quasar | 42e5b76705daee37d79456402795f0353bcd7eecbdcecfa863a5179dafe3c967

Analysis

max time kernel
152s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
31/01/2022, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dd8c70113c9c68b1eaafe290014e1037.exe
Size 38KB
Sample220131-pgmarahbbq
SHA256 42e5b76705daee37d79456402795f0353bcd7eecbdcecfa863a5179dafe3c967
MD5 dd8c70113c9c68b1eaafe290014e1037
SHA1 5a5ab0ffe753a9f278a44fc92f219cf7efd86b71
SHA512 59318d6850794a47a119cc17554febec6a9c8089d767f9c701b86329b2c375a08ebb598cf419ebba26060e105aae151e4d6e1c7d8cbb5f099410181e586a1b7e
MD5 SHA1 SHA512

Score

10^/10

quasar remote2 persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

remote2

thomasfunte.zapto.org:64779
yncesucesss.chickenkiller.com:64779

Mutex

QSR_MUTEX_5FdAa2wmL7UGj6r2Dg

Attributes

encryption_key
cTW0njX7Q1AP21O2l7Fd
install_name
Updater.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
Windows

Signatures

Quasar Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1300-147-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	dd8c70113c9c68b1eaafe290014e1037.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	dd8c70113c9c68b1eaafe290014e1037.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	dd8c70113c9c68b1eaafe290014e1037.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wcqmcon = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\wcqmcon\\wcqmcon.exe\""	dd8c70113c9c68b1eaafe290014e1037.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
51	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3968 set thread context of 1300	3968	dd8c70113c9c68b1eaafe290014e1037.exe	78

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2232	timeout.exe
3172	timeout.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2528	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2476	powershell.exe
2476	powershell.exe
3968	dd8c70113c9c68b1eaafe290014e1037.exe
3968	dd8c70113c9c68b1eaafe290014e1037.exe
2824	powershell.exe
2824	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3968	dd8c70113c9c68b1eaafe290014e1037.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	1300	dd8c70113c9c68b1eaafe290014e1037.exe
Token: SeDebugPrivilege	3640	dd8c70113c9c68b1eaafe290014e1037.exe
Token: SeDebugPrivilege	2824	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 2476	3968	dd8c70113c9c68b1eaafe290014e1037.exe	55
PID 3968 wrote to memory of 2476	3968	dd8c70113c9c68b1eaafe290014e1037.exe	55
PID 3968 wrote to memory of 2476	3968	dd8c70113c9c68b1eaafe290014e1037.exe	55
PID 2476 wrote to memory of 1968	2476	powershell.exe	58
PID 2476 wrote to memory of 1968	2476	powershell.exe	58
PID 2476 wrote to memory of 1968	2476	powershell.exe	58
PID 1968 wrote to memory of 2232	1968	cmd.exe	59
PID 1968 wrote to memory of 2232	1968	cmd.exe	59
PID 1968 wrote to memory of 2232	1968	cmd.exe	59
PID 3968 wrote to memory of 1300	3968	dd8c70113c9c68b1eaafe290014e1037.exe	78
PID 3968 wrote to memory of 1300	3968	dd8c70113c9c68b1eaafe290014e1037.exe	78
PID 3968 wrote to memory of 1300	3968	dd8c70113c9c68b1eaafe290014e1037.exe	78
PID 3968 wrote to memory of 1300	3968	dd8c70113c9c68b1eaafe290014e1037.exe	78
PID 3968 wrote to memory of 1300	3968	dd8c70113c9c68b1eaafe290014e1037.exe	78
PID 3968 wrote to memory of 1300	3968	dd8c70113c9c68b1eaafe290014e1037.exe	78
PID 3968 wrote to memory of 1300	3968	dd8c70113c9c68b1eaafe290014e1037.exe	78
PID 3968 wrote to memory of 1300	3968	dd8c70113c9c68b1eaafe290014e1037.exe	78
PID 1300 wrote to memory of 2096	1300	dd8c70113c9c68b1eaafe290014e1037.exe	81
PID 1300 wrote to memory of 2096	1300	dd8c70113c9c68b1eaafe290014e1037.exe	81
PID 1300 wrote to memory of 2096	1300	dd8c70113c9c68b1eaafe290014e1037.exe	81
PID 2096 wrote to memory of 3948	2096	cmd.exe	83
PID 2096 wrote to memory of 3948	2096	cmd.exe	83
PID 2096 wrote to memory of 3948	2096	cmd.exe	83
PID 2096 wrote to memory of 2528	2096	cmd.exe	84
PID 2096 wrote to memory of 2528	2096	cmd.exe	84
PID 2096 wrote to memory of 2528	2096	cmd.exe	84
PID 2096 wrote to memory of 3640	2096	cmd.exe	85
PID 2096 wrote to memory of 3640	2096	cmd.exe	85
PID 2096 wrote to memory of 3640	2096	cmd.exe	85
PID 3640 wrote to memory of 2824	3640	dd8c70113c9c68b1eaafe290014e1037.exe	86
PID 3640 wrote to memory of 2824	3640	dd8c70113c9c68b1eaafe290014e1037.exe	86
PID 3640 wrote to memory of 2824	3640	dd8c70113c9c68b1eaafe290014e1037.exe	86
PID 2824 wrote to memory of 1020	2824	powershell.exe	88
PID 2824 wrote to memory of 1020	2824	powershell.exe	88
PID 2824 wrote to memory of 1020	2824	powershell.exe	88
PID 1020 wrote to memory of 3172	1020	cmd.exe	89
PID 1020 wrote to memory of 3172	1020	cmd.exe	89
PID 1020 wrote to memory of 3172	1020	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\dd8c70113c9c68b1eaafe290014e1037.exe
"C:\Users\Admin\AppData\Local\Temp\dd8c70113c9c68b1eaafe290014e1037.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cmd /c timeout 20
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout 20
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 20
      4⤵
      Delays execution with timeout.exe
      PID:2232
- C:\Users\Admin\AppData\Local\Temp\dd8c70113c9c68b1eaafe290014e1037.exe
  C:\Users\Admin\AppData\Local\Temp\dd8c70113c9c68b1eaafe290014e1037.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gRPifs1qtx0R.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:3948
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\dd8c70113c9c68b1eaafe290014e1037.exe
      "C:\Users\Admin\AppData\Local\Temp\dd8c70113c9c68b1eaafe290014e1037.exe"
      4⤵
      Checks computer location settings
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3640
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cmd /c timeout 20
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2824
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout 20
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 20
        7⤵
        Delays execution with timeout.exe
        
        PID:3172

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 4f6c34a4710b31c95a6e830e3b3c80ac r47ChdGul0a9kBdCP4mQbw.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:3996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1300-147-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1300-153-0x0000000006910000-0x000000000691A000-memory.dmp

Download

memory/1300-152-0x0000000006750000-0x000000000678C000-memory.dmp

Download

memory/1300-151-0x00000000054B0000-0x00000000054C2000-memory.dmp

Download

memory/1300-150-0x00000000052F0000-0x00000000054B0000-memory.dmp

Download

memory/1300-149-0x0000000005AA0000-0x0000000006044000-memory.dmp

Download

memory/2476-144-0x0000000008010000-0x000000000802E000-memory.dmp

Download

memory/2476-140-0x0000000004802000-0x0000000004803000-memory.dmp

Download

memory/2476-138-0x0000000007190000-0x00000000077B8000-memory.dmp

Download

memory/2476-139-0x0000000004800000-0x0000000004801000-memory.dmp

Download

memory/2476-143-0x00000000077C0000-0x0000000007826000-memory.dmp

Download

memory/2476-142-0x0000000007110000-0x0000000007176000-memory.dmp

Download

memory/2476-141-0x0000000006F70000-0x0000000006F92000-memory.dmp

Download

memory/2476-137-0x00000000046F0000-0x0000000004726000-memory.dmp

Download

memory/2824-160-0x0000000006CA2000-0x0000000006CA3000-memory.dmp

Download

memory/2824-159-0x0000000006CA0000-0x0000000006CA1000-memory.dmp

Download

memory/3640-158-0x0000000005550000-0x0000000005551000-memory.dmp

Download

memory/3968-133-0x0000000000320000-0x000000000032E000-memory.dmp

Download

memory/3968-146-0x0000000000B00000-0x0000000000B92000-memory.dmp

Download

memory/3968-134-0x0000000004C60000-0x0000000004C61000-memory.dmp

Download