quasar | 42e5b76705daee37d79456402795f0353bcd7eecbdcecfa863a5179dafe3c967

Analysis

max time kernel
126s
max time network
129s
platform
windows7_x64
resource
win7-en-20211208
submitted
31/01/2022, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dd8c70113c9c68b1eaafe290014e1037.exe
Size 38KB
Sample220131-pgmarahbbq
SHA256 42e5b76705daee37d79456402795f0353bcd7eecbdcecfa863a5179dafe3c967
MD5 dd8c70113c9c68b1eaafe290014e1037
SHA1 5a5ab0ffe753a9f278a44fc92f219cf7efd86b71
SHA512 59318d6850794a47a119cc17554febec6a9c8089d767f9c701b86329b2c375a08ebb598cf419ebba26060e105aae151e4d6e1c7d8cbb5f099410181e586a1b7e
MD5 SHA1 SHA512

Score

10^/10

quasar remote2 persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

remote2

thomasfunte.zapto.org:64779
yncesucesss.chickenkiller.com:64779

Mutex

QSR_MUTEX_5FdAa2wmL7UGj6r2Dg

Attributes

encryption_key
cTW0njX7Q1AP21O2l7Fd
install_name
Updater.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
Windows

Signatures

Quasar Payload 5 IoCs

resource	yara_rule
behavioral1/memory/1440-65-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/1440-66-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/1440-67-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/1440-68-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/1944-79-0x0000000002210000-0x00000000024C0000-memory.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\wcqmcon = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\wcqmcon\\wcqmcon.exe\""	dd8c70113c9c68b1eaafe290014e1037.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1448 set thread context of 1440	1448	dd8c70113c9c68b1eaafe290014e1037.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1804	timeout.exe
656	timeout.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1600	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
656	powershell.exe
1448	dd8c70113c9c68b1eaafe290014e1037.exe
1448	dd8c70113c9c68b1eaafe290014e1037.exe
1944	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	dd8c70113c9c68b1eaafe290014e1037.exe
Token: SeDebugPrivilege	656	powershell.exe
Token: SeDebugPrivilege	1440	dd8c70113c9c68b1eaafe290014e1037.exe
Token: SeDebugPrivilege	832	dd8c70113c9c68b1eaafe290014e1037.exe
Token: SeDebugPrivilege	1944	powershell.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 656	1448	dd8c70113c9c68b1eaafe290014e1037.exe	27
PID 1448 wrote to memory of 656	1448	dd8c70113c9c68b1eaafe290014e1037.exe	27
PID 1448 wrote to memory of 656	1448	dd8c70113c9c68b1eaafe290014e1037.exe	27
PID 1448 wrote to memory of 656	1448	dd8c70113c9c68b1eaafe290014e1037.exe	27
PID 656 wrote to memory of 968	656	powershell.exe	29
PID 656 wrote to memory of 968	656	powershell.exe	29
PID 656 wrote to memory of 968	656	powershell.exe	29
PID 656 wrote to memory of 968	656	powershell.exe	29
PID 968 wrote to memory of 1804	968	cmd.exe	30
PID 968 wrote to memory of 1804	968	cmd.exe	30
PID 968 wrote to memory of 1804	968	cmd.exe	30
PID 968 wrote to memory of 1804	968	cmd.exe	30
PID 1448 wrote to memory of 1440	1448	dd8c70113c9c68b1eaafe290014e1037.exe	31
PID 1448 wrote to memory of 1440	1448	dd8c70113c9c68b1eaafe290014e1037.exe	31
PID 1448 wrote to memory of 1440	1448	dd8c70113c9c68b1eaafe290014e1037.exe	31
PID 1448 wrote to memory of 1440	1448	dd8c70113c9c68b1eaafe290014e1037.exe	31
PID 1448 wrote to memory of 1440	1448	dd8c70113c9c68b1eaafe290014e1037.exe	31
PID 1448 wrote to memory of 1440	1448	dd8c70113c9c68b1eaafe290014e1037.exe	31
PID 1448 wrote to memory of 1440	1448	dd8c70113c9c68b1eaafe290014e1037.exe	31
PID 1448 wrote to memory of 1440	1448	dd8c70113c9c68b1eaafe290014e1037.exe	31
PID 1448 wrote to memory of 1440	1448	dd8c70113c9c68b1eaafe290014e1037.exe	31
PID 1440 wrote to memory of 1500	1440	dd8c70113c9c68b1eaafe290014e1037.exe	35
PID 1440 wrote to memory of 1500	1440	dd8c70113c9c68b1eaafe290014e1037.exe	35
PID 1440 wrote to memory of 1500	1440	dd8c70113c9c68b1eaafe290014e1037.exe	35
PID 1440 wrote to memory of 1500	1440	dd8c70113c9c68b1eaafe290014e1037.exe	35
PID 1500 wrote to memory of 1300	1500	cmd.exe	37
PID 1500 wrote to memory of 1300	1500	cmd.exe	37
PID 1500 wrote to memory of 1300	1500	cmd.exe	37
PID 1500 wrote to memory of 1300	1500	cmd.exe	37
PID 1500 wrote to memory of 1600	1500	cmd.exe	38
PID 1500 wrote to memory of 1600	1500	cmd.exe	38
PID 1500 wrote to memory of 1600	1500	cmd.exe	38
PID 1500 wrote to memory of 1600	1500	cmd.exe	38
PID 1500 wrote to memory of 832	1500	cmd.exe	39
PID 1500 wrote to memory of 832	1500	cmd.exe	39
PID 1500 wrote to memory of 832	1500	cmd.exe	39
PID 1500 wrote to memory of 832	1500	cmd.exe	39
PID 832 wrote to memory of 1944	832	dd8c70113c9c68b1eaafe290014e1037.exe	40
PID 832 wrote to memory of 1944	832	dd8c70113c9c68b1eaafe290014e1037.exe	40
PID 832 wrote to memory of 1944	832	dd8c70113c9c68b1eaafe290014e1037.exe	40
PID 832 wrote to memory of 1944	832	dd8c70113c9c68b1eaafe290014e1037.exe	40
PID 1944 wrote to memory of 1176	1944	powershell.exe	42
PID 1944 wrote to memory of 1176	1944	powershell.exe	42
PID 1944 wrote to memory of 1176	1944	powershell.exe	42
PID 1944 wrote to memory of 1176	1944	powershell.exe	42
PID 1176 wrote to memory of 656	1176	cmd.exe	43
PID 1176 wrote to memory of 656	1176	cmd.exe	43
PID 1176 wrote to memory of 656	1176	cmd.exe	43
PID 1176 wrote to memory of 656	1176	cmd.exe	43

C:\Users\Admin\AppData\Local\Temp\dd8c70113c9c68b1eaafe290014e1037.exe
"C:\Users\Admin\AppData\Local\Temp\dd8c70113c9c68b1eaafe290014e1037.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cmd /c timeout 20
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout 20
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 20
      4⤵
      Delays execution with timeout.exe
      PID:1804
- C:\Users\Admin\AppData\Local\Temp\dd8c70113c9c68b1eaafe290014e1037.exe
  C:\Users\Admin\AppData\Local\Temp\dd8c70113c9c68b1eaafe290014e1037.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\b3sXYVgU9dce.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:1300
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\dd8c70113c9c68b1eaafe290014e1037.exe
      "C:\Users\Admin\AppData\Local\Temp\dd8c70113c9c68b1eaafe290014e1037.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:832
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cmd /c timeout 20
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1944
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout 20
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1176
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 20
        7⤵
        Delays execution with timeout.exe
        
        PID:656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-58-0x0000000002320000-0x0000000002F6A000-memory.dmp

Download

memory/656-59-0x0000000002320000-0x0000000002F6A000-memory.dmp

Download

memory/832-78-0x0000000001140000-0x0000000001141000-memory.dmp

Download

memory/832-72-0x00000000011E0000-0x00000000011EE000-memory.dmp

Download

memory/1440-65-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1440-68-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1440-63-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1440-64-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1440-70-0x0000000001010000-0x0000000001011000-memory.dmp

Download

memory/1440-66-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1440-67-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1448-54-0x00000000011E0000-0x00000000011EE000-memory.dmp

Download

memory/1448-62-0x0000000004FE0000-0x000000000502C000-memory.dmp

Download

memory/1448-61-0x0000000004E80000-0x0000000004ED8000-memory.dmp

Download

memory/1448-60-0x0000000005830000-0x00000000058CC000-memory.dmp

Download

memory/1448-56-0x0000000004D80000-0x0000000004D81000-memory.dmp

Download

memory/1448-55-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Download

memory/1944-79-0x0000000002210000-0x00000000024C0000-memory.dmp

Download

memory/1944-80-0x0000000002210000-0x00000000024C0000-memory.dmp

Download