quasar | fbe69d8e1fa5390e1627f2c7713c456c69e0be031e2df0faace32d439a412fe9

Analysis

max time kernel
172s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eee.exe
Size

3.1MB
MD5

9e282c69a25055463e8481edbbaf3d14
SHA1

2c867ddfe529f664bc6234fd9c1244bd4d6c7a6c
SHA256

fbe69d8e1fa5390e1627f2c7713c456c69e0be031e2df0faace32d439a412fe9
SHA512

fa1d96774579db7aeef3cc5ae7c94f6a3358b3209dc10e3d43b068bd0b6ad2ba6a457f89e0eda7fe7533e2bf4656acffbe1fab491fcf7a475c88bde63c19fcbe
SSDEEP

49152:cwBDoDZjiLWI2DEJd0XiUcyGPOJndAmh6aI6XP11dmnJ1BG0HyuEao/7XO:NBcDRiL4ETNUcBmJndQZwt1KjBG0Hyz

Score

10^/10

quasar update spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

update

127.0.0.1:4782

Mutex

ddb0d81d-667e-44c3-a1b7-00fcb82dd1ef

Attributes

encryption_key
00DF680B0E09235E9256570DFF972BC701444E37
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
putty
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1700-11-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar

Suspicious use of SetThreadContext 1 IoCs

Processes:

eee.exe

description pid process target process

PID 3916 set thread context of 1700 3916 eee.exe RegAsm.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4216 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

eee.exe

pid process

3916 eee.exe
3916 eee.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

eee.exe

description pid process

Token: SeDebugPrivilege 3916 eee.exe

description	pid	process	target process
PID 3916 set thread context of 1700	3916	eee.exe	RegAsm.exe

pid	process
4216	schtasks.exe

pid	process
3916	eee.exe
3916	eee.exe

description	pid	process
Token: SeDebugPrivilege	3916	eee.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

eee.exe

description	pid	process	target process
PID 3916 wrote to memory of 1860	3916	eee.exe	RegAsm.exe
PID 3916 wrote to memory of 1860	3916	eee.exe	RegAsm.exe
PID 3916 wrote to memory of 1860	3916	eee.exe	RegAsm.exe
PID 3916 wrote to memory of 1700	3916	eee.exe	RegAsm.exe
PID 3916 wrote to memory of 1700	3916	eee.exe	RegAsm.exe
PID 3916 wrote to memory of 1700	3916	eee.exe	RegAsm.exe
PID 3916 wrote to memory of 1700	3916	eee.exe	RegAsm.exe
PID 3916 wrote to memory of 1700	3916	eee.exe	RegAsm.exe
PID 3916 wrote to memory of 1700	3916	eee.exe	RegAsm.exe
PID 3916 wrote to memory of 1700	3916	eee.exe	RegAsm.exe
PID 3916 wrote to memory of 1700	3916	eee.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\eee.exe
"C:\Users\Admin\AppData\Local\Temp\eee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1860

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1700

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "putty" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:4216

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
3⤵
PID:4116

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-11-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/3916-8-0x0000000005600000-0x0000000005610000-memory.dmp

Filesize
64KB

Download
memory/3916-9-0x0000000005EB0000-0x00000000061D6000-memory.dmp

Filesize
3.1MB

Download
memory/3916-3-0x00000000053F0000-0x0000000005482000-memory.dmp

Filesize
584KB

Download
memory/3916-4-0x0000000005600000-0x0000000005610000-memory.dmp

Filesize
64KB

Download
memory/3916-5-0x00000000055B0000-0x00000000055BA000-memory.dmp

Filesize
40KB

Download
memory/3916-6-0x0000000005690000-0x0000000005706000-memory.dmp

Filesize
472KB

Download
memory/3916-2-0x0000000005900000-0x0000000005EA4000-memory.dmp

Filesize
5.6MB

Download
memory/3916-0-0x0000000074D40000-0x00000000754F0000-memory.dmp

Filesize
7.7MB

Download
memory/3916-7-0x0000000074D40000-0x00000000754F0000-memory.dmp

Filesize
7.7MB

Download
memory/3916-10-0x0000000005880000-0x000000000589E000-memory.dmp

Filesize
120KB

Download
memory/3916-1-0x00000000006E0000-0x0000000000A08000-memory.dmp

Filesize
3.2MB

Download
memory/3916-13-0x0000000074D40000-0x00000000754F0000-memory.dmp

Filesize
7.7MB

Download
memory/4116-14-0x0000000000510000-0x0000000000522000-memory.dmp

Filesize
72KB

Download
memory/4116-15-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/4116-17-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download