quasar | 59b2725f7466da2b7426c5d2b64af386c128e313738a0cd5a838a5ec3ca90b5c

Analysis

max time kernel
261s
max time network
308s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59b2725f7466da2b7426c5d2b64af386c128e313738a0cd5a838a5ec3ca90b5c.exe
Size

2.7MB
MD5

533a8b7d2d523e95e31f517ea0e432de
SHA1

64e003d9c733196f1c1569ee40c64983cc6e4127
SHA256

59b2725f7466da2b7426c5d2b64af386c128e313738a0cd5a838a5ec3ca90b5c
SHA512

b777d95be33e9b9cd5e0f4e5d9c494b83be0f835697bf9b358c7cc93acf6f2ef35f2ac502b9f96030c0262a0c5289d072b0920cd9ea46eea0fa1b4cc59136c4f
SSDEEP

49152:NUF0bDj03kJVsDZj3dE1juUo5XipVmaiDQ2EX8q8bgZvakhJGFLBz8LS:NUFUjmmVsDhNYj/VpVzh2I4S0FLBz8LS

Score

10^/10

quasar rat spyware trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

RAT

23.105.131.178:7812

Mutex

VNM_MUTEX_gdy9bWxR0te3WgTRnI

Attributes

encryption_key
MDXzdQumRqZGIeya7nG9
install_name
Windows Defender Security.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
Microsoft

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x0007000000022dbc-134.dat	disable_win_def
behavioral2/files/0x0007000000022dbc-135.dat	disable_win_def

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000022dbc-134.dat	family_quasar
behavioral2/files/0x0007000000022dbc-135.dat	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
4464	Windows Defender Security.exe
1764	Amazon valid emails by Scorpio.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	59b2725f7466da2b7426c5d2b64af386c128e313738a0cd5a838a5ec3ca90b5c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 4464	2664	59b2725f7466da2b7426c5d2b64af386c128e313738a0cd5a838a5ec3ca90b5c.exe	83
PID 2664 wrote to memory of 4464	2664	59b2725f7466da2b7426c5d2b64af386c128e313738a0cd5a838a5ec3ca90b5c.exe	83
PID 2664 wrote to memory of 4464	2664	59b2725f7466da2b7426c5d2b64af386c128e313738a0cd5a838a5ec3ca90b5c.exe	83
PID 2664 wrote to memory of 1764	2664	59b2725f7466da2b7426c5d2b64af386c128e313738a0cd5a838a5ec3ca90b5c.exe	84
PID 2664 wrote to memory of 1764	2664	59b2725f7466da2b7426c5d2b64af386c128e313738a0cd5a838a5ec3ca90b5c.exe	84
PID 2664 wrote to memory of 1764	2664	59b2725f7466da2b7426c5d2b64af386c128e313738a0cd5a838a5ec3ca90b5c.exe	84

C:\Users\Admin\AppData\Local\Temp\59b2725f7466da2b7426c5d2b64af386c128e313738a0cd5a838a5ec3ca90b5c.exe
"C:\Users\Admin\AppData\Local\Temp\59b2725f7466da2b7426c5d2b64af386c128e313738a0cd5a838a5ec3ca90b5c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe
  "C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe"
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Users\Admin\AppData\Roaming\Amazon valid emails by Scorpio.exe
  "C:\Users\Admin\AppData\Roaming\Amazon valid emails by Scorpio.exe"
  2⤵
  - Executes dropped EXE
  PID:1764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Amazon valid emails by Scorpio.exe

Filesize
2.8MB

MD5
555a824b8efc10e007b77675161fbfb8

SHA1
b4cf844d2bdd4580aa469341e8613ff6a67d2111

SHA256
e458a300574507d1bc999871b5a679494d69eef97c2fcff42715e3148d57646e

SHA512
b4fb2092fb1cf6ee94700e29336b0c109f4f2f8a8fcd53e56b136ff62d124d342024496281accaede0b84a5e46e2f7350f3f31b4a1e2d2ffd02436f61b78be8d

Download Submit
C:\Users\Admin\AppData\Roaming\Amazon valid emails by Scorpio.exe

Filesize
2.8MB

MD5
555a824b8efc10e007b77675161fbfb8

SHA1
b4cf844d2bdd4580aa469341e8613ff6a67d2111

SHA256
e458a300574507d1bc999871b5a679494d69eef97c2fcff42715e3148d57646e

SHA512
b4fb2092fb1cf6ee94700e29336b0c109f4f2f8a8fcd53e56b136ff62d124d342024496281accaede0b84a5e46e2f7350f3f31b4a1e2d2ffd02436f61b78be8d

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe

Filesize
535KB

MD5
6f3b107a20b18244efb6473bae2544b1

SHA1
dc02ec107547c515bffeadcd87e6308c3bdfd390

SHA256
2b23c8f0299f92a4ba0f7d4eea26316cf2ffae2eaf41767ce452464c9951b2a0

SHA512
318b51a7bc6a37f9a4d2ee528d66124b541c9d3f2002ad7a15456071fe090cdb264f6439dbc3fa5471200d2faf5217d01af56b3eafa2830917480b080d31161c

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe

Filesize
535KB

MD5
6f3b107a20b18244efb6473bae2544b1

SHA1
dc02ec107547c515bffeadcd87e6308c3bdfd390

SHA256
2b23c8f0299f92a4ba0f7d4eea26316cf2ffae2eaf41767ce452464c9951b2a0

SHA512
318b51a7bc6a37f9a4d2ee528d66124b541c9d3f2002ad7a15456071fe090cdb264f6439dbc3fa5471200d2faf5217d01af56b3eafa2830917480b080d31161c

Download Submit
memory/2664-132-0x00000000749F0000-0x0000000074FA1000-memory.dmp

Filesize
5.7MB

Download
memory/2664-139-0x00000000749F0000-0x0000000074FA1000-memory.dmp

Filesize
5.7MB

Download