quasar | 3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8

General

Target

f6f83ba3f1e87503941e50b3e50d390f.exe
Size

17KB
MD5

f6f83ba3f1e87503941e50b3e50d390f
SHA1

6983d00bc9cda93f0da126504d99a851ffef6cea
SHA256

3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8
SHA512

d9afb2024c16229d1245d1c8faf1a5fb7b1c2a4c2e379078e0c70493c8dedc7fb76be3233c4e9757168382b27b8ae4f17726209af893297fe67838472443e3d4
SSDEEP

384:O0CqWx4t+dWNzuY7/aAygucwhb6v/uFi:O0CL4sBTguJmei

Score

10^/10

quasar revengerat office04 persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office04

C2

51.89.157.248:4782

Mutex

MvfU8Y7jQptTEqcSWG

Attributes

encryption_key
gfcyUhYEMEq5BWNn8aVX
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1708-72-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/1708-74-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/1708-73-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/1708-75-0x000000000044943E-mapping.dmp	family_quasar
behavioral1/memory/1708-77-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/1708-79-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f6f83ba3f1e87503941e50b3e50d390f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\DriverHelp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DriverHelp.exe\""	f6f83ba3f1e87503941e50b3e50d390f.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

f6f83ba3f1e87503941e50b3e50d390f.exe

description pid process target process

PID 1144 set thread context of 1708 1144 f6f83ba3f1e87503941e50b3e50d390f.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

680 powershell.exe
1272 powershell.exe

flow	ioc
6	ip-api.com

description	pid	process	target process
PID 1144 set thread context of 1708	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	RegAsm.exe

pid	process
680	powershell.exe
1272	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

f6f83ba3f1e87503941e50b3e50d390f.exepowershell.exepowershell.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1144	f6f83ba3f1e87503941e50b3e50d390f.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeDebugPrivilege	1708	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegAsm.exe

pid process

1708 RegAsm.exe

pid	process
1708	RegAsm.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

f6f83ba3f1e87503941e50b3e50d390f.execmd.exe

description	pid	process	target process
PID 1144 wrote to memory of 680	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	powershell.exe
PID 1144 wrote to memory of 680	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	powershell.exe
PID 1144 wrote to memory of 680	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	powershell.exe
PID 1144 wrote to memory of 680	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	powershell.exe
PID 1144 wrote to memory of 1536	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	cmd.exe
PID 1144 wrote to memory of 1536	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	cmd.exe
PID 1144 wrote to memory of 1536	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	cmd.exe
PID 1144 wrote to memory of 1536	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	cmd.exe
PID 1536 wrote to memory of 1272	1536	cmd.exe	powershell.exe
PID 1536 wrote to memory of 1272	1536	cmd.exe	powershell.exe
PID 1536 wrote to memory of 1272	1536	cmd.exe	powershell.exe
PID 1536 wrote to memory of 1272	1536	cmd.exe	powershell.exe
PID 1144 wrote to memory of 1708	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	RegAsm.exe
PID 1144 wrote to memory of 1708	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	RegAsm.exe
PID 1144 wrote to memory of 1708	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	RegAsm.exe
PID 1144 wrote to memory of 1708	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	RegAsm.exe
PID 1144 wrote to memory of 1708	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	RegAsm.exe
PID 1144 wrote to memory of 1708	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	RegAsm.exe
PID 1144 wrote to memory of 1708	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	RegAsm.exe
PID 1144 wrote to memory of 1708	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	RegAsm.exe
PID 1144 wrote to memory of 1708	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	RegAsm.exe
PID 1144 wrote to memory of 1708	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	RegAsm.exe
PID 1144 wrote to memory of 1708	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	RegAsm.exe
PID 1144 wrote to memory of 1708	1144	f6f83ba3f1e87503941e50b3e50d390f.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\f6f83ba3f1e87503941e50b3e50d390f.exe
"C:\Users\Admin\AppData\Local\Temp\f6f83ba3f1e87503941e50b3e50d390f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:680

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
2⤵
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1708

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
b186b09c4a95ed93a880968250c1776e

SHA1
f9282008d5a79287389c93fb9d14b1e8936983b4

SHA256
4d1a754b6fce5349017c2e5f90b8b5869158664abf3397d3e562b34946ea6577

SHA512
6b51396a19a199f52efd292a2feb18b68612a76f2e2656430a9a68401c3bdd88f30251b5d3fdeb7b2078b4925fcbb0b755e9dc2788b8f89d2cfc6c5f70e97cb2

Download Submit
memory/680-60-0x000000006F630000-0x000000006FBDB000-memory.dmp

Filesize
5.7MB

Download
memory/680-58-0x0000000000000000-mapping.dmp

Download
memory/680-61-0x000000006F630000-0x000000006FBDB000-memory.dmp

Filesize
5.7MB

Download
memory/680-62-0x000000006F630000-0x000000006FBDB000-memory.dmp

Filesize
5.7MB

Download
memory/1144-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1144-57-0x0000000005090000-0x0000000005122000-memory.dmp

Filesize
584KB

Download
memory/1144-54-0x0000000001170000-0x000000000117A000-memory.dmp

Filesize
40KB

Download
memory/1144-56-0x0000000005770000-0x00000000058E6000-memory.dmp

Filesize
1.5MB

Download
memory/1144-68-0x0000000004C40000-0x0000000004C9C000-memory.dmp

Filesize
368KB

Download
memory/1272-67-0x000000006F5F0000-0x000000006FB9B000-memory.dmp

Filesize
5.7MB

Download
memory/1272-64-0x0000000000000000-mapping.dmp

Download
memory/1536-63-0x0000000000000000-mapping.dmp

Download
memory/1708-75-0x000000000044943E-mapping.dmp

Download
memory/1708-70-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1708-72-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1708-74-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1708-73-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1708-69-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1708-77-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1708-79-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads