quasar | 51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f

Resubmissions

19-09-2023 04:16

230919-evw21aeg6z 10

19-09-2023 03:45

230919-ebdfjsef3t 10

Analysis

max time kernel
288s
max time network
300s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-09-2023 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exe
Size

3.1MB
MD5

28e03a0e0871a90ee993db029c25ded5
SHA1

651f0c06a5d0bf37a8a7987626a89135b5384459
SHA256

51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f
SHA512

c13997f114735d9db85205b7b76f5236c0721babd850528bd066d0ed0059bd82650008bf52a8172a9a183ad8b90beb16c39b682511c6750d896ef99c10a57a60
SSDEEP

49152:q+4bzTvij0votBkRPJMMB+9YUkSk+yfzBcpoG9SbTHHB72eh2NT:q+i/i5tBkRPJMM2YUkSk5u

Score

10^/10

quasar cunt spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

cunt

37.139.129.145:5512

37.139.129.145:5505

Mutex

5a092138-836c-4206-9af6-8a540736ef07

Attributes

encryption_key
D21B49539C3EA494897D43CF75CBF5F989F0792A
install_name
ntoskrnl.exe
log_directory
SystemLogs
reconnect_delay
3000
startup_key
Kernel
subdirectory
Kernel

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2176-0-0x0000000000200000-0x0000000000522000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\Kernel\ntoskrnl.exe	family_quasar
C:\Users\Admin\AppData\Roaming\Kernel\ntoskrnl.exe	family_quasar
behavioral1/memory/2604-9-0x0000000000B30000-0x0000000000E52000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

ntoskrnl.exe

pid process

2604 ntoskrnl.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2088 schtasks.exe
2772 schtasks.exe

pid	process
2604	ntoskrnl.exe

pid	process
2088	schtasks.exe
2772	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exentoskrnl.exe

description	pid	process
Token: SeDebugPrivilege	2176	51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exe
Token: SeDebugPrivilege	2604	ntoskrnl.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ntoskrnl.exe

pid process

2604 ntoskrnl.exe

pid	process
2604	ntoskrnl.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exentoskrnl.exe

description	pid	process	target process
PID 2176 wrote to memory of 2088	2176	51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exe	schtasks.exe
PID 2176 wrote to memory of 2088	2176	51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exe	schtasks.exe
PID 2176 wrote to memory of 2088	2176	51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exe	schtasks.exe
PID 2176 wrote to memory of 2604	2176	51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exe	ntoskrnl.exe
PID 2176 wrote to memory of 2604	2176	51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exe	ntoskrnl.exe
PID 2176 wrote to memory of 2604	2176	51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exe	ntoskrnl.exe
PID 2604 wrote to memory of 2772	2604	ntoskrnl.exe	schtasks.exe
PID 2604 wrote to memory of 2772	2604	ntoskrnl.exe	schtasks.exe
PID 2604 wrote to memory of 2772	2604	ntoskrnl.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exe
"C:\Users\Admin\AppData\Local\Temp\51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Kernel" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Kernel\ntoskrnl.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2088

C:\Users\Admin\AppData\Roaming\Kernel\ntoskrnl.exe
"C:\Users\Admin\AppData\Roaming\Kernel\ntoskrnl.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Kernel" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Kernel\ntoskrnl.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Kernel\ntoskrnl.exe

Filesize
3.1MB

MD5
28e03a0e0871a90ee993db029c25ded5

SHA1
651f0c06a5d0bf37a8a7987626a89135b5384459

SHA256
51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f

SHA512
c13997f114735d9db85205b7b76f5236c0721babd850528bd066d0ed0059bd82650008bf52a8172a9a183ad8b90beb16c39b682511c6750d896ef99c10a57a60

Download Submit
C:\Users\Admin\AppData\Roaming\Kernel\ntoskrnl.exe

Filesize
3.1MB

MD5
28e03a0e0871a90ee993db029c25ded5

SHA1
651f0c06a5d0bf37a8a7987626a89135b5384459

SHA256
51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f

SHA512
c13997f114735d9db85205b7b76f5236c0721babd850528bd066d0ed0059bd82650008bf52a8172a9a183ad8b90beb16c39b682511c6750d896ef99c10a57a60

Download Submit
memory/2176-0-0x0000000000200000-0x0000000000522000-memory.dmp

Filesize
3.1MB

Download
memory/2176-1-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

Filesize
9.9MB

Download
memory/2176-2-0x000000001B2B0000-0x000000001B330000-memory.dmp

Filesize
512KB

Download
memory/2176-8-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

Filesize
9.9MB

Download
memory/2604-10-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

Filesize
9.9MB

Download
memory/2604-9-0x0000000000B30000-0x0000000000E52000-memory.dmp

Filesize
3.1MB

Download
memory/2604-11-0x000000001B380000-0x000000001B400000-memory.dmp

Filesize
512KB

Download
memory/2604-12-0x000007FEF5B80000-0x000007FEF656C000-memory.dmp

Filesize
9.9MB

Download
memory/2604-13-0x000000001B380000-0x000000001B400000-memory.dmp

Filesize
512KB

Download