quasar | 088023dee5807788786ad2707fa34ae3422654ecb0cb9efbc1eb268cec958ff0

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bcf82013e39cef4310eb312625ab8598.exe
Size 157KB
Sample240309-2elbwscf49
SHA256 088023dee5807788786ad2707fa34ae3422654ecb0cb9efbc1eb268cec958ff0
MD5 bcf82013e39cef4310eb312625ab8598
SHA1 96f423ba66892855a6d67e96a23bdba885f63944
SHA512 1cddb94d23d6387dcb0650a74ae2028e6a9744788ce7fe5f4bb98afa41c9670e7097fe1be9b323b2c061742a2c026ea710ff294a3b169085fecdb417beb95ac3
SSDEEP 3072:GfckI9Z12hDq4SWe06jQ75GKqEcjk0XkhFBx4:K0Z12jjM400Tw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar revengerat games spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Games

services18.dns.army:7000
ss1999.64-b.it:7000

Mutex

5EwVZpKkbJ5fq0j9og

Attributes

encryption_key
O6mxl5VNcg9uGSOey4nY
install_name
Instalation Rep.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Firefox Update
subdirectory
Instalation

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

resource	yara_rule
behavioral1/memory/1812-0-0x0000000000160000-0x000000000018E000-memory.dmp	family_quasar
behavioral1/memory/1812-2-0x0000000001D60000-0x0000000001DAC000-memory.dmp	family_quasar
behavioral1/memory/1812-3-0x0000000004950000-0x0000000004990000-memory.dmp	family_quasar
behavioral1/files/0x000d00000001232e-5.dat	family_quasar
behavioral1/memory/2640-12-0x0000000000C00000-0x0000000000C2E000-memory.dmp	family_quasar

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Executes dropped EXE 2 IoCs

pid	Process
2640	Instalation Rep.exe
2976	Instalation Rep.exe

Loads dropped DLL 7 IoCs

pid	Process
1812	bcf82013e39cef4310eb312625ab8598.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2424	WerFault.exe
2472	cmd.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2424	2640	WerFault.exe	31

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2568	schtasks.exe
2588	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2500	PING.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	bcf82013e39cef4310eb312625ab8598.exe
Token: SeDebugPrivilege	2640	Instalation Rep.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2640	Instalation Rep.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2568	1812	bcf82013e39cef4310eb312625ab8598.exe	29
PID 1812 wrote to memory of 2568	1812	bcf82013e39cef4310eb312625ab8598.exe	29
PID 1812 wrote to memory of 2568	1812	bcf82013e39cef4310eb312625ab8598.exe	29
PID 1812 wrote to memory of 2568	1812	bcf82013e39cef4310eb312625ab8598.exe	29
PID 1812 wrote to memory of 2640	1812	bcf82013e39cef4310eb312625ab8598.exe	31
PID 1812 wrote to memory of 2640	1812	bcf82013e39cef4310eb312625ab8598.exe	31
PID 1812 wrote to memory of 2640	1812	bcf82013e39cef4310eb312625ab8598.exe	31
PID 1812 wrote to memory of 2640	1812	bcf82013e39cef4310eb312625ab8598.exe	31
PID 1812 wrote to memory of 2640	1812	bcf82013e39cef4310eb312625ab8598.exe	31
PID 1812 wrote to memory of 2640	1812	bcf82013e39cef4310eb312625ab8598.exe	31
PID 1812 wrote to memory of 2640	1812	bcf82013e39cef4310eb312625ab8598.exe	31
PID 2640 wrote to memory of 2588	2640	Instalation Rep.exe	32
PID 2640 wrote to memory of 2588	2640	Instalation Rep.exe	32
PID 2640 wrote to memory of 2588	2640	Instalation Rep.exe	32
PID 2640 wrote to memory of 2588	2640	Instalation Rep.exe	32
PID 2640 wrote to memory of 2472	2640	Instalation Rep.exe	34
PID 2640 wrote to memory of 2472	2640	Instalation Rep.exe	34
PID 2640 wrote to memory of 2472	2640	Instalation Rep.exe	34
PID 2640 wrote to memory of 2472	2640	Instalation Rep.exe	34
PID 2472 wrote to memory of 2444	2472	cmd.exe	37
PID 2472 wrote to memory of 2444	2472	cmd.exe	37
PID 2472 wrote to memory of 2444	2472	cmd.exe	37
PID 2472 wrote to memory of 2444	2472	cmd.exe	37
PID 2640 wrote to memory of 2424	2640	Instalation Rep.exe	36
PID 2640 wrote to memory of 2424	2640	Instalation Rep.exe	36
PID 2640 wrote to memory of 2424	2640	Instalation Rep.exe	36
PID 2640 wrote to memory of 2424	2640	Instalation Rep.exe	36
PID 2472 wrote to memory of 2500	2472	cmd.exe	38
PID 2472 wrote to memory of 2500	2472	cmd.exe	38
PID 2472 wrote to memory of 2500	2472	cmd.exe	38
PID 2472 wrote to memory of 2500	2472	cmd.exe	38
PID 2472 wrote to memory of 2976	2472	cmd.exe	39
PID 2472 wrote to memory of 2976	2472	cmd.exe	39
PID 2472 wrote to memory of 2976	2472	cmd.exe	39
PID 2472 wrote to memory of 2976	2472	cmd.exe	39
PID 2472 wrote to memory of 2976	2472	cmd.exe	39
PID 2472 wrote to memory of 2976	2472	cmd.exe	39
PID 2472 wrote to memory of 2976	2472	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe
"C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "Firefox Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2568
- C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
  "C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Firefox Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\0EPIBWDmBjQw.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:2444
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:2500
  - - C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
      "C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe"
      4⤵
      Executes dropped EXE
      PID:2976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 1492
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0EPIBWDmBjQw.bat

Path C:\Users\Admin\AppData\Local\Temp\0EPIBWDmBjQw.bat
Size 221B
SHA256 04d97a0f0230637e659531ec71875766b92445fd491ac4bc621b0b782a4f9b8b
MD5 3be8d4a1fd7a726dfa34a9566cad25db
SHA1 2f3bbc1db68b662572bd4f0130225bd60f79363a
SHA512 4d423109524fa9894205444cf465caa3ff47a53655ecdbc4d46e3625286e667b400798e6ac9e28a4ee0b07f8dc75df137b1898673730de0cde7d71fc1c5669c3
MD5 SHA1 SHA512

Submit Download

Instalation Rep.exe

Path \Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
Size 157KB
SHA256 088023dee5807788786ad2707fa34ae3422654ecb0cb9efbc1eb268cec958ff0
MD5 bcf82013e39cef4310eb312625ab8598
SHA1 96f423ba66892855a6d67e96a23bdba885f63944
SHA512 1cddb94d23d6387dcb0650a74ae2028e6a9744788ce7fe5f4bb98afa41c9670e7097fe1be9b323b2c061742a2c026ea710ff294a3b169085fecdb417beb95ac3
SSDEEP 3072:GfckI9Z12hDq4SWe06jQ75GKqEcjk0XkhFBx4:K0Z12jjM400Tw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1812-11-0x0000000074470000-0x0000000074B5E000-memory.dmp

Download

memory/1812-1-0x0000000074470000-0x0000000074B5E000-memory.dmp

Download

memory/1812-2-0x0000000001D60000-0x0000000001DAC000-memory.dmp

Download

memory/1812-3-0x0000000004950000-0x0000000004990000-memory.dmp

Download

memory/1812-0-0x0000000000160000-0x000000000018E000-memory.dmp

Download

memory/2640-12-0x0000000000C00000-0x0000000000C2E000-memory.dmp

Download

memory/2640-10-0x0000000074470000-0x0000000074B5E000-memory.dmp

Download

memory/2640-32-0x0000000074470000-0x0000000074B5E000-memory.dmp

Download

memory/2640-33-0x0000000004940000-0x0000000004980000-memory.dmp

Download

memory/2976-30-0x0000000074470000-0x0000000074B5E000-memory.dmp

Download

memory/2976-31-0x0000000074470000-0x0000000074B5E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads