quasar | 191e85b65efedab77e67bdaa3a4aad1915f0fa991c1858b359d8a92c679206a8

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2022 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

quasar_clean.exe
Size

376KB
MD5

1e9ac0b5547b0fa980e4ee8529677be5
SHA1

c25c80b4325218cd8e4f4ca11e404293829963f2
SHA256

191e85b65efedab77e67bdaa3a4aad1915f0fa991c1858b359d8a92c679206a8
SHA512

e86c50705690191ab37f84d9c9675e8c820d9dee9bc9b54dba689c0bcfe9a55d8faf0ade793c01eaa5a66a60741e4794d884d9f140126a58f0388faaa9c85ec5
SSDEEP

6144:B8NHXf500M+4EFC4KQk7lKxbvY67CACSerymKtwe:6d50yAQlbCjSerymmwe

Score

10^/10

quasar top spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

top

dnuocc.com:64594

www.dnuocc.com:64594

Mutex

QSR_MUTEX_NKzsG6279pND1MmPDw

Attributes

encryption_key
6c7zzdS2IXrGaCb9wrMU
install_name
tors.exe
log_directory
Logs
reconnect_delay
5000
startup_key
tdm
subdirectory
tilk

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4284-132-0x0000000000740000-0x000000000079E000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\tilk\tors.exe	family_quasar
C:\Users\Admin\AppData\Roaming\tilk\tors.exe	family_quasar

Executes dropped EXE 1 IoCs

Processes:

tors.exe

pid process

3796 tors.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 ip-api.com
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4292 schtasks.exe
344 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

quasar_clean.exetors.exe

description pid process

Token: SeDebugPrivilege 4284 quasar_clean.exe
Token: SeDebugPrivilege 3796 tors.exe

pid	process
3796	tors.exe

flow	ioc
10	ip-api.com

pid	process
4292	schtasks.exe
344	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	4284	quasar_clean.exe
Token: SeDebugPrivilege	3796	tors.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

quasar_clean.exetors.exe

description	pid	process	target process
PID 4284 wrote to memory of 4292	4284	quasar_clean.exe	schtasks.exe
PID 4284 wrote to memory of 4292	4284	quasar_clean.exe	schtasks.exe
PID 4284 wrote to memory of 4292	4284	quasar_clean.exe	schtasks.exe
PID 4284 wrote to memory of 3796	4284	quasar_clean.exe	tors.exe
PID 4284 wrote to memory of 3796	4284	quasar_clean.exe	tors.exe
PID 4284 wrote to memory of 3796	4284	quasar_clean.exe	tors.exe
PID 3796 wrote to memory of 344	3796	tors.exe	schtasks.exe
PID 3796 wrote to memory of 344	3796	tors.exe	schtasks.exe
PID 3796 wrote to memory of 344	3796	tors.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\quasar_clean.exe
"C:\Users\Admin\AppData\Local\Temp\quasar_clean.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "tdm" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\quasar_clean.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:4292

C:\Users\Admin\AppData\Roaming\tilk\tors.exe
"C:\Users\Admin\AppData\Roaming\tilk\tors.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "tdm" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\tilk\tors.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\tilk\tors.exe
Filesize
376KB

MD5
1e9ac0b5547b0fa980e4ee8529677be5

SHA1
c25c80b4325218cd8e4f4ca11e404293829963f2

SHA256
191e85b65efedab77e67bdaa3a4aad1915f0fa991c1858b359d8a92c679206a8

SHA512
e86c50705690191ab37f84d9c9675e8c820d9dee9bc9b54dba689c0bcfe9a55d8faf0ade793c01eaa5a66a60741e4794d884d9f140126a58f0388faaa9c85ec5

Download Submit
C:\Users\Admin\AppData\Roaming\tilk\tors.exe
Filesize
376KB

MD5
1e9ac0b5547b0fa980e4ee8529677be5

SHA1
c25c80b4325218cd8e4f4ca11e404293829963f2

SHA256
191e85b65efedab77e67bdaa3a4aad1915f0fa991c1858b359d8a92c679206a8

SHA512
e86c50705690191ab37f84d9c9675e8c820d9dee9bc9b54dba689c0bcfe9a55d8faf0ade793c01eaa5a66a60741e4794d884d9f140126a58f0388faaa9c85ec5

Download Submit
memory/344-142-0x0000000000000000-mapping.dmp

Download
memory/3796-139-0x0000000000000000-mapping.dmp

Download
memory/3796-143-0x0000000006720000-0x000000000672A000-memory.dmp

Filesize
40KB

Download
memory/4284-132-0x0000000000740000-0x000000000079E000-memory.dmp

Filesize
376KB

Download
memory/4284-133-0x0000000005730000-0x0000000005CD4000-memory.dmp

Filesize
5.6MB

Download
memory/4284-134-0x0000000005080000-0x0000000005112000-memory.dmp

Filesize
584KB

Download
memory/4284-135-0x0000000005000000-0x0000000005066000-memory.dmp

Filesize
408KB

Download
memory/4284-136-0x0000000005F60000-0x0000000005F72000-memory.dmp

Filesize
72KB

Download
memory/4284-137-0x00000000063A0000-0x00000000063DC000-memory.dmp

Filesize
240KB

Download
memory/4292-138-0x0000000000000000-mapping.dmp

Download