quasar | 97f8c59bc4de919eb1cd0530cb96ab278e81330f893224aea145514e47f4d097

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 05:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a10dcc9d7a81791fe288bbe58ad046e3.exe
Size

1.2MB
MD5

a10dcc9d7a81791fe288bbe58ad046e3
SHA1

3f0d0ffa580f8c504fe75ed3f295621d2c0a17fc
SHA256

97f8c59bc4de919eb1cd0530cb96ab278e81330f893224aea145514e47f4d097
SHA512

921d89eb070e687921e35160289fdfb53edef0c96201482f80bf4124496f3c5d9a56f6183f67d2309f78e07194571aafa5051adf57f8d128713a538c4e8d1b8f
SSDEEP

24576:ko2A4d+A+d/axWtr0sa5Qyajklxmwx58rK/NJKao5:zb3BJaxery5QyayxXz8mJKl

Score

10^/10

quasar spyware trojan

Malware Config

Signatures

Contains code to disable Windows Defender 5 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/2428-12-0x0000000000400000-0x0000000000458000-memory.dmp	disable_win_def
behavioral1/memory/2428-14-0x0000000000400000-0x0000000000458000-memory.dmp	disable_win_def
behavioral1/memory/2428-18-0x0000000000400000-0x0000000000458000-memory.dmp	disable_win_def
behavioral1/memory/2428-20-0x0000000000400000-0x0000000000458000-memory.dmp	disable_win_def
behavioral1/memory/2428-22-0x0000000000400000-0x0000000000458000-memory.dmp	disable_win_def

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

resource	yara_rule
behavioral1/memory/2428-12-0x0000000000400000-0x0000000000458000-memory.dmp	family_quasar
behavioral1/memory/2428-14-0x0000000000400000-0x0000000000458000-memory.dmp	family_quasar
behavioral1/memory/2428-18-0x0000000000400000-0x0000000000458000-memory.dmp	family_quasar
behavioral1/memory/2428-20-0x0000000000400000-0x0000000000458000-memory.dmp	family_quasar
behavioral1/memory/2428-22-0x0000000000400000-0x0000000000458000-memory.dmp	family_quasar

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	pastebin.com
3	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2340 set thread context of 2428	2340	a10dcc9d7a81791fe288bbe58ad046e3.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2312	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2652	a10dcc9d7a81791fe288bbe58ad046e3.exe
2652	a10dcc9d7a81791fe288bbe58ad046e3.exe
2652	a10dcc9d7a81791fe288bbe58ad046e3.exe
2652	a10dcc9d7a81791fe288bbe58ad046e3.exe
2652	a10dcc9d7a81791fe288bbe58ad046e3.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	a10dcc9d7a81791fe288bbe58ad046e3.exe
Token: SeDebugPrivilege	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2428	2340	a10dcc9d7a81791fe288bbe58ad046e3.exe	30
PID 2340 wrote to memory of 2428	2340	a10dcc9d7a81791fe288bbe58ad046e3.exe	30
PID 2340 wrote to memory of 2428	2340	a10dcc9d7a81791fe288bbe58ad046e3.exe	30
PID 2340 wrote to memory of 2428	2340	a10dcc9d7a81791fe288bbe58ad046e3.exe	30
PID 2340 wrote to memory of 2428	2340	a10dcc9d7a81791fe288bbe58ad046e3.exe	30
PID 2340 wrote to memory of 2428	2340	a10dcc9d7a81791fe288bbe58ad046e3.exe	30
PID 2340 wrote to memory of 2428	2340	a10dcc9d7a81791fe288bbe58ad046e3.exe	30
PID 2340 wrote to memory of 2428	2340	a10dcc9d7a81791fe288bbe58ad046e3.exe	30
PID 2340 wrote to memory of 2428	2340	a10dcc9d7a81791fe288bbe58ad046e3.exe	30
PID 2428 wrote to memory of 2144	2428	a10dcc9d7a81791fe288bbe58ad046e3.exe	31
PID 2428 wrote to memory of 2144	2428	a10dcc9d7a81791fe288bbe58ad046e3.exe	31
PID 2428 wrote to memory of 2144	2428	a10dcc9d7a81791fe288bbe58ad046e3.exe	31
PID 2428 wrote to memory of 2144	2428	a10dcc9d7a81791fe288bbe58ad046e3.exe	31
PID 2144 wrote to memory of 2216	2144	cmd.exe	33
PID 2144 wrote to memory of 2216	2144	cmd.exe	33
PID 2144 wrote to memory of 2216	2144	cmd.exe	33
PID 2144 wrote to memory of 2216	2144	cmd.exe	33
PID 2144 wrote to memory of 2312	2144	cmd.exe	34
PID 2144 wrote to memory of 2312	2144	cmd.exe	34
PID 2144 wrote to memory of 2312	2144	cmd.exe	34
PID 2144 wrote to memory of 2312	2144	cmd.exe	34
PID 2144 wrote to memory of 2652	2144	cmd.exe	35
PID 2144 wrote to memory of 2652	2144	cmd.exe	35
PID 2144 wrote to memory of 2652	2144	cmd.exe	35
PID 2144 wrote to memory of 2652	2144	cmd.exe	35
PID 2652 wrote to memory of 2316	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	36
PID 2652 wrote to memory of 2316	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	36
PID 2652 wrote to memory of 2316	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	36
PID 2652 wrote to memory of 2316	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	36
PID 2652 wrote to memory of 1980	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	37
PID 2652 wrote to memory of 1980	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	37
PID 2652 wrote to memory of 1980	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	37
PID 2652 wrote to memory of 1980	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	37
PID 2652 wrote to memory of 2368	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	38
PID 2652 wrote to memory of 2368	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	38
PID 2652 wrote to memory of 2368	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	38
PID 2652 wrote to memory of 2368	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	38
PID 2652 wrote to memory of 2288	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	39
PID 2652 wrote to memory of 2288	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	39
PID 2652 wrote to memory of 2288	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	39
PID 2652 wrote to memory of 2288	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	39
PID 2652 wrote to memory of 2228	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	40
PID 2652 wrote to memory of 2228	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	40
PID 2652 wrote to memory of 2228	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	40
PID 2652 wrote to memory of 2228	2652	a10dcc9d7a81791fe288bbe58ad046e3.exe	40

C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe
"C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe
  "C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\fgHF93bVlfHa.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:2216
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe
      "C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe"
        5⤵
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe"
        5⤵
        
        PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe"
        5⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe"
        5⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a10dcc9d7a81791fe288bbe58ad046e3.exe"
        5⤵
        
        PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab2751.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27C1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fgHF93bVlfHa.bat

Filesize
229B

MD5
733efe4749745d134149a908742c69c1

SHA1
35fdaf7e648c899c887e844693eb7c23d45d9677

SHA256
e9c652bdb8844c6f1cfa8128e02a20a372fac26cff0688cc641355f7879365e8

SHA512
c7540528e682e7483b17fec4acfa80d513461c3a95f57d9665e7e8de182f090da37ce55b71b798fa01c50bb098a7efe0b1769757654f9943de8cc479b84ac9a9

Download Submit
memory/2340-7-0x0000000004C30000-0x0000000004C88000-memory.dmp

Filesize
352KB

Download
memory/2340-23-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-5-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

Filesize
256KB

Download
memory/2340-6-0x0000000006740000-0x00000000067F0000-memory.dmp

Filesize
704KB

Download
memory/2340-0-0x00000000008E0000-0x0000000000A18000-memory.dmp

Filesize
1.2MB

Download
memory/2340-1-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-2-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

Filesize
256KB

Download
memory/2340-3-0x0000000000410000-0x000000000042A000-memory.dmp

Filesize
104KB

Download
memory/2340-4-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-22-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2428-8-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2428-20-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2428-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2428-14-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2428-24-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-25-0x00000000047E0000-0x0000000004820000-memory.dmp

Filesize
256KB

Download
memory/2428-12-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2428-10-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2428-18-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2428-69-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2652-70-0x0000000000310000-0x0000000000448000-memory.dmp

Filesize
1.2MB

Download
memory/2652-71-0x0000000074570000-0x0000000074C5E000-memory.dmp

Filesize
6.9MB

Download
memory/2652-72-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/2652-73-0x0000000074570000-0x0000000074C5E000-memory.dmp

Filesize
6.9MB

Download
memory/2652-74-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/2652-75-0x0000000074570000-0x0000000074C5E000-memory.dmp

Filesize
6.9MB

Download