quasar | 2f17290edaf08835afe238abbbe0d7e5f3e68bf1cf57ceac0bbb8fca463d5235

General

Target

8ae7b875a0d70a25b691551190da4549.exe
Size

348KB
MD5

8ae7b875a0d70a25b691551190da4549
SHA1

291c0ea30050288c58eb6e1b20004e20b3b223c0
SHA256

2f17290edaf08835afe238abbbe0d7e5f3e68bf1cf57ceac0bbb8fca463d5235
SHA512

d2519dc2d5cb867dc0a64e16cf04573e39e9ed75f818371c35f08572ffea176d48ac27c798a7cb834ee0f866405a9677c2a4d2ee0bf2e40ec44a074e81e759bf
SSDEEP

6144:si6bPXhLApfpx2putsmVQby/vOMUUw3biFsyPO:PmhAprb6qj/vO2IbiFsyPO

Score

10^/10

quasar taskhostd persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

taskhostd

C2

205.185.126.148:666

Mutex

QSR_MUTEX_eKOC3FxUJYmTXUa6V7

Attributes

encryption_key
ZVXr7UpQvBNrKfbqvT2X
install_name
svchosts.exe
log_directory
Logs
reconnect_delay
300
startup_key
svhosts
subdirectory
subdir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral2/memory/4292-132-0x0000000000FD0000-0x000000000102E000-memory.dmp	family_quasar
behavioral2/files/0x0006000000022e30-140.dat	family_quasar
behavioral2/files/0x0006000000022e30-141.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
1696	svchosts.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhosts = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\8ae7b875a0d70a25b691551190da4549.exe\""	8ae7b875a0d70a25b691551190da4549.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhosts = "\"C:\\Users\\Admin\\AppData\\Roaming\\subdir\\svchosts.exe\""	svchosts.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	ip-api.com

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3592	schtasks.exe
1152	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	8ae7b875a0d70a25b691551190da4549.exe
Token: SeDebugPrivilege	1696	svchosts.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1696	svchosts.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 1152	4292	8ae7b875a0d70a25b691551190da4549.exe	80
PID 4292 wrote to memory of 1152	4292	8ae7b875a0d70a25b691551190da4549.exe	80
PID 4292 wrote to memory of 1152	4292	8ae7b875a0d70a25b691551190da4549.exe	80
PID 4292 wrote to memory of 1696	4292	8ae7b875a0d70a25b691551190da4549.exe	82
PID 4292 wrote to memory of 1696	4292	8ae7b875a0d70a25b691551190da4549.exe	82
PID 4292 wrote to memory of 1696	4292	8ae7b875a0d70a25b691551190da4549.exe	82
PID 1696 wrote to memory of 3592	1696	svchosts.exe	83
PID 1696 wrote to memory of 3592	1696	svchosts.exe	83
PID 1696 wrote to memory of 3592	1696	svchosts.exe	83

C:\Users\Admin\AppData\Local\Temp\8ae7b875a0d70a25b691551190da4549.exe
"C:\Users\Admin\AppData\Local\Temp\8ae7b875a0d70a25b691551190da4549.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "svhosts" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\8ae7b875a0d70a25b691551190da4549.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1152
- C:\Users\Admin\AppData\Roaming\subdir\svchosts.exe
  "C:\Users\Admin\AppData\Roaming\subdir\svchosts.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "svhosts" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\subdir\svchosts.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\subdir\svchosts.exe

Filesize
348KB

MD5
8ae7b875a0d70a25b691551190da4549

SHA1
291c0ea30050288c58eb6e1b20004e20b3b223c0

SHA256
2f17290edaf08835afe238abbbe0d7e5f3e68bf1cf57ceac0bbb8fca463d5235

SHA512
d2519dc2d5cb867dc0a64e16cf04573e39e9ed75f818371c35f08572ffea176d48ac27c798a7cb834ee0f866405a9677c2a4d2ee0bf2e40ec44a074e81e759bf

Download Submit
C:\Users\Admin\AppData\Roaming\subdir\svchosts.exe

Filesize
348KB

MD5
8ae7b875a0d70a25b691551190da4549

SHA1
291c0ea30050288c58eb6e1b20004e20b3b223c0

SHA256
2f17290edaf08835afe238abbbe0d7e5f3e68bf1cf57ceac0bbb8fca463d5235

SHA512
d2519dc2d5cb867dc0a64e16cf04573e39e9ed75f818371c35f08572ffea176d48ac27c798a7cb834ee0f866405a9677c2a4d2ee0bf2e40ec44a074e81e759bf

Download Submit
memory/1696-143-0x0000000006700000-0x000000000670A000-memory.dmp

Filesize
40KB

Download
memory/4292-132-0x0000000000FD0000-0x000000000102E000-memory.dmp

Filesize
376KB

Download
memory/4292-133-0x00000000060A0000-0x0000000006644000-memory.dmp

Filesize
5.6MB

Download
memory/4292-134-0x0000000005A40000-0x0000000005AD2000-memory.dmp

Filesize
584KB

Download
memory/4292-135-0x0000000005DF0000-0x0000000005E56000-memory.dmp

Filesize
408KB

Download
memory/4292-136-0x0000000006B00000-0x0000000006B12000-memory.dmp

Filesize
72KB

Download
memory/4292-137-0x0000000006F30000-0x0000000006F6C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads