quasar | 93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33

General

Target

93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe
Size

2.8MB
MD5

be30e02cf69f0b7fad05dfc7a641d903
SHA1

dec2042f9e76557f59e80aefcd63465761b4dd61
SHA256

93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33
SHA512

f318d60d2e598307adbd2a302cd6b7b77516a459f9b10620c0d090bb692c689044917d3d011a85f528c01c0e0d7164b84783edd5691948d1748512018a5a4476
SSDEEP

49152:cx/mZWE3x9nn0c1IYVuTRyjrk88RIP5vEUfl6za32ehyfT0m:cxeZWE3x9n0OIYV4Ryjrk88RI0

Score

10^/10

quasar projecthydro spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

ProjectHydro

C2

192.168.145.131:4782

Mutex

959a4a81-1e0c-4b68-9700-ba2617f02c24

Attributes

encryption_key
5314E4E479660AE215BEB448CBAF17EDF374B00B
install_name
vc_redist.x64.exe
log_directory
Logs
reconnect_delay
3000
startup_key
VC redistributable install
subdirectory
vc_redist

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

resource	yara_rule
behavioral1/memory/1768-54-0x0000000000D60000-0x000000000102A000-memory.dmp	family_quasar
behavioral1/files/0x000b0000000122da-58.dat	family_quasar
behavioral1/files/0x000b0000000122da-59.dat	family_quasar
behavioral1/memory/856-60-0x0000000000A50000-0x0000000000D1A000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
856	vc_redist.x64.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1940	schtasks.exe
560	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe
Token: SeDebugPrivilege	856	vc_redist.x64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
856	vc_redist.x64.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
856	vc_redist.x64.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1940	1768	93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe	27
PID 1768 wrote to memory of 1940	1768	93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe	27
PID 1768 wrote to memory of 1940	1768	93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe	27
PID 1768 wrote to memory of 856	1768	93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe	29
PID 1768 wrote to memory of 856	1768	93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe	29
PID 1768 wrote to memory of 856	1768	93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe	29
PID 856 wrote to memory of 560	856	vc_redist.x64.exe	30
PID 856 wrote to memory of 560	856	vc_redist.x64.exe	30
PID 856 wrote to memory of 560	856	vc_redist.x64.exe	30

C:\Users\Admin\AppData\Local\Temp\93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe
"C:\Users\Admin\AppData\Local\Temp\93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "VC redistributable install" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1940
- C:\Users\Admin\AppData\Roaming\vc_redist\vc_redist.x64.exe
  "C:\Users\Admin\AppData\Roaming\vc_redist\vc_redist.x64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "VC redistributable install" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\vc_redist\vc_redist.x64.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\vc_redist\vc_redist.x64.exe

Filesize
2.8MB

MD5
be30e02cf69f0b7fad05dfc7a641d903

SHA1
dec2042f9e76557f59e80aefcd63465761b4dd61

SHA256
93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33

SHA512
f318d60d2e598307adbd2a302cd6b7b77516a459f9b10620c0d090bb692c689044917d3d011a85f528c01c0e0d7164b84783edd5691948d1748512018a5a4476

Download Submit
C:\Users\Admin\AppData\Roaming\vc_redist\vc_redist.x64.exe

Filesize
2.8MB

MD5
be30e02cf69f0b7fad05dfc7a641d903

SHA1
dec2042f9e76557f59e80aefcd63465761b4dd61

SHA256
93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33

SHA512
f318d60d2e598307adbd2a302cd6b7b77516a459f9b10620c0d090bb692c689044917d3d011a85f528c01c0e0d7164b84783edd5691948d1748512018a5a4476

Download Submit
memory/856-60-0x0000000000A50000-0x0000000000D1A000-memory.dmp

Filesize
2.8MB

Download
memory/1768-54-0x0000000000D60000-0x000000000102A000-memory.dmp

Filesize
2.8MB

Download
memory/1768-55-0x000007FEFC591000-0x000007FEFC593000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads