quasar | 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6

General

Target

BLToolsMod.exe
Size

763KB
MD5

869037e716218fb7551d84b8ce7d0ae7
SHA1

12cb776519eeb2d5e6a7ab1ddce3a09f143d5f18
SHA256

305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6
SHA512

6840e10d1daeacd169dba4a0049bc3b9087726dd45551b9a9587d57ec45d926356ce1656a39fdf35c1acb4020c564ec1f6a910fd83cde99e3ff75195728c72d2
SSDEEP

12288:SAZdPU5ttcsREhy5IYU8OaNISOvsk0gnT467zpmw7OfimWm/YfdFxfJ:S2UVc+EhyuAOaNIBXnT46fpmiOfimWy4

Score

10^/10

quasar office04 persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office04

C2

youhackernetpaingodxd.duckdns.org:5557

blablashitspreading.ddns.net:5557

Mutex

xEoEv3HHdyEIYwJRFM

Attributes

encryption_key
w3WfcmWh1iXT9cxeKFEX
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4780-147-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	BLToolsMod.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Updater-File.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Executes dropped EXE 1 IoCs

pid	Process
5088	Updater-File.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Driver.exe\""	Updater-File.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 4780	5088	Updater-File.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1384	5036	WerFault.exe	80

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4340	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4512	powershell.exe
4512	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	BLToolsMod.exe
Token: SeDebugPrivilege	5088	Updater-File.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	4780	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4780	RegAsm.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 5088	5036	BLToolsMod.exe	81
PID 5036 wrote to memory of 5088	5036	BLToolsMod.exe	81
PID 5036 wrote to memory of 5088	5036	BLToolsMod.exe	81
PID 5088 wrote to memory of 4512	5088	Updater-File.exe	84
PID 5088 wrote to memory of 4512	5088	Updater-File.exe	84
PID 5088 wrote to memory of 4512	5088	Updater-File.exe	84
PID 5088 wrote to memory of 4780	5088	Updater-File.exe	92
PID 5088 wrote to memory of 4780	5088	Updater-File.exe	92
PID 5088 wrote to memory of 4780	5088	Updater-File.exe	92
PID 5088 wrote to memory of 4780	5088	Updater-File.exe	92
PID 5088 wrote to memory of 4780	5088	Updater-File.exe	92
PID 5088 wrote to memory of 4780	5088	Updater-File.exe	92
PID 5088 wrote to memory of 4780	5088	Updater-File.exe	92
PID 5088 wrote to memory of 4780	5088	Updater-File.exe	92
PID 4780 wrote to memory of 4320	4780	RegAsm.exe	94
PID 4780 wrote to memory of 4320	4780	RegAsm.exe	94
PID 4780 wrote to memory of 4320	4780	RegAsm.exe	94
PID 4320 wrote to memory of 900	4320	cmd.exe	96
PID 4320 wrote to memory of 900	4320	cmd.exe	96
PID 4320 wrote to memory of 900	4320	cmd.exe	96
PID 4320 wrote to memory of 4340	4320	cmd.exe	97
PID 4320 wrote to memory of 4340	4320	cmd.exe	97
PID 4320 wrote to memory of 4340	4320	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\BLToolsMod.exe
"C:\Users\Admin\AppData\Local\Temp\BLToolsMod.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Users\Admin\AppData\Roaming\Updater-File.exe
  "C:\Users\Admin\AppData\Roaming\Updater-File.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4512
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iW69HWG2R85y.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4320
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:900
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:4340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 2096
  2⤵
  - Program crash
  PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5036 -ip 5036
1⤵
PID:3676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\iW69HWG2R85y.bat

Filesize
270B

MD5
7c6a3d8ef717b261449f12b39489ea30

SHA1
583f10c970719be4dc98b3b2ccdd735fc57a64ac

SHA256
af0b54e507cc4e9ab2dc0a2d93421139155ffc5385a879355fa768252a96b445

SHA512
6bd7d464e22051f13174089ac624c8ca01b4e2567c157e0e5bed30e1f56a9ea9c9afb70f6e468e0669aba7bf4d3478cef1d3074a841014f5ce08b308d9e45037

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\02-05-~1

Filesize
224B

MD5
a0b724fcea26adc37a1dc594a1861a41

SHA1
3c82509425896a1f0bfb6893e6d47d74bf8633be

SHA256
fae9982c374a9782a5de4dbdc1e4a415089ce502321339be375496f0a3322056

SHA512
160647bc9b97f6a81cb83cebdb0e31f27f7b0d2111cf47384b7f11e5fcaa7189cf635cc42f0be0d485f3dbdc5e7d8c69e6605a9123fc6dfac4576697892ae7e3

Download Submit
C:\Users\Admin\AppData\Roaming\Updater-File.exe

Filesize
6KB

MD5
be2c9d9f3e9206eb7d809157ea37d0ea

SHA1
79fc984efb6d9e58c21f7c5dee8de2fc44710f62

SHA256
f07ca31e483745ac9fe74da53f939a797f3f8868717eb29f9f0d1286b89f6b79

SHA512
2510583a2690be0c48614fa21d24c2919d6c4f704d897ed4bb5a523d0bbc3616bd2aba7a6b22120068a24aa756a9b6f37feeb2b8eb461b86c2eacde935478d4b

Download Submit
C:\Users\Admin\AppData\Roaming\Updater-File.exe

Filesize
6KB

MD5
be2c9d9f3e9206eb7d809157ea37d0ea

SHA1
79fc984efb6d9e58c21f7c5dee8de2fc44710f62

SHA256
f07ca31e483745ac9fe74da53f939a797f3f8868717eb29f9f0d1286b89f6b79

SHA512
2510583a2690be0c48614fa21d24c2919d6c4f704d897ed4bb5a523d0bbc3616bd2aba7a6b22120068a24aa756a9b6f37feeb2b8eb461b86c2eacde935478d4b

Download Submit
memory/4512-145-0x0000000006570000-0x000000000658A000-memory.dmp

Filesize
104KB

Download
memory/4512-140-0x00000000051D0000-0x00000000057F8000-memory.dmp

Filesize
6.2MB

Download
memory/4512-141-0x00000000059A0000-0x0000000005A06000-memory.dmp

Filesize
408KB

Download
memory/4512-142-0x0000000005A10000-0x0000000005A76000-memory.dmp

Filesize
408KB

Download
memory/4512-143-0x0000000006080000-0x000000000609E000-memory.dmp

Filesize
120KB

Download
memory/4512-144-0x00000000078D0000-0x0000000007F4A000-memory.dmp

Filesize
6.5MB

Download
memory/4512-139-0x0000000002AA0000-0x0000000002AD6000-memory.dmp

Filesize
216KB

Download
memory/4780-152-0x00000000065C0000-0x00000000065CA000-memory.dmp

Filesize
40KB

Download
memory/4780-148-0x00000000052E0000-0x0000000005884000-memory.dmp

Filesize
5.6MB

Download
memory/4780-149-0x0000000004E10000-0x0000000004EA2000-memory.dmp

Filesize
584KB

Download
memory/4780-150-0x0000000005E10000-0x0000000005E22000-memory.dmp

Filesize
72KB

Download
memory/4780-151-0x0000000006250000-0x000000000628C000-memory.dmp

Filesize
240KB

Download
memory/4780-147-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5036-132-0x0000000000340000-0x0000000000404000-memory.dmp

Filesize
784KB

Download
memory/5088-137-0x00000000069C0000-0x00000000069E2000-memory.dmp

Filesize
136KB

Download
memory/5088-136-0x0000000000DE0000-0x0000000000DE8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing