quasar | b6d5b869720645aefed2e060c1828fa54bfb4faedbe9bebc5d41928110b2ab2d

Analysis

max time kernel
1047s
max time network
1051s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2023 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UD.exe
Size

3.1MB
MD5

8eeb2a1b1c1f5abb96801789585eb940
SHA1

4ad1d0f1a048ba9615dccd16fae6526180365499
SHA256

b6d5b869720645aefed2e060c1828fa54bfb4faedbe9bebc5d41928110b2ab2d
SHA512

62f216a6920f393ab9a68a8dc83b8559fe4ef3a770a092ec4f046a189bf57a10cb2a43a8c1299b828ad5cde62f2415e510af47f94b49fa9e0f510b0b0b4bf4a2
SSDEEP

49152:yvFt62XlaSFNWPjljiFa2RoUYIXQRJ6mbR3LoGdPNTHHB72eh2NT:yv362XlaSFNWPjljiFXRoUYIXQRJ6g

Score

10^/10

quasar reservices spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

ReServices

bobbawb1000.duckdns.org:59955

Mutex

a97b7b05-f9a6-4a97-9f99-a2119823cf8f

Attributes

encryption_key
B451C26057A2AEFC83990793720D2316EA48C49A
install_name
renservice.exe
log_directory
Logs
reconnect_delay
3000
startup_key
renservice
subdirectory
servicerenk

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1500-133-0x0000000000AE0000-0x0000000000E04000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\servicerenk\renservice.exe	family_quasar
C:\Users\Admin\AppData\Roaming\servicerenk\renservice.exe	family_quasar

Executes dropped EXE 1 IoCs

Processes:

renservice.exe

pid process

4232 renservice.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

412 schtasks.exe
1560 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

UD.exerenservice.exe

description pid process

Token: SeDebugPrivilege 1500 UD.exe
Token: SeDebugPrivilege 4232 renservice.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

renservice.exe

pid process

4232 renservice.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

renservice.exe

pid process

4232 renservice.exe

pid	process
4232	renservice.exe

pid	process
412	schtasks.exe
1560	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1500	UD.exe
Token: SeDebugPrivilege	4232	renservice.exe

pid	process
4232	renservice.exe

pid	process
4232	renservice.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

UD.exerenservice.exe

description	pid	process	target process
PID 1500 wrote to memory of 412	1500	UD.exe	schtasks.exe
PID 1500 wrote to memory of 412	1500	UD.exe	schtasks.exe
PID 1500 wrote to memory of 4232	1500	UD.exe	renservice.exe
PID 1500 wrote to memory of 4232	1500	UD.exe	renservice.exe
PID 4232 wrote to memory of 1560	4232	renservice.exe	schtasks.exe
PID 4232 wrote to memory of 1560	4232	renservice.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\UD.exe
"C:\Users\Admin\AppData\Local\Temp\UD.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "renservice" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\servicerenk\renservice.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:412

C:\Users\Admin\AppData\Roaming\servicerenk\renservice.exe
"C:\Users\Admin\AppData\Roaming\servicerenk\renservice.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4232

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "renservice" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\servicerenk\renservice.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\servicerenk\renservice.exe
Filesize
3.1MB

MD5
8eeb2a1b1c1f5abb96801789585eb940

SHA1
4ad1d0f1a048ba9615dccd16fae6526180365499

SHA256
b6d5b869720645aefed2e060c1828fa54bfb4faedbe9bebc5d41928110b2ab2d

SHA512
62f216a6920f393ab9a68a8dc83b8559fe4ef3a770a092ec4f046a189bf57a10cb2a43a8c1299b828ad5cde62f2415e510af47f94b49fa9e0f510b0b0b4bf4a2

Download Submit
C:\Users\Admin\AppData\Roaming\servicerenk\renservice.exe
Filesize
3.1MB

MD5
8eeb2a1b1c1f5abb96801789585eb940

SHA1
4ad1d0f1a048ba9615dccd16fae6526180365499

SHA256
b6d5b869720645aefed2e060c1828fa54bfb4faedbe9bebc5d41928110b2ab2d

SHA512
62f216a6920f393ab9a68a8dc83b8559fe4ef3a770a092ec4f046a189bf57a10cb2a43a8c1299b828ad5cde62f2415e510af47f94b49fa9e0f510b0b0b4bf4a2

Download Submit
memory/1500-133-0x0000000000AE0000-0x0000000000E04000-memory.dmp

Filesize
3.1MB

Download
memory/1500-134-0x000000001BA80000-0x000000001BA90000-memory.dmp

Filesize
64KB

Download
memory/4232-141-0x000000001BBB0000-0x000000001BBC0000-memory.dmp

Filesize
64KB

Download
memory/4232-142-0x000000001C6F0000-0x000000001C740000-memory.dmp

Filesize
320KB

Download
memory/4232-143-0x000000001C800000-0x000000001C8B2000-memory.dmp

Filesize
712KB

Download
memory/4232-144-0x000000001BBB0000-0x000000001BBC0000-memory.dmp

Filesize
64KB

Download