quasar | d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f

General

Target

d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
Size

786KB
MD5

0acf6ea8ea82fd3aae0da111f91e0052
SHA1

7a04c82c0081741a3fe211a7eda63584937ddea5
SHA256

d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f
SHA512

da5d1d3cd47af8e66bc21ba33bc66782474c728a009f78b6040350107ffa4a8075bf6c0c70e383db62ab5e7ee7de681bf52f7d24bb0174cc8802e320505ced57

Score

10^/10

quasar wallets persistence spyware suricata trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Wallets

C2

mailsdc61.ga:5490

Mutex

QSR_MUTEX_AlGzVdofAbXTg5UjU1

Attributes

encryption_key
kjsUY5tlvrmAWR8ZxfU3
install_name
skype.exe
log_directory
Logs
reconnect_delay
3000
startup_key
skype
subdirectory
AppData

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1168-58-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/1168-59-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/1168-60-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/1168-61-0x000000000045819E-mapping.dmp	family_quasar
behavioral1/memory/1168-63-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/1168-65-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar

suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata
Executes dropped EXE 2 IoCs

Processes:

skype.exeskype.exe

pid process

1656 skype.exe
268 skype.exe
Loads dropped DLL 1 IoCs

Processes:

d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe

pid process

1168 d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe

pid	process
1656	skype.exe
268	skype.exe

pid	process
1168	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

skype.exed0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\12Build = "C:\\Users\\Admin\\AppData\\Roaming\\iBJoj\\smhpo.exe"	skype.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\12Build = "C:\\Users\\Admin\\AppData\\Roaming\\iBJoj\\smhpo.exe"	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exeskype.exe

description	pid	process	target process
PID 972 set thread context of 1168	972	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 1656 set thread context of 268	1656	skype.exe	skype.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1828 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe

description pid process

Token: SeDebugPrivilege 1168 d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe

pid	process
1828	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1168	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exed0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exeskype.exe

description	pid	process	target process
PID 972 wrote to memory of 1168	972	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 972 wrote to memory of 1168	972	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 972 wrote to memory of 1168	972	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 972 wrote to memory of 1168	972	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 972 wrote to memory of 1168	972	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 972 wrote to memory of 1168	972	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 972 wrote to memory of 1168	972	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 972 wrote to memory of 1168	972	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 972 wrote to memory of 1168	972	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 1168 wrote to memory of 1828	1168	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	schtasks.exe
PID 1168 wrote to memory of 1828	1168	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	schtasks.exe
PID 1168 wrote to memory of 1828	1168	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	schtasks.exe
PID 1168 wrote to memory of 1828	1168	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	schtasks.exe
PID 1168 wrote to memory of 1656	1168	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	skype.exe
PID 1168 wrote to memory of 1656	1168	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	skype.exe
PID 1168 wrote to memory of 1656	1168	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	skype.exe
PID 1168 wrote to memory of 1656	1168	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	skype.exe
PID 1656 wrote to memory of 268	1656	skype.exe	skype.exe
PID 1656 wrote to memory of 268	1656	skype.exe	skype.exe
PID 1656 wrote to memory of 268	1656	skype.exe	skype.exe
PID 1656 wrote to memory of 268	1656	skype.exe	skype.exe
PID 1656 wrote to memory of 268	1656	skype.exe	skype.exe

C:\Users\Admin\AppData\Local\Temp\d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
"C:\Users\Admin\AppData\Local\Temp\d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:972

C:\Users\Admin\AppData\Local\Temp\d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
"C:\Users\Admin\AppData\Local\Temp\d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe"
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "skype" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1828

C:\Users\Admin\AppData\Roaming\AppData\skype.exe
"C:\Users\Admin\AppData\Roaming\AppData\skype.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Roaming\AppData\skype.exe
"C:\Users\Admin\AppData\Roaming\AppData\skype.exe"
4⤵
- Executes dropped EXE
PID:268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AppData\skype.exe
Filesize
786KB

MD5
0acf6ea8ea82fd3aae0da111f91e0052

SHA1
7a04c82c0081741a3fe211a7eda63584937ddea5

SHA256
d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f

SHA512
da5d1d3cd47af8e66bc21ba33bc66782474c728a009f78b6040350107ffa4a8075bf6c0c70e383db62ab5e7ee7de681bf52f7d24bb0174cc8802e320505ced57

Download Submit
C:\Users\Admin\AppData\Roaming\AppData\skype.exe
Filesize
786KB

MD5
0acf6ea8ea82fd3aae0da111f91e0052

SHA1
7a04c82c0081741a3fe211a7eda63584937ddea5

SHA256
d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f

SHA512
da5d1d3cd47af8e66bc21ba33bc66782474c728a009f78b6040350107ffa4a8075bf6c0c70e383db62ab5e7ee7de681bf52f7d24bb0174cc8802e320505ced57

Download Submit
C:\Users\Admin\AppData\Roaming\AppData\skype.exe
Filesize
786KB

MD5
0acf6ea8ea82fd3aae0da111f91e0052

SHA1
7a04c82c0081741a3fe211a7eda63584937ddea5

SHA256
d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f

SHA512
da5d1d3cd47af8e66bc21ba33bc66782474c728a009f78b6040350107ffa4a8075bf6c0c70e383db62ab5e7ee7de681bf52f7d24bb0174cc8802e320505ced57

Download Submit
\Users\Admin\AppData\Roaming\AppData\skype.exe
Filesize
786KB

MD5
0acf6ea8ea82fd3aae0da111f91e0052

SHA1
7a04c82c0081741a3fe211a7eda63584937ddea5

SHA256
d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f

SHA512
da5d1d3cd47af8e66bc21ba33bc66782474c728a009f78b6040350107ffa4a8075bf6c0c70e383db62ab5e7ee7de681bf52f7d24bb0174cc8802e320505ced57

Download Submit
memory/268-74-0x000000000045819E-mapping.dmp

Download
memory/972-54-0x00000000012D0000-0x000000000139A000-memory.dmp

Filesize
808KB

Download
memory/1168-59-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1168-63-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1168-65-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1168-66-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Filesize
8KB

Download
memory/1168-61-0x000000000045819E-mapping.dmp

Download
memory/1168-60-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1168-58-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1168-56-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1168-55-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1656-69-0x0000000000000000-mapping.dmp

Download
memory/1656-72-0x00000000011F0000-0x00000000012BA000-memory.dmp

Filesize
808KB

Download
memory/1828-67-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads