quasar | ab991f490e6b779f70f684ac6742c6ba25be045822695bfc02fa0dd1c6e423c2

General

Target

11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e.exe
Size

1.0MB
MD5

d1c929278c8a9455e511c54af3fa83f0
SHA1

d84ec50973b36bd214cd43ebb1baac6b2cdc8b83
SHA256

11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e
SHA512

b1aeff9ffc7a76d80ba6e3999ed2a47b10d42e9d2bbe690617b71d59762ba64040088dc5b18905634c59bfb84dd85023e8619303386877f5f71969eb21b9b8d8
SSDEEP

24576:M+ynkc1ZzBvtrZHFjMKY2SrtxeloGEoUDwc81iwJZ:pynkc1ZzBvtrZHFjMKY2+xeloGEzDx8l

Score

10^/10

quasar venom client persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

2.7.0.0

Botnet

Venom Client

C2

markphoto.casacam.net:5000

Mutex

JlYM51eW4iZoFyLa2X

Attributes

encryption_key
Xs9khGbxnXFgwtiuru4Q
install_name
Venom.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1996-54-0x0000000000C30000-0x0000000000D40000-memory.dmp	family_quasar

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Venom Client Startup = "C:\\Users\\Admin\\AppData\\Roaming\\Venom.exe"	WScript.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1708 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e.exe

description pid process

Token: SeDebugPrivilege 1996 11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e.exe

flow	ioc
1	ip-api.com

pid	process
1708	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1996	11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e.exeexplorer.exe

description	pid	process	target process
PID 1996 wrote to memory of 1708	1996	11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e.exe	schtasks.exe
PID 1996 wrote to memory of 1708	1996	11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e.exe	schtasks.exe
PID 1996 wrote to memory of 1708	1996	11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e.exe	schtasks.exe
PID 1996 wrote to memory of 1708	1996	11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e.exe	schtasks.exe
PID 1996 wrote to memory of 1744	1996	11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e.exe	explorer.exe
PID 1996 wrote to memory of 1744	1996	11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e.exe	explorer.exe
PID 1996 wrote to memory of 1744	1996	11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e.exe	explorer.exe
PID 1996 wrote to memory of 1744	1996	11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e.exe	explorer.exe
PID 1132 wrote to memory of 1084	1132	explorer.exe	WScript.exe
PID 1132 wrote to memory of 1084	1132	explorer.exe	WScript.exe
PID 1132 wrote to memory of 1084	1132	explorer.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e.exe
"C:\Users\Admin\AppData\Local\Temp\11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Venom.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1708

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Execution.vbs
2⤵
PID:1744

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1132

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Execution.vbs"
2⤵
- Adds Run key to start application
PID:1084

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Execution.vbs
Filesize
487B

MD5
c615faeefc28c1044bdfb204a6227aa6

SHA1
b60b35a1e074a99ec3f51757f7119d85d996982d

SHA256
e3e3827040baa12d5c07f0dd976f890a96e11fd58767845db161d4192282e330

SHA512
dffdbb0d8adfd383ef80af421cc876f4f1aa3a68ac408dd2e01dcc30ad5fbd7cf5ac2203d280eef683aa4cf73ac6863c3c473a1f62ff9011981731d98b77d498

Download Submit
memory/1996-54-0x0000000000C30000-0x0000000000D40000-memory.dmp

Filesize
1.1MB

Download
memory/1996-55-0x0000000004B90000-0x0000000004BD0000-memory.dmp

Filesize
256KB

Download
memory/1996-59-0x0000000004B90000-0x0000000004BD0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads