quasar | b85d366a889518edf0a9899e2120de042965a72fc60c8795a2f9bd6eee96d58c

General

Target

42501e281de15d0331a70d0b34b94b8b.exe
Size

348KB
MD5

42501e281de15d0331a70d0b34b94b8b
SHA1

c9ae2a74d0e25e0d2c4946917767d46d33e208cc
SHA256

b85d366a889518edf0a9899e2120de042965a72fc60c8795a2f9bd6eee96d58c
SHA512

aaea1b070c6560264d2875b7fb355820af4ceab172ff4c5a6b21d893ec4955419c7b673bedae66beae5626dbbacf1c6fe7860008b49029275016c4ac97392f74
SSDEEP

6144:j+NHXf500Mh9fsD02Sp1bS6Zh4SRy80WUw7K:yd50ODqhZh4SYXw7K

Score

10^/10

quasar godbless my hustle spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Godbless my Hustle

C2

mill.hopto.org:7773

Mutex

QSR_MUTEX_IYpAlOHqocnX5nf6J7

Attributes

encryption_key
4AVo5Pq15qMZSQfQWCXf
install_name
Client.exe
log_directory
Ll
reconnect_delay
123
startup_key
str
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/768-54-0x00000000001E0000-0x000000000023E000-memory.dmp	family_quasar

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1692 768 WerFault.exe 42501e281de15d0331a70d0b34b94b8b.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1988 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1292 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

42501e281de15d0331a70d0b34b94b8b.exe

description pid process

Token: SeDebugPrivilege 768 42501e281de15d0331a70d0b34b94b8b.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

42501e281de15d0331a70d0b34b94b8b.exe

pid process

768 42501e281de15d0331a70d0b34b94b8b.exe

flow	ioc
1	ip-api.com

pid	pid_target	process	target process
1692	768	WerFault.exe	42501e281de15d0331a70d0b34b94b8b.exe

pid	process
1988	schtasks.exe

pid	process
1292	PING.EXE

description	pid	process
Token: SeDebugPrivilege	768	42501e281de15d0331a70d0b34b94b8b.exe

pid	process
768	42501e281de15d0331a70d0b34b94b8b.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

42501e281de15d0331a70d0b34b94b8b.execmd.exe

description	pid	process	target process
PID 768 wrote to memory of 1988	768	42501e281de15d0331a70d0b34b94b8b.exe	schtasks.exe
PID 768 wrote to memory of 1988	768	42501e281de15d0331a70d0b34b94b8b.exe	schtasks.exe
PID 768 wrote to memory of 1988	768	42501e281de15d0331a70d0b34b94b8b.exe	schtasks.exe
PID 768 wrote to memory of 1988	768	42501e281de15d0331a70d0b34b94b8b.exe	schtasks.exe
PID 768 wrote to memory of 276	768	42501e281de15d0331a70d0b34b94b8b.exe	cmd.exe
PID 768 wrote to memory of 276	768	42501e281de15d0331a70d0b34b94b8b.exe	cmd.exe
PID 768 wrote to memory of 276	768	42501e281de15d0331a70d0b34b94b8b.exe	cmd.exe
PID 768 wrote to memory of 276	768	42501e281de15d0331a70d0b34b94b8b.exe	cmd.exe
PID 276 wrote to memory of 1080	276	cmd.exe	chcp.com
PID 276 wrote to memory of 1080	276	cmd.exe	chcp.com
PID 276 wrote to memory of 1080	276	cmd.exe	chcp.com
PID 276 wrote to memory of 1080	276	cmd.exe	chcp.com
PID 768 wrote to memory of 1692	768	42501e281de15d0331a70d0b34b94b8b.exe	WerFault.exe
PID 768 wrote to memory of 1692	768	42501e281de15d0331a70d0b34b94b8b.exe	WerFault.exe
PID 768 wrote to memory of 1692	768	42501e281de15d0331a70d0b34b94b8b.exe	WerFault.exe
PID 768 wrote to memory of 1692	768	42501e281de15d0331a70d0b34b94b8b.exe	WerFault.exe
PID 276 wrote to memory of 1292	276	cmd.exe	PING.EXE
PID 276 wrote to memory of 1292	276	cmd.exe	PING.EXE
PID 276 wrote to memory of 1292	276	cmd.exe	PING.EXE
PID 276 wrote to memory of 1292	276	cmd.exe	PING.EXE
PID 276 wrote to memory of 1220	276	cmd.exe	42501e281de15d0331a70d0b34b94b8b.exe
PID 276 wrote to memory of 1220	276	cmd.exe	42501e281de15d0331a70d0b34b94b8b.exe
PID 276 wrote to memory of 1220	276	cmd.exe	42501e281de15d0331a70d0b34b94b8b.exe
PID 276 wrote to memory of 1220	276	cmd.exe	42501e281de15d0331a70d0b34b94b8b.exe

C:\Users\Admin\AppData\Local\Temp\42501e281de15d0331a70d0b34b94b8b.exe
"C:\Users\Admin\AppData\Local\Temp\42501e281de15d0331a70d0b34b94b8b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "str" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\42501e281de15d0331a70d0b34b94b8b.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1988

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\zRhydHFq45fr.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:276

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:1080

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
3⤵
- Runs ping.exe
PID:1292

C:\Users\Admin\AppData\Local\Temp\42501e281de15d0331a70d0b34b94b8b.exe
"C:\Users\Admin\AppData\Local\Temp\42501e281de15d0331a70d0b34b94b8b.exe"
3⤵
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 1464
2⤵
- Program crash
PID:1692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zRhydHFq45fr.bat
Filesize
229B

MD5
fd3b1a8cc2392e91b8f07e6b711bf7ac

SHA1
cdd3d747c742bb7f70f8882bf1cbdea04a8e8a2c

SHA256
5c20959caeec4c385d5e19b22e65edd270e4d6dc45c9be6b99600de661c5aaec

SHA512
b13deac4e6103ed088ebc001eacf49183f273b0585d93e4fc8bb30937753ada2766e792cba6f8da9810c7f531c895aaf911b376bc20eeb08accde661b83e32aa

Download Submit
memory/276-57-0x0000000000000000-mapping.dmp

Download
memory/768-54-0x00000000001E0000-0x000000000023E000-memory.dmp

Filesize
376KB

Download
memory/768-55-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/1080-59-0x0000000000000000-mapping.dmp

Download
memory/1220-62-0x0000000000000000-mapping.dmp

Download
memory/1292-61-0x0000000000000000-mapping.dmp

Download
memory/1692-60-0x0000000000000000-mapping.dmp

Download
memory/1988-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads