quasar | d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f

General

Target

d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
Size

786KB
MD5

0acf6ea8ea82fd3aae0da111f91e0052
SHA1

7a04c82c0081741a3fe211a7eda63584937ddea5
SHA256

d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f
SHA512

da5d1d3cd47af8e66bc21ba33bc66782474c728a009f78b6040350107ffa4a8075bf6c0c70e383db62ab5e7ee7de681bf52f7d24bb0174cc8802e320505ced57

Score

10^/10

quasar wallets persistence spyware suricata trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Wallets

C2

mailsdc61.ga:5490

Mutex

QSR_MUTEX_AlGzVdofAbXTg5UjU1

Attributes

encryption_key
kjsUY5tlvrmAWR8ZxfU3
install_name
skype.exe
log_directory
Logs
reconnect_delay
3000
startup_key
skype
subdirectory
AppData

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1096-133-0x0000000000000000-mapping.dmp	family_quasar
behavioral2/memory/1096-134-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar

suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata
Executes dropped EXE 2 IoCs

Processes:

skype.exeskype.exe

pid process

228 skype.exe
3748 skype.exe

pid	process
228	skype.exe
3748	skype.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exeskype.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\12Build = "C:\\Users\\Admin\\AppData\\Roaming\\iBJoj\\smhpo.exe"	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\12Build = "C:\\Users\\Admin\\AppData\\Roaming\\iBJoj\\smhpo.exe"	skype.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

26 ip-api.com

flow	ioc
26	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exeskype.exe

description	pid	process	target process
PID 2368 set thread context of 1096	2368	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 228 set thread context of 3748	228	skype.exe	skype.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3644 3748 WerFault.exe skype.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4160 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe

description pid process

Token: SeDebugPrivilege 1096 d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe

pid	pid_target	process	target process
3644	3748	WerFault.exe	skype.exe

pid	process
4160	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1096	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exed0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exeskype.exe

description	pid	process	target process
PID 2368 wrote to memory of 1096	2368	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 2368 wrote to memory of 1096	2368	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 2368 wrote to memory of 1096	2368	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 2368 wrote to memory of 1096	2368	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 2368 wrote to memory of 1096	2368	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 2368 wrote to memory of 1096	2368	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 2368 wrote to memory of 1096	2368	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 2368 wrote to memory of 1096	2368	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
PID 1096 wrote to memory of 4160	1096	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	schtasks.exe
PID 1096 wrote to memory of 4160	1096	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	schtasks.exe
PID 1096 wrote to memory of 4160	1096	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	schtasks.exe
PID 1096 wrote to memory of 228	1096	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	skype.exe
PID 1096 wrote to memory of 228	1096	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	skype.exe
PID 1096 wrote to memory of 228	1096	d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe	skype.exe
PID 228 wrote to memory of 3748	228	skype.exe	skype.exe
PID 228 wrote to memory of 3748	228	skype.exe	skype.exe
PID 228 wrote to memory of 3748	228	skype.exe	skype.exe
PID 228 wrote to memory of 3748	228	skype.exe	skype.exe

C:\Users\Admin\AppData\Local\Temp\d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
"C:\Users\Admin\AppData\Local\Temp\d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2368

C:\Users\Admin\AppData\Local\Temp\d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe
"C:\Users\Admin\AppData\Local\Temp\d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "skype" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:4160

C:\Users\Admin\AppData\Roaming\AppData\skype.exe
"C:\Users\Admin\AppData\Roaming\AppData\skype.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:228

C:\Users\Admin\AppData\Roaming\AppData\skype.exe
"C:\Users\Admin\AppData\Roaming\AppData\skype.exe"
4⤵
- Executes dropped EXE
PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 80
5⤵
- Program crash
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3748 -ip 3748
1⤵
PID:3136

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f.exe.log
Filesize
611B

MD5
e09032fb626c6c1d10e2ab27b0278463

SHA1
a26ea328ef81ab53a9883f7b9c7d3998883eaf47

SHA256
1b834fc0faded24ae9665629c739742a2614784d62f96f9f982a6c678e916147

SHA512
2c341b371103d67fb0bd1e49a4a07b3037e3a304b914446c103de43f87370d584e666f0b93e2c28c776188e975cd95855bb3a1bc4ddbcac89acd62ec46cb5e35

Download Submit
C:\Users\Admin\AppData\Roaming\AppData\skype.exe
Filesize
786KB

MD5
0acf6ea8ea82fd3aae0da111f91e0052

SHA1
7a04c82c0081741a3fe211a7eda63584937ddea5

SHA256
d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f

SHA512
da5d1d3cd47af8e66bc21ba33bc66782474c728a009f78b6040350107ffa4a8075bf6c0c70e383db62ab5e7ee7de681bf52f7d24bb0174cc8802e320505ced57

Download Submit
C:\Users\Admin\AppData\Roaming\AppData\skype.exe
Filesize
786KB

MD5
0acf6ea8ea82fd3aae0da111f91e0052

SHA1
7a04c82c0081741a3fe211a7eda63584937ddea5

SHA256
d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f

SHA512
da5d1d3cd47af8e66bc21ba33bc66782474c728a009f78b6040350107ffa4a8075bf6c0c70e383db62ab5e7ee7de681bf52f7d24bb0174cc8802e320505ced57

Download Submit
C:\Users\Admin\AppData\Roaming\AppData\skype.exe
Filesize
786KB

MD5
0acf6ea8ea82fd3aae0da111f91e0052

SHA1
7a04c82c0081741a3fe211a7eda63584937ddea5

SHA256
d0e1019396782435f18448f916bbd03371d132965538f9244f726ff240a6582f

SHA512
da5d1d3cd47af8e66bc21ba33bc66782474c728a009f78b6040350107ffa4a8075bf6c0c70e383db62ab5e7ee7de681bf52f7d24bb0174cc8802e320505ced57

Download Submit
memory/228-141-0x0000000000000000-mapping.dmp

Download
memory/228-144-0x0000000000630000-0x00000000006FA000-memory.dmp

Filesize
808KB

Download
memory/1096-134-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1096-137-0x0000000004D70000-0x0000000004DD6000-memory.dmp

Filesize
408KB

Download
memory/1096-138-0x0000000005D80000-0x0000000005D92000-memory.dmp

Filesize
72KB

Download
memory/1096-139-0x00000000062E0000-0x000000000631C000-memory.dmp

Filesize
240KB

Download
memory/1096-136-0x0000000005270000-0x0000000005814000-memory.dmp

Filesize
5.6MB

Download
memory/1096-133-0x0000000000000000-mapping.dmp

Download
memory/2368-130-0x0000000000060000-0x000000000012A000-memory.dmp

Filesize
808KB

Download
memory/2368-132-0x0000000007070000-0x0000000007102000-memory.dmp

Filesize
584KB

Download
memory/2368-131-0x0000000006F20000-0x0000000006FBC000-memory.dmp

Filesize
624KB

Download
memory/3748-145-0x0000000000000000-mapping.dmp

Download
memory/4160-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads