quasar | 17add376de5c606429260436cc6e1ce9bbf2ba5bb2f3ef4fb503434c0c37eada

General

Target

DiscordClean.exe
Size

3.1MB
MD5

e40d9df40a13bba33d406ff3a1780449
SHA1

a43ed65b73a1d3d0c130b62258858d3b35bd8fa9
SHA256

17add376de5c606429260436cc6e1ce9bbf2ba5bb2f3ef4fb503434c0c37eada
SHA512

35e0aa7a1124e66b310d4fd368b50162bba8aa9f0e60784e06bbeee9acdd6d66925b87f7c6f009f9ea9fba38f55032a1332ad0e35de2cb745fdc1ded1153b1cb
SSDEEP

49152:7vHz92YpaQI6oPZlhP3ReybewoqnoNSBar7roGdGTHHB72eh2NT:7vT92YpaQI6oPZlhP3YybewoiiSC

Score

10^/10

quasar slave spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Slave

C2

uk2.localto.net:37735

192.168.1.54:443

192.168.1.54:80

82.47.98.176:80

82.47.98.176:443

Mutex

70129915-f2b5-40ef-aa85-96dbc3efa5c9

Attributes

encryption_key
76B28C3E753D8BB017093D2AA2C736559D00B442
install_name
GorillaTag.exe
log_directory
Steam Error Logs
reconnect_delay
3000
startup_key
Steam WebHelper
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1208-0-0x0000000000D30000-0x0000000001054000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\GorillaTag.exe	family_quasar
behavioral1/memory/3016-8-0x0000000001220000-0x0000000001544000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

GorillaTag.exe

pid process

3016 GorillaTag.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2988 schtasks.exe
2728 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

DiscordClean.exeGorillaTag.exe

description pid process

Token: SeDebugPrivilege 1208 DiscordClean.exe
Token: SeDebugPrivilege 3016 GorillaTag.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

GorillaTag.exe

pid process

3016 GorillaTag.exe

pid	process
3016	GorillaTag.exe

pid	process
2988	schtasks.exe
2728	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1208	DiscordClean.exe
Token: SeDebugPrivilege	3016	GorillaTag.exe

pid	process
3016	GorillaTag.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

DiscordClean.exeGorillaTag.exe

description	pid	process	target process
PID 1208 wrote to memory of 2988	1208	DiscordClean.exe	schtasks.exe
PID 1208 wrote to memory of 2988	1208	DiscordClean.exe	schtasks.exe
PID 1208 wrote to memory of 2988	1208	DiscordClean.exe	schtasks.exe
PID 1208 wrote to memory of 3016	1208	DiscordClean.exe	GorillaTag.exe
PID 1208 wrote to memory of 3016	1208	DiscordClean.exe	GorillaTag.exe
PID 1208 wrote to memory of 3016	1208	DiscordClean.exe	GorillaTag.exe
PID 3016 wrote to memory of 2728	3016	GorillaTag.exe	schtasks.exe
PID 3016 wrote to memory of 2728	3016	GorillaTag.exe	schtasks.exe
PID 3016 wrote to memory of 2728	3016	GorillaTag.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DiscordClean.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordClean.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Steam WebHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\GorillaTag.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2988

C:\Users\Admin\AppData\Roaming\SubDir\GorillaTag.exe
"C:\Users\Admin\AppData\Roaming\SubDir\GorillaTag.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Steam WebHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\GorillaTag.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2728

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\GorillaTag.exe
Filesize
3.1MB

MD5
e40d9df40a13bba33d406ff3a1780449

SHA1
a43ed65b73a1d3d0c130b62258858d3b35bd8fa9

SHA256
17add376de5c606429260436cc6e1ce9bbf2ba5bb2f3ef4fb503434c0c37eada

SHA512
35e0aa7a1124e66b310d4fd368b50162bba8aa9f0e60784e06bbeee9acdd6d66925b87f7c6f009f9ea9fba38f55032a1332ad0e35de2cb745fdc1ded1153b1cb

Download Submit
memory/1208-0-0x0000000000D30000-0x0000000001054000-memory.dmp

Filesize
3.1MB

Download
memory/1208-1-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download
memory/1208-2-0x000000001B150000-0x000000001B1D0000-memory.dmp

Filesize
512KB

Download
memory/1208-10-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download
memory/3016-8-0x0000000001220000-0x0000000001544000-memory.dmp

Filesize
3.1MB

Download
memory/3016-9-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download
memory/3016-11-0x000000001B230000-0x000000001B2B0000-memory.dmp

Filesize
512KB

Download
memory/3016-12-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download
memory/3016-13-0x000000001B230000-0x000000001B2B0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads