quasar | 7c7dce6e70752136091a003af64e199ca226b65136ea7403fee158f5458e07f4

Analysis

max time kernel
139s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2023 16:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7C7DCE6E70752136091A003AF64E199CA226B65136EA7.exe
Size

3.1MB
MD5

5106cc8b676f99d94f020c3416c4419e
SHA1

1f232fc810f3430cbd582b15c3624f7719d25f78
SHA256

7c7dce6e70752136091a003af64e199ca226b65136ea7403fee158f5458e07f4
SHA512

05a4893909d78a2d78ff4ba00827d73417f328e6fa7691a05dafb2d79433bc17a4e5d399174da02fdda9d3ef406c8c3d8fb28e8d4d9efa669be70912a957a6d8
SSDEEP

49152:z0an44t3co4c+ZgE09xV0QYHyv6NWPHHB72eh2NT:z0A44t3co43gE09x2U

Score

10^/10

quasar bot spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

bot

67.191.63.138:4781

Mutex

5e71212f-3f9b-4da2-b7e1-c0a0e90d92f3

Attributes

encryption_key
69F476AEBC36CDCB235187230CF3F99552BD1703
install_name
tasker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
tasker
subdirectory
Tasks

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4344-132-0x00000000000B0000-0x00000000003D2000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\Tasks\tasker.exe	family_quasar
C:\Users\Admin\AppData\Roaming\Tasks\tasker.exe	family_quasar

Executes dropped EXE 1 IoCs

Processes:

tasker.exe

pid process

1436 tasker.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 api.ipify.org
18 api.ipify.org
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

tasker.exe

pid process

1436 tasker.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7C7DCE6E70752136091A003AF64E199CA226B65136EA7.exetasker.exe

description pid process

Token: SeDebugPrivilege 4344 7C7DCE6E70752136091A003AF64E199CA226B65136EA7.exe
Token: SeDebugPrivilege 1436 tasker.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

tasker.exe

pid process

1436 tasker.exe

pid	process
1436	tasker.exe

flow	ioc
17	api.ipify.org
18	api.ipify.org

pid	process
1436	tasker.exe

description	pid	process
Token: SeDebugPrivilege	4344	7C7DCE6E70752136091A003AF64E199CA226B65136EA7.exe
Token: SeDebugPrivilege	1436	tasker.exe

pid	process
1436	tasker.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

7C7DCE6E70752136091A003AF64E199CA226B65136EA7.exe

description	pid	process	target process
PID 4344 wrote to memory of 1436	4344	7C7DCE6E70752136091A003AF64E199CA226B65136EA7.exe	tasker.exe
PID 4344 wrote to memory of 1436	4344	7C7DCE6E70752136091A003AF64E199CA226B65136EA7.exe	tasker.exe

C:\Users\Admin\AppData\Local\Temp\7C7DCE6E70752136091A003AF64E199CA226B65136EA7.exe
"C:\Users\Admin\AppData\Local\Temp\7C7DCE6E70752136091A003AF64E199CA226B65136EA7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344

C:\Users\Admin\AppData\Roaming\Tasks\tasker.exe
"C:\Users\Admin\AppData\Roaming\Tasks\tasker.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1436

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Tasks\tasker.exe
Filesize
3.1MB

MD5
5106cc8b676f99d94f020c3416c4419e

SHA1
1f232fc810f3430cbd582b15c3624f7719d25f78

SHA256
7c7dce6e70752136091a003af64e199ca226b65136ea7403fee158f5458e07f4

SHA512
05a4893909d78a2d78ff4ba00827d73417f328e6fa7691a05dafb2d79433bc17a4e5d399174da02fdda9d3ef406c8c3d8fb28e8d4d9efa669be70912a957a6d8

Download Submit
C:\Users\Admin\AppData\Roaming\Tasks\tasker.exe
Filesize
3.1MB

MD5
5106cc8b676f99d94f020c3416c4419e

SHA1
1f232fc810f3430cbd582b15c3624f7719d25f78

SHA256
7c7dce6e70752136091a003af64e199ca226b65136ea7403fee158f5458e07f4

SHA512
05a4893909d78a2d78ff4ba00827d73417f328e6fa7691a05dafb2d79433bc17a4e5d399174da02fdda9d3ef406c8c3d8fb28e8d4d9efa669be70912a957a6d8

Download Submit
memory/1436-134-0x0000000000000000-mapping.dmp

Download
memory/1436-138-0x00007FF817550000-0x00007FF818011000-memory.dmp

Filesize
10.8MB

Download
memory/1436-139-0x0000000000D10000-0x0000000000D60000-memory.dmp

Filesize
320KB

Download
memory/1436-140-0x000000001C530000-0x000000001C5E2000-memory.dmp

Filesize
712KB

Download
memory/1436-141-0x00007FF817550000-0x00007FF818011000-memory.dmp

Filesize
10.8MB

Download
memory/4344-132-0x00000000000B0000-0x00000000003D2000-memory.dmp

Filesize
3.1MB

Download
memory/4344-133-0x00007FF817550000-0x00007FF818011000-memory.dmp

Filesize
10.8MB

Download
memory/4344-137-0x00007FF817550000-0x00007FF818011000-memory.dmp

Filesize
10.8MB

Download