quasar | aa0a18dad402f0cfbd776899ece4ec642f451f8ad0ae5a5faa0682bf1ca21930

General

Target
46ee13b4e8a0cd58784a6845e271a00e.exe
Size 502KB
Sample211014-srbhsaagak
SHA256 aa0a18dad402f0cfbd776899ece4ec642f451f8ad0ae5a5faa0682bf1ca21930
MD5 46ee13b4e8a0cd58784a6845e271a00e
SHA1 0fcb8ab6ef5a684c15008c3781b20ab10f6b3188
SHA512 cb52bc645c463da2e5be80645ed59a7edd2f339bddf1c4589483118bd65cb26e886fffd9c69f8ae8d3040b6a962ff00c0e74a8745b2d4ef09edac6d1b1412a29
MD5 SHA1 SHA512

Score

10^/10

quasar user spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

User

C2

104.248.133.59:5424

Mutex

aa0abdaa-9f94-49b1-98c9-82424402f208

Attributes

encryption_key
EC9F3C0FB5E251141748405014C913865BAD4EE2
install_name
mga.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft Graphics Adapter
subdirectory
MicrosoftGraphicsAdapter

Signatures

Quasar Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000700000001221e-59.dat	family_quasar
behavioral1/files/0x000700000001221e-60.dat	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Executes dropped EXE 1 IoCs

pid	Process
1056	mga.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
664	schtasks.exe
1832	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	46ee13b4e8a0cd58784a6845e271a00e.exe
Token: SeDebugPrivilege	1056	mga.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1056	mga.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 664	2040	46ee13b4e8a0cd58784a6845e271a00e.exe	28
PID 2040 wrote to memory of 664	2040	46ee13b4e8a0cd58784a6845e271a00e.exe	28
PID 2040 wrote to memory of 664	2040	46ee13b4e8a0cd58784a6845e271a00e.exe	28
PID 2040 wrote to memory of 1056	2040	46ee13b4e8a0cd58784a6845e271a00e.exe	29
PID 2040 wrote to memory of 1056	2040	46ee13b4e8a0cd58784a6845e271a00e.exe	29
PID 2040 wrote to memory of 1056	2040	46ee13b4e8a0cd58784a6845e271a00e.exe	29
PID 1056 wrote to memory of 1832	1056	mga.exe	30
PID 1056 wrote to memory of 1832	1056	mga.exe	30
PID 1056 wrote to memory of 1832	1056	mga.exe	30

C:\Users\Admin\AppData\Local\Temp\46ee13b4e8a0cd58784a6845e271a00e.exe
"C:\Users\Admin\AppData\Local\Temp\46ee13b4e8a0cd58784a6845e271a00e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Microsoft Graphics Adapter" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\46ee13b4e8a0cd58784a6845e271a00e.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:664
- C:\Users\Admin\AppData\Roaming\MicrosoftGraphicsAdapter\mga.exe
  "C:\Users\Admin\AppData\Roaming\MicrosoftGraphicsAdapter\mga.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Microsoft Graphics Adapter" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\MicrosoftGraphicsAdapter\mga.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-61-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1056-63-0x000000001AE80000-0x000000001AE82000-memory.dmp

Download

memory/2040-54-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/2040-56-0x000000001A820000-0x000000001A822000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads