quasar | 93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33

Analysis

max time kernel
132s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2022 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe
Size

2.8MB
MD5

be30e02cf69f0b7fad05dfc7a641d903
SHA1

dec2042f9e76557f59e80aefcd63465761b4dd61
SHA256

93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33
SHA512

f318d60d2e598307adbd2a302cd6b7b77516a459f9b10620c0d090bb692c689044917d3d011a85f528c01c0e0d7164b84783edd5691948d1748512018a5a4476
SSDEEP

49152:cx/mZWE3x9nn0c1IYVuTRyjrk88RIP5vEUfl6za32ehyfT0m:cxeZWE3x9n0OIYV4Ryjrk88RI0

Score

10^/10

quasar projecthydro spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

ProjectHydro

192.168.145.131:4782

Mutex

959a4a81-1e0c-4b68-9700-ba2617f02c24

Attributes

encryption_key
5314E4E479660AE215BEB448CBAF17EDF374B00B
install_name
vc_redist.x64.exe
log_directory
Logs
reconnect_delay
3000
startup_key
VC redistributable install
subdirectory
vc_redist

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral2/memory/4500-132-0x0000000000BB0000-0x0000000000E7A000-memory.dmp	family_quasar
behavioral2/files/0x0009000000022f71-136.dat	family_quasar
behavioral2/files/0x0009000000022f71-137.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
3448	vc_redist.x64.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4964	schtasks.exe
4280	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe
Token: SeDebugPrivilege	3448	vc_redist.x64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3448	vc_redist.x64.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3448	vc_redist.x64.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4964	4500	93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe	82
PID 4500 wrote to memory of 4964	4500	93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe	82
PID 4500 wrote to memory of 3448	4500	93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe	84
PID 4500 wrote to memory of 3448	4500	93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe	84
PID 3448 wrote to memory of 4280	3448	vc_redist.x64.exe	87
PID 3448 wrote to memory of 4280	3448	vc_redist.x64.exe	87

C:\Users\Admin\AppData\Local\Temp\93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe
"C:\Users\Admin\AppData\Local\Temp\93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "VC redistributable install" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:4964
- C:\Users\Admin\AppData\Roaming\vc_redist\vc_redist.x64.exe
  "C:\Users\Admin\AppData\Roaming\vc_redist\vc_redist.x64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "VC redistributable install" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\vc_redist\vc_redist.x64.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\vc_redist\vc_redist.x64.exe

Filesize
2.8MB

MD5
be30e02cf69f0b7fad05dfc7a641d903

SHA1
dec2042f9e76557f59e80aefcd63465761b4dd61

SHA256
93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33

SHA512
f318d60d2e598307adbd2a302cd6b7b77516a459f9b10620c0d090bb692c689044917d3d011a85f528c01c0e0d7164b84783edd5691948d1748512018a5a4476

Download Submit
C:\Users\Admin\AppData\Roaming\vc_redist\vc_redist.x64.exe

Filesize
2.8MB

MD5
be30e02cf69f0b7fad05dfc7a641d903

SHA1
dec2042f9e76557f59e80aefcd63465761b4dd61

SHA256
93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33

SHA512
f318d60d2e598307adbd2a302cd6b7b77516a459f9b10620c0d090bb692c689044917d3d011a85f528c01c0e0d7164b84783edd5691948d1748512018a5a4476

Download Submit
memory/3448-139-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Filesize
10.8MB

Download
memory/3448-141-0x000000001CFE0000-0x000000001D030000-memory.dmp

Filesize
320KB

Download
memory/3448-142-0x000000001D0F0000-0x000000001D1A2000-memory.dmp

Filesize
712KB

Download
memory/3448-143-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Filesize
10.8MB

Download
memory/4500-132-0x0000000000BB0000-0x0000000000E7A000-memory.dmp

Filesize
2.8MB

Download
memory/4500-133-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Filesize
10.8MB

Download
memory/4500-138-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads