 wrote to memory of 2452	3960	cmd.exe	wsapx.exe
PID 3960 wrote to memory of 2452	3960	cmd.exe	wsapx.exe

C:\Users\Admin\AppData\Local\Temp\a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe
"C:\Users\Admin\AppData\Local\Temp\a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "wsapx" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2284

C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe
"C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "wsapx" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:648

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ydK6WMkAwEZB.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:3960

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:2592

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:3184

C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe
"C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe"
4⤵
- Executes dropped EXE
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 2208
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ydK6WMkAwEZB.bat
MD5
c97e2ab647d7d834cdc3bdae3d1a9810

SHA1
d006e6ec41a5d3a33c431f3c1e55658c4cd0ea6a

SHA256
df6a5542656b81042d5ebd45c8f7ee02aadcff15349b1a1b755ea7264e0d3c7e

SHA512
6e71f3c051725baa231f2dc2046b91450de4369b0871a3cbc72c23a1341b27e1a08bc556cc1faf4a38b86e2ea0f143d702444ff1fa7828107e4e126ce9549e62

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe
MD5
b7c64961404b11332ce76a067eb3d1d0

SHA1
7781a5b8c7d8f318514188d67b50000bcd022dfc

SHA256
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452

SHA512
72a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe
MD5
b7c64961404b11332ce76a067eb3d1d0

SHA1
7781a5b8c7d8f318514188d67b50000bcd022dfc

SHA256
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452

SHA512
72a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\wsapx.exe
MD5
b7c64961404b11332ce76a067eb3d1d0

SHA1
7781a5b8c7d8f318514188d67b50000bcd022dfc

SHA256
a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452

SHA512
72a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6

Download Submit
memory/648-26-0x0000000000000000-mapping.dmp

Download
memory/940-13-0x0000000000000000-mapping.dmp

Download
memory/940-28-0x0000000006410000-0x0000000006411000-memory.dmp

Filesize
4KB

Download
memory/940-27-0x0000000006490000-0x0000000006491000-memory.dmp

Filesize
4KB

Download
memory/940-23-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/940-16-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/1032-9-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/1032-5-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/1032-11-0x00000000066D0000-0x00000000066D1000-memory.dmp

Filesize
4KB

Download
memory/1032-10-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/1032-2-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/1032-8-0x0000000005970000-0x0000000005971000-memory.dmp

Filesize
4KB

Download
memory/1032-7-0x00000000053D0000-0x00000000053D1000-memory.dmp

Filesize
4KB

Download
memory/1032-6-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/1032-3-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/2284-12-0x0000000000000000-mapping.dmp

Download
memory/2452-34-0x0000000000000000-mapping.dmp

Download
memory/2452-36-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/2452-43-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/2592-31-0x0000000000000000-mapping.dmp

Download
memory/3180-33-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/3184-32-0x0000000000000000-mapping.dmp

Download
memory/3960-29-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads