quasar | d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358

General

Target

d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe
Size

1.7MB
MD5

21eedc621939b5e997b75196b6621b03
SHA1

f3fc557364510567815a5e53730a339cc68b572d
SHA256

d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358
SHA512

05daf1bb49ffd48daf36957ae1b2e8a5f49033b809f0c400fdb1a0d3a492d91e638c0d0253fdbf2bd2af6e0991b3b63d83264a8e7ad195d50e2637cac3f7ec5f
SSDEEP

24576:PUxJIRCRoenYQb6VOJ8Kgn1beVuumyEU:

Score

10^/10

quasar cio persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Cio

C2

162.19.131.197:4782

Mutex

c5fdf017-8f44-47ea-a69e-0b82e4044ca7

Attributes

encryption_key
59A92039F951E5069C9F50FD9F340E759713B058
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1948-65-0x0000000000400000-0x0000000000484000-memory.dmp	family_quasar
behavioral1/memory/1948-66-0x0000000000400000-0x0000000000484000-memory.dmp	family_quasar
behavioral1/memory/1948-67-0x0000000000400000-0x0000000000484000-memory.dmp	family_quasar
behavioral1/memory/1948-68-0x000000000047E79E-mapping.dmp	family_quasar
behavioral1/memory/1948-70-0x0000000000400000-0x0000000000484000-memory.dmp	family_quasar
behavioral1/memory/1948-72-0x0000000000400000-0x0000000000484000-memory.dmp	family_quasar

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jlnprgcxco = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eqbuy\\Jlnprgcxco.exe\""	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe

description	pid	process	target process
PID 576 set thread context of 1948	576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exepowershell.exe

pid process

576 d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe
944 powershell.exe

pid	process
576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe
944	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exepowershell.exed3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe

description	pid	process
Token: SeDebugPrivilege	576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe
Token: SeDebugPrivilege	944	powershell.exe
Token: SeDebugPrivilege	1948	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe

pid process

1948 d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe

pid	process
1948	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe

description	pid	process	target process
PID 576 wrote to memory of 944	576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe	powershell.exe
PID 576 wrote to memory of 944	576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe	powershell.exe
PID 576 wrote to memory of 944	576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe	powershell.exe
PID 576 wrote to memory of 944	576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe	powershell.exe
PID 576 wrote to memory of 1948	576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe
PID 576 wrote to memory of 1948	576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe
PID 576 wrote to memory of 1948	576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe
PID 576 wrote to memory of 1948	576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe
PID 576 wrote to memory of 1948	576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe
PID 576 wrote to memory of 1948	576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe
PID 576 wrote to memory of 1948	576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe
PID 576 wrote to memory of 1948	576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe
PID 576 wrote to memory of 1948	576	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe	d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe

C:\Users\Admin\AppData\Local\Temp\d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe
"C:\Users\Admin\AppData\Local\Temp\d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Users\Admin\AppData\Local\Temp\d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe
C:\Users\Admin\AppData\Local\Temp\d3709777baef696ae4502fc371784000200245d6769ba94e1a80d21d2b800358.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-54-0x0000000000890000-0x0000000000A50000-memory.dmp

Filesize
1.8MB

Download
memory/576-55-0x00000000022A0000-0x0000000002382000-memory.dmp

Filesize
904KB

Download
memory/576-56-0x0000000004480000-0x0000000004512000-memory.dmp

Filesize
584KB

Download
memory/944-57-0x0000000000000000-mapping.dmp

Download
memory/944-58-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download
memory/944-59-0x000000006FAB0000-0x000000007005B000-memory.dmp

Filesize
5.7MB

Download
memory/944-60-0x000000006FAB0000-0x000000007005B000-memory.dmp

Filesize
5.7MB

Download
memory/944-61-0x000000006FAB0000-0x000000007005B000-memory.dmp

Filesize
5.7MB

Download
memory/1948-62-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1948-63-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1948-65-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1948-66-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1948-67-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1948-68-0x000000000047E79E-mapping.dmp

Download
memory/1948-70-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1948-72-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads