quasar | 814fde58d94356918c7bdcd449e46c28aeff737db12aa6307f4dbf87eaf09277

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24a21527f7cf342314dbec545ef09669.exe
Size 10.8MB
Sample231005-p7hegsbc3v
SHA256 814fde58d94356918c7bdcd449e46c28aeff737db12aa6307f4dbf87eaf09277
MD5 24a21527f7cf342314dbec545ef09669
SHA1 8d1ec0dfeb1e4903a2e41d2ea2fe9c8338f7e2fa
SHA512 1075ada1d5934721f6677defc9d873cc9c14a93b182b38ae976624ec6c0474a5c2490d178b8a87084a878a7fa9295cdd65594a8f7712741808e9a818f7932fd6
SSDEEP 49152:+4wKGjZqErb/TJvO90d7HjmAFd4A64nsfJVMa+AbKffcVHxoCtosmb4xWqXgHyVi:OZ2+ux8sayZSaEDVc/2P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar tru spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

msi.servet.site:4782
si.servet.site:4782

Mutex

e6014a62-7041-454f-9b62-24d01e22fdc4

Attributes

encryption_key
8EC54092718FA50F667C672F27638133FB074D00
install_name
Client.exe
log_directory
Msi
reconnect_delay
3000
startup_key
Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/3788-3-0x0000000000A10000-0x0000000000D34000-memory.dmp	family_quasar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1900 set thread context of 3788	1900	24a21527f7cf342314dbec545ef09669.exe	97

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1900	24a21527f7cf342314dbec545ef09669.exe
1900	24a21527f7cf342314dbec545ef09669.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3788	jsc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 3788	1900	24a21527f7cf342314dbec545ef09669.exe	97
PID 1900 wrote to memory of 3788	1900	24a21527f7cf342314dbec545ef09669.exe	97
PID 1900 wrote to memory of 3788	1900	24a21527f7cf342314dbec545ef09669.exe	97
PID 1900 wrote to memory of 3788	1900	24a21527f7cf342314dbec545ef09669.exe	97
PID 1900 wrote to memory of 3788	1900	24a21527f7cf342314dbec545ef09669.exe	97
PID 3788 wrote to memory of 3268	3788	jsc.exe	99
PID 3788 wrote to memory of 3268	3788	jsc.exe	99
PID 3788 wrote to memory of 3268	3788	jsc.exe	99

C:\Users\Admin\AppData\Local\Temp\24a21527f7cf342314dbec545ef09669.exe
"C:\Users\Admin\AppData\Local\Temp\24a21527f7cf342314dbec545ef09669.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-2-0x00007FF69E3B0000-0x00007FF69EED9000-memory.dmp

Download

memory/1900-13-0x00007FF69E3B0000-0x00007FF69EED9000-memory.dmp

Download

memory/3788-8-0x00000000053C0000-0x00000000053CA000-memory.dmp

Download

memory/3788-5-0x00000000058E0000-0x0000000005E84000-memory.dmp

Download

memory/3788-6-0x00000000053D0000-0x0000000005462000-memory.dmp

Download

memory/3788-7-0x00000000054C0000-0x00000000054D0000-memory.dmp

Download

memory/3788-4-0x00000000752C0000-0x0000000075A70000-memory.dmp

Download

memory/3788-10-0x00000000068B0000-0x0000000006EC8000-memory.dmp

Download

memory/3788-11-0x0000000006410000-0x0000000006460000-memory.dmp

Download

memory/3788-12-0x0000000006680000-0x0000000006732000-memory.dmp

Download

memory/3788-3-0x0000000000A10000-0x0000000000D34000-memory.dmp

Download

memory/3788-14-0x00000000752C0000-0x0000000075A70000-memory.dmp

Download

memory/3788-15-0x00000000054C0000-0x00000000054D0000-memory.dmp

Download