quasar | 0519a93b01b9929423e8313cc6f425f596d19ace6e81d0d3d3749703fc236188

General

Target

Client-built.exe
Size

342KB
MD5

0b0287fdaa9bea5c3289fee8e4677e46
SHA1

5f2dcbfd4348c88f772d8b50746f7ba989aade90
SHA256

5b045134161e8922ea16d3aae401edbe088113690fa7aacacb274481150f8872
SHA512

420cfb68b777c0acb94566e9adb04b0fb89ff41d0f517cb51d8a3e3de7c03c38a48662c964ab92c0a0e082fe39a636ac69bbe0c4144ef2bafc329a7c5bea7592
SSDEEP

6144:f0N453rTzUAGKXIl3q09GeRpeP6aqSAXAkacT73/GVzebSfMgMtRz:f0N41zUiIl3f9GeRq6aqSAXAkp73Szm3

Score

10^/10

quasar persistence spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Executes dropped EXE 4 IoCs

pid	Process
1276	Start.exe
1812	Start.exe
1476	Start.exe
1012	Start.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quasar Client Startup = "\"C:\\Users\\Admin\\AppData\\Roaming\\Python\\Start.exe\""	Start.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
764	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	Client-built.exe
Token: SeDebugPrivilege	1276	Start.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1276	1960	Client-built.exe	29
PID 1960 wrote to memory of 1276	1960	Client-built.exe	29
PID 1960 wrote to memory of 1276	1960	Client-built.exe	29
PID 1276 wrote to memory of 764	1276	Start.exe	30
PID 1276 wrote to memory of 764	1276	Start.exe	30
PID 1276 wrote to memory of 764	1276	Start.exe	30
PID 1684 wrote to memory of 1812	1684	taskeng.exe	33
PID 1684 wrote to memory of 1812	1684	taskeng.exe	33
PID 1684 wrote to memory of 1812	1684	taskeng.exe	33
PID 1684 wrote to memory of 1476	1684	taskeng.exe	34
PID 1684 wrote to memory of 1476	1684	taskeng.exe	34
PID 1684 wrote to memory of 1476	1684	taskeng.exe	34
PID 1684 wrote to memory of 1012	1684	taskeng.exe	35
PID 1684 wrote to memory of 1012	1684	taskeng.exe	35
PID 1684 wrote to memory of 1012	1684	taskeng.exe	35

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Roaming\Python\Start.exe
  "C:\Users\Admin\AppData\Roaming\Python\Start.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "WINDOWSSYSTEMHOST" /tr "C:\Users\Admin\AppData\Roaming\Python\Start.exe" /sc MINUTE /MO 1
    3⤵
    - Creates scheduled task(s)
    PID:764

C:\Windows\system32\taskeng.exe
taskeng.exe {363C5225-D60E-4F6C-A060-7CBA75C4FCF5} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Roaming\Python\Start.exe
  C:\Users\Admin\AppData\Roaming\Python\Start.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Users\Admin\AppData\Roaming\Python\Start.exe
  C:\Users\Admin\AppData\Roaming\Python\Start.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Users\Admin\AppData\Roaming\Python\Start.exe
  C:\Users\Admin\AppData\Roaming\Python\Start.exe
  2⤵
  - Executes dropped EXE
  PID:1012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Python\Start.exe

Filesize
342KB

MD5
0b0287fdaa9bea5c3289fee8e4677e46

SHA1
5f2dcbfd4348c88f772d8b50746f7ba989aade90

SHA256
5b045134161e8922ea16d3aae401edbe088113690fa7aacacb274481150f8872

SHA512
420cfb68b777c0acb94566e9adb04b0fb89ff41d0f517cb51d8a3e3de7c03c38a48662c964ab92c0a0e082fe39a636ac69bbe0c4144ef2bafc329a7c5bea7592

Download Submit
C:\Users\Admin\AppData\Roaming\Python\Start.exe

Filesize
342KB

MD5
0b0287fdaa9bea5c3289fee8e4677e46

SHA1
5f2dcbfd4348c88f772d8b50746f7ba989aade90

SHA256
5b045134161e8922ea16d3aae401edbe088113690fa7aacacb274481150f8872

SHA512
420cfb68b777c0acb94566e9adb04b0fb89ff41d0f517cb51d8a3e3de7c03c38a48662c964ab92c0a0e082fe39a636ac69bbe0c4144ef2bafc329a7c5bea7592

Download Submit
C:\Users\Admin\AppData\Roaming\Python\Start.exe

Filesize
342KB

MD5
0b0287fdaa9bea5c3289fee8e4677e46

SHA1
5f2dcbfd4348c88f772d8b50746f7ba989aade90

SHA256
5b045134161e8922ea16d3aae401edbe088113690fa7aacacb274481150f8872

SHA512
420cfb68b777c0acb94566e9adb04b0fb89ff41d0f517cb51d8a3e3de7c03c38a48662c964ab92c0a0e082fe39a636ac69bbe0c4144ef2bafc329a7c5bea7592

Download Submit
C:\Users\Admin\AppData\Roaming\Python\Start.exe

Filesize
342KB

MD5
0b0287fdaa9bea5c3289fee8e4677e46

SHA1
5f2dcbfd4348c88f772d8b50746f7ba989aade90

SHA256
5b045134161e8922ea16d3aae401edbe088113690fa7aacacb274481150f8872

SHA512
420cfb68b777c0acb94566e9adb04b0fb89ff41d0f517cb51d8a3e3de7c03c38a48662c964ab92c0a0e082fe39a636ac69bbe0c4144ef2bafc329a7c5bea7592

Download Submit
C:\Users\Admin\AppData\Roaming\Python\Start.exe

Filesize
342KB

MD5
0b0287fdaa9bea5c3289fee8e4677e46

SHA1
5f2dcbfd4348c88f772d8b50746f7ba989aade90

SHA256
5b045134161e8922ea16d3aae401edbe088113690fa7aacacb274481150f8872

SHA512
420cfb68b777c0acb94566e9adb04b0fb89ff41d0f517cb51d8a3e3de7c03c38a48662c964ab92c0a0e082fe39a636ac69bbe0c4144ef2bafc329a7c5bea7592

Download Submit
memory/1276-59-0x0000000000B50000-0x0000000000B58000-memory.dmp

Filesize
32KB

Download
memory/1960-54-0x0000000000840000-0x0000000000848000-memory.dmp

Filesize
32KB

Download
memory/1960-55-0x000000001AAF0000-0x000000001AB8E000-memory.dmp

Filesize
632KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads