quasar | 57f21a762965de14502e74ded173e8e81e569fa7236819c3d4ce7804fa119d50

General

Target

624b5682f917d426ce2a4d1ec03fb5ef.exe
Size

1.0MB
MD5

624b5682f917d426ce2a4d1ec03fb5ef
SHA1

379757ca4ab81f1c224ab9440a4c828286513808
SHA256

57f21a762965de14502e74ded173e8e81e569fa7236819c3d4ce7804fa119d50
SHA512

eef5274e53a85b0bf6c37e858b3b7dd880b12ef9a3ba31b20951f448e9ef76da921818634957a862316ef111f16bbc91bb71bf00a2872c48f31e4b32de4cd6de
SSDEEP

24576:YkY5kMJDyGouUqg75HVDBvdKjAgYudelJ6Avr29:V4kMJDyGouUqg75HVDBvdgrdelcm

Score

10^/10

quasar 123 spyware trojan

Malware Config

Extracted

Family

quasar

Version

2.7.0.0

Botnet

123

C2

2.tcp.ngrok.io:16021

2.tcp.ngrok.io:14032

Mutex

ACq4BPNVEhlXf66pqs

Attributes

encryption_key
54GiDZOdbh066qkohQsM
install_name
123.exe
log_directory
Logs
reconnect_delay
1000
startup_key
Venom Client Startup

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2996-1-0x0000000000D60000-0x0000000000E70000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\123.exe	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

624b5682f917d426ce2a4d1ec03fb5ef.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	624b5682f917d426ce2a4d1ec03fb5ef.exe

Executes dropped EXE 1 IoCs

Processes:

123.exe

pid process

2460 123.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3552 PING.EXE

pid	process
2460	123.exe

flow	ioc
14	ip-api.com

pid	process
3552	PING.EXE

Suspicious use of AdjustPrivilegeToken 39 IoCs

Processes:

624b5682f917d426ce2a4d1ec03fb5ef.exe123.exe

description	pid	process
Token: SeDebugPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeSecurityPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeSecurityPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeSecurityPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeSecurityPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeSecurityPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeSecurityPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeSecurityPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeSecurityPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeSecurityPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeSecurityPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeSecurityPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeBackupPrivilege	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe
Token: SeDebugPrivilege	2460	123.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

624b5682f917d426ce2a4d1ec03fb5ef.execmd.exe

description	pid	process	target process
PID 2996 wrote to memory of 2460	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe	123.exe
PID 2996 wrote to memory of 2460	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe	123.exe
PID 2996 wrote to memory of 2460	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe	123.exe
PID 2996 wrote to memory of 4928	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe	cmd.exe
PID 2996 wrote to memory of 4928	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe	cmd.exe
PID 2996 wrote to memory of 4928	2996	624b5682f917d426ce2a4d1ec03fb5ef.exe	cmd.exe
PID 4928 wrote to memory of 3564	4928	cmd.exe	chcp.com
PID 4928 wrote to memory of 3564	4928	cmd.exe	chcp.com
PID 4928 wrote to memory of 3564	4928	cmd.exe	chcp.com
PID 4928 wrote to memory of 3552	4928	cmd.exe	PING.EXE
PID 4928 wrote to memory of 3552	4928	cmd.exe	PING.EXE
PID 4928 wrote to memory of 3552	4928	cmd.exe	PING.EXE
PID 4928 wrote to memory of 2444	4928	cmd.exe	624b5682f917d426ce2a4d1ec03fb5ef.exe
PID 4928 wrote to memory of 2444	4928	cmd.exe	624b5682f917d426ce2a4d1ec03fb5ef.exe
PID 4928 wrote to memory of 2444	4928	cmd.exe	624b5682f917d426ce2a4d1ec03fb5ef.exe

C:\Users\Admin\AppData\Local\Temp\624b5682f917d426ce2a4d1ec03fb5ef.exe
"C:\Users\Admin\AppData\Local\Temp\624b5682f917d426ce2a4d1ec03fb5ef.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996

C:\Users\Admin\AppData\Roaming\123.exe
"C:\Users\Admin\AppData\Roaming\123.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fqB9wxWXRSfo.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:4928

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:3564

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
3⤵
- Runs ping.exe
PID:3552

C:\Users\Admin\AppData\Local\Temp\624b5682f917d426ce2a4d1ec03fb5ef.exe
"C:\Users\Admin\AppData\Local\Temp\624b5682f917d426ce2a4d1ec03fb5ef.exe"
3⤵
PID:2444

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\624b5682f917d426ce2a4d1ec03fb5ef.exe.log
Filesize
1KB

MD5
9f0ab4a25d1ed1820e2e6791346fcbb3

SHA1
5fe78c8a3b420c4c407e7b081e022b8274fc051b

SHA256
dd3304bba5d4cdb7f7edd03bddc9a6196affc5e15cbec3113fb83607082b6df2

SHA512
1acccc67e08802bf4cbc7a3f402464b121ed98625aaf6dc1470b081f793fce5740e6138eb72dac74182379d7d2c177cbd1558284c53212e876a963c47104dcab

Download Submit
C:\Users\Admin\AppData\Local\Temp\fqB9wxWXRSfo.bat
Filesize
229B

MD5
2307220f803ccc674bba99d2a50d459a

SHA1
04efbb5eeb39033cdf76bb2f536f22decf9a51d3

SHA256
decb2ac470f19c76ce205438bd71ae72f77830e1b15192daa036bc772c8dc82b

SHA512
7ec56fda801223426de6bc59af138d2712af49779051a95bc92fc852897d63451c00446cf5addeee580042d747e0b15678eb3ca2587145fe3f53186bf4e5a3b3

Download Submit
C:\Users\Admin\AppData\Roaming\123.exe
Filesize
1.0MB

MD5
624b5682f917d426ce2a4d1ec03fb5ef

SHA1
379757ca4ab81f1c224ab9440a4c828286513808

SHA256
57f21a762965de14502e74ded173e8e81e569fa7236819c3d4ce7804fa119d50

SHA512
eef5274e53a85b0bf6c37e858b3b7dd880b12ef9a3ba31b20951f448e9ef76da921818634957a862316ef111f16bbc91bb71bf00a2872c48f31e4b32de4cd6de

Download Submit
memory/2444-25-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/2444-24-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Filesize
64KB

Download
memory/2444-23-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/2460-13-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/2460-14-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/2460-27-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/2460-26-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/2460-20-0x00000000064F0000-0x00000000064FA000-memory.dmp

Filesize
40KB

Download
memory/2996-0-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/2996-5-0x0000000005C80000-0x0000000005CE6000-memory.dmp

Filesize
408KB

Download
memory/2996-7-0x0000000006E00000-0x0000000006E3C000-memory.dmp

Filesize
240KB

Download
memory/2996-21-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/2996-4-0x00000000058B0000-0x00000000058C0000-memory.dmp

Filesize
64KB

Download
memory/2996-3-0x00000000058E0000-0x0000000005972000-memory.dmp

Filesize
584KB

Download
memory/2996-2-0x0000000005E90000-0x0000000006434000-memory.dmp

Filesize
5.6MB

Download
memory/2996-1-0x0000000000D60000-0x0000000000E70000-memory.dmp

Filesize
1.1MB

Download
memory/2996-12-0x0000000006F10000-0x0000000006FAC000-memory.dmp

Filesize
624KB

Download
memory/2996-6-0x00000000069C0000-0x00000000069D2000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads