quasar | 38da47e30f2fdac36749e0cbf2670c00fcff778f5ca9c543734271cce7116be9

General

Target

20bde1fda3d779a90e7c7b9ff305707a.exe
Size

3.1MB
MD5

20bde1fda3d779a90e7c7b9ff305707a
SHA1

41f4d3975a698602b59b1a333d2ff338ab4046b2
SHA256

38da47e30f2fdac36749e0cbf2670c00fcff778f5ca9c543734271cce7116be9
SHA512

c9bead404244d75a341d694c7ccad051f12b0f6a4194793072dfa87e1b4ed4e4cfe9ab2732ef758c311c1b93df7a6da94103e252012f81781423fc9163cb4be8
SSDEEP

49152:XvClL26AaNeWgPhlmVqvMQ7XSKXOBrmMf/IoGdEJbTHHB72eh2NT:Xv6L26AaNeWgPhlmVqkQ7XSKXOBrG

Score

10^/10

quasar vm spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

VM

C2

192.168.1.9:4782

Mutex

6c756287-c4ff-4a15-a573-78b63a105013

Attributes

encryption_key
6964046A47D2126B973C642C58E5CF169F21AB76
install_name
HWIDUnbanFN.exe
log_directory
Logs
reconnect_delay
3000
startup_key
WindowsDefenderService
subdirectory
WindowsSubFolder

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral2/memory/4944-0-0x0000000000AE0000-0x0000000000E04000-memory.dmp	family_quasar
behavioral2/files/0x00060000000231c7-7.dat	family_quasar
behavioral2/files/0x00060000000231c7-5.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
3524	HWIDUnbanFN.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\WindowsSubFolder\HWIDUnbanFN.exe	20bde1fda3d779a90e7c7b9ff305707a.exe
File opened for modification	C:\Windows\system32\WindowsSubFolder\HWIDUnbanFN.exe	20bde1fda3d779a90e7c7b9ff305707a.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3852	schtasks.exe
2308	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	20bde1fda3d779a90e7c7b9ff305707a.exe
Token: SeDebugPrivilege	3524	HWIDUnbanFN.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3524	HWIDUnbanFN.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 2308	4944	20bde1fda3d779a90e7c7b9ff305707a.exe	27
PID 4944 wrote to memory of 2308	4944	20bde1fda3d779a90e7c7b9ff305707a.exe	27
PID 4944 wrote to memory of 3524	4944	20bde1fda3d779a90e7c7b9ff305707a.exe	28
PID 4944 wrote to memory of 3524	4944	20bde1fda3d779a90e7c7b9ff305707a.exe	28
PID 3524 wrote to memory of 3852	3524	HWIDUnbanFN.exe	40
PID 3524 wrote to memory of 3852	3524	HWIDUnbanFN.exe	40

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\20bde1fda3d779a90e7c7b9ff305707a.exe
"C:\Users\Admin\AppData\Local\Temp\20bde1fda3d779a90e7c7b9ff305707a.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "WindowsDefenderService" /sc ONLOGON /tr "C:\Windows\system32\WindowsSubFolder\HWIDUnbanFN.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2308
- C:\Windows\system32\WindowsSubFolder\HWIDUnbanFN.exe
  "C:\Windows\system32\WindowsSubFolder\HWIDUnbanFN.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "WindowsDefenderService" /sc ONLOGON /tr "C:\Windows\system32\WindowsSubFolder\HWIDUnbanFN.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\WindowsSubFolder\HWIDUnbanFN.exe

Filesize
27KB

MD5
28a44a27d89e4a9a95f9bbca0469a4e6

SHA1
e753000bce7ac54476f8c6ae9588ff59b67675ff

SHA256
49baad2f1b802a241376b129f3cda0525cd7cef6af44acd3056c948ced03fc26

SHA512
a5071536a57d3f2c5f1dc1ea6866544083cf9e1fed7b6adcc4028f96972c969d5ea151064c835e6d8c444682a939dfc2214b04d90b305da68c756781473674c3

Download Submit
C:\Windows\system32\WindowsSubFolder\HWIDUnbanFN.exe

Filesize
50KB

MD5
8de50bb0d08376353af037af1acc5022

SHA1
c5c689a2c70249032695c971a054333517bf328b

SHA256
4d96a2c05f403a088f80714fcd801271d9f9635ad0df8a055f450ca9c57104a6

SHA512
11ae129e746e10d719abc1bf34a66ee6795339cd02009620c0854835fa7c826346a6f08c792f6c25bb385c0f8fa7b733f276c810a4cd4fd606eb3f7bf84dcd0e

Download Submit
memory/3524-9-0x00007FF82A310000-0x00007FF82ADD1000-memory.dmp

Filesize
10.8MB

Download
memory/3524-10-0x0000000001790000-0x00000000017A0000-memory.dmp

Filesize
64KB

Download
memory/3524-11-0x000000001BDB0000-0x000000001BE00000-memory.dmp

Filesize
320KB

Download
memory/3524-12-0x000000001C450000-0x000000001C502000-memory.dmp

Filesize
712KB

Download
memory/3524-13-0x00007FF82A310000-0x00007FF82ADD1000-memory.dmp

Filesize
10.8MB

Download
memory/3524-14-0x0000000001790000-0x00000000017A0000-memory.dmp

Filesize
64KB

Download
memory/4944-0-0x0000000000AE0000-0x0000000000E04000-memory.dmp

Filesize
3.1MB

Download
memory/4944-1-0x00007FF82A310000-0x00007FF82ADD1000-memory.dmp

Filesize
10.8MB

Download
memory/4944-2-0x000000001BAF0000-0x000000001BB00000-memory.dmp

Filesize
64KB

Download
memory/4944-8-0x00007FF82A310000-0x00007FF82ADD1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads