quasar | 6e7f1b5bd5b7696ef942013c9d8151420dd29849514be091b43b1fcb9a193d73

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2024 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client.exe
Size

1.2MB
MD5

e0578185ba00836f1971e48cf4da4580
SHA1

42a4e35d4aab1d8cca6459a808573927cb4e18c7
SHA256

6e7f1b5bd5b7696ef942013c9d8151420dd29849514be091b43b1fcb9a193d73
SHA512

399ed216148ec9ec1c7aef1af0298abd3ffbeba73105ea398dc294370d25c57909e59563083a79a511732c0b8381ad19c551c0f3c1eb9b104b5c3e229c9c6775
SSDEEP

24576:WBY9DN/ISlbnyr+rCy/++9vFgWZiA+8qIElcP25WwjorMjTXqxjfxl:WgDfmrEdS1iEmrGgd

Score

10^/10

quasar nulled spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

nulled

147.50.240.233:8008

Mutex

QSR_MUTEX_vjlanSKDAVykDAvDJ6

Attributes

encryption_key
d4qN0cIZpTNNR0XsDxxy
install_name
thick.exe
log_directory
Logs
reconnect_delay
3000
startup_key
updates
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4236-2-0x0000000000F30000-0x00000000012F4000-memory.dmp	family_quasar

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 ip-api.com

flow	ioc
16	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

Processes:

Client.exe

pid	process
4236	Client.exe
4236	Client.exe
4236	Client.exe
4236	Client.exe
4236	Client.exe
4236	Client.exe
4236	Client.exe
4236	Client.exe
4236	Client.exe
4236	Client.exe
4236	Client.exe
4236	Client.exe
4236	Client.exe
4236	Client.exe
4236	Client.exe
4236	Client.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

968 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Client.exe

description pid process

Token: SeDebugPrivilege 4236 Client.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

4236 Client.exe

pid	process
968	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	4236	Client.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client.exe

description	pid	process	target process
PID 4236 wrote to memory of 968	4236	Client.exe	schtasks.exe
PID 4236 wrote to memory of 968	4236	Client.exe	schtasks.exe
PID 4236 wrote to memory of 968	4236	Client.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "updates" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:968

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4236-0-0x0000000000F30000-0x00000000012F4000-memory.dmp

Filesize
3.8MB

Download
memory/4236-1-0x00000000741E0000-0x0000000074990000-memory.dmp

Filesize
7.7MB

Download
memory/4236-2-0x0000000000F30000-0x00000000012F4000-memory.dmp

Filesize
3.8MB

Download
memory/4236-3-0x00000000075A0000-0x0000000007B44000-memory.dmp

Filesize
5.6MB

Download
memory/4236-4-0x0000000007160000-0x00000000071F2000-memory.dmp

Filesize
584KB

Download
memory/4236-5-0x0000000007150000-0x0000000007160000-memory.dmp

Filesize
64KB

Download
memory/4236-6-0x0000000007300000-0x0000000007366000-memory.dmp

Filesize
408KB

Download
memory/4236-7-0x0000000007F10000-0x0000000007F22000-memory.dmp

Filesize
72KB

Download
memory/4236-8-0x0000000008330000-0x000000000836C000-memory.dmp

Filesize
240KB

Download
memory/4236-10-0x0000000008620000-0x000000000862A000-memory.dmp

Filesize
40KB

Download
memory/4236-12-0x0000000000F30000-0x00000000012F4000-memory.dmp

Filesize
3.8MB

Download
memory/4236-13-0x00000000741E0000-0x0000000074990000-memory.dmp

Filesize
7.7MB

Download
memory/4236-15-0x0000000007150000-0x0000000007160000-memory.dmp

Filesize
64KB

Download