quasar | 0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237

General

Target

0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237.exe
Size

3.3MB
MD5

71de7ec63dbc36eac4435afcd17ee03d
SHA1

9c468f6dfae8fd63889e403a67aabc3257bd9e09
SHA256

0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237
SHA512

5a7dccfe897b1940c9d2186bfc13508e4f8a55f15e6d8395f177f9e15ad97ad5c328d179a0d3113271e544d88e1bd74bb54d91bc3f8a8bcb6bd5b0ef142df8fd
SSDEEP

49152:LzbEXehF9XONWogPCy3RUn9NgLOb0THHB72eh2NTQAJ6:L8OLJVogPCy3an9OpAJ6

Score

10^/10

quasar service host: windows event log spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.3

Botnet

Service Host: Windows Event Log

C2

apple-coupled.gl.at.ply.gg:36473

147.185.221.18:36473

Mutex

44b6c65a-d844-4fa9-9d68-a7df5ab8b127

Attributes

encryption_key
8B7FB23965F229B24068B848FCD6536A6961D4FE
install_name
ServiceHostWindowsEventLog.exe
log_directory
runtime
reconnect_delay
5000
startup_key
Service Host
subdirectory
hdll

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

resource	yara_rule
behavioral1/memory/1680-0-0x0000000000BF0000-0x0000000000F44000-memory.dmp	family_quasar
behavioral1/files/0x000b000000015d0f-5.dat	family_quasar
behavioral1/files/0x000b000000015d0f-7.dat	family_quasar
behavioral1/memory/2180-10-0x0000000000B60000-0x0000000000EB4000-memory.dmp	family_quasar

Detects Windows executables referencing non-Windows User-Agents 4 IoCs

resource	yara_rule
behavioral1/memory/1680-0-0x0000000000BF0000-0x0000000000F44000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000b000000015d0f-5.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000b000000015d0f-7.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2180-10-0x0000000000B60000-0x0000000000EB4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 4 IoCs

resource	yara_rule
behavioral1/memory/1680-0-0x0000000000BF0000-0x0000000000F44000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/files/0x000b000000015d0f-5.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/files/0x000b000000015d0f-7.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2180-10-0x0000000000B60000-0x0000000000EB4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing common artifacts observed in infostealers 4 IoCs

resource	yara_rule
behavioral1/memory/1680-0-0x0000000000BF0000-0x0000000000F44000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral1/files/0x000b000000015d0f-5.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral1/files/0x000b000000015d0f-7.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral1/memory/2180-10-0x0000000000B60000-0x0000000000EB4000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer

Executes dropped EXE 1 IoCs

pid	Process
2180	ServiceHostWindowsEventLog.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\hdll	ServiceHostWindowsEventLog.exe
File created	C:\Windows\system32\hdll\ServiceHostWindowsEventLog.exe	0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237.exe
File opened for modification	C:\Windows\system32\hdll\ServiceHostWindowsEventLog.exe	0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237.exe
File opened for modification	C:\Windows\system32\hdll	0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237.exe
File opened for modification	C:\Windows\system32\hdll\ServiceHostWindowsEventLog.exe	ServiceHostWindowsEventLog.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2748	schtasks.exe
3052	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237.exe
Token: SeDebugPrivilege	2180	ServiceHostWindowsEventLog.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2180	ServiceHostWindowsEventLog.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2748	1680	0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237.exe	28
PID 1680 wrote to memory of 2748	1680	0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237.exe	28
PID 1680 wrote to memory of 2748	1680	0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237.exe	28
PID 1680 wrote to memory of 2180	1680	0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237.exe	30
PID 1680 wrote to memory of 2180	1680	0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237.exe	30
PID 1680 wrote to memory of 2180	1680	0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237.exe	30
PID 2180 wrote to memory of 3052	2180	ServiceHostWindowsEventLog.exe	31
PID 2180 wrote to memory of 3052	2180	ServiceHostWindowsEventLog.exe	31
PID 2180 wrote to memory of 3052	2180	ServiceHostWindowsEventLog.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237.exe
"C:\Users\Admin\AppData\Local\Temp\0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Service Host" /sc ONLOGON /tr "C:\Windows\system32\hdll\ServiceHostWindowsEventLog.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2748
- C:\Windows\system32\hdll\ServiceHostWindowsEventLog.exe
  "C:\Windows\system32\hdll\ServiceHostWindowsEventLog.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Service Host" /sc ONLOGON /tr "C:\Windows\system32\hdll\ServiceHostWindowsEventLog.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\hdll\ServiceHostWindowsEventLog.exe

Filesize
1.7MB

MD5
0343f6241e89f384008d6d4e653f622e

SHA1
06274bc42dffa40d8cf2cdae0acda2ba90e846ae

SHA256
19fefc6458354252d61ef5eb3c6a80929c824054862866fbba248309634d300c

SHA512
0f9c0797f1084fb2e29b188ad337ff80ee52056c73bf040a5de8dcc3bcbba80ececa765f1e796d8a9845cc9da7978dae1c4cf4957829f7938b9766c73b8bd35b

Download Submit
C:\Windows\system32\hdll\ServiceHostWindowsEventLog.exe

Filesize
803KB

MD5
a350eb46c1d86936400aae7fcc52b45f

SHA1
00dd29d7fd7e92dcfb20ecc87daa3b6000e9b2b9

SHA256
bf1c166c8ab5e8d484aa0afefdeed2ae2ec9a7ef89c7e922edd5b18c403e8cfd

SHA512
7ae50bc1c78815a028bc979ab79b32b1d794c01ceaa4d32a24975d537f6d8c65b7dd84a01e99aeeaa3f161343456e340b96edb9b5cf3e6ed5727c5748a62a01c

Download Submit
memory/1680-0-0x0000000000BF0000-0x0000000000F44000-memory.dmp

Filesize
3.3MB

Download
memory/1680-1-0x000007FEF50F0000-0x000007FEF5ADC000-memory.dmp

Filesize
9.9MB

Download
memory/1680-2-0x000000001ABD0000-0x000000001AC50000-memory.dmp

Filesize
512KB

Download
memory/1680-9-0x000007FEF50F0000-0x000007FEF5ADC000-memory.dmp

Filesize
9.9MB

Download
memory/2180-8-0x000007FEF50F0000-0x000007FEF5ADC000-memory.dmp

Filesize
9.9MB

Download
memory/2180-10-0x0000000000B60000-0x0000000000EB4000-memory.dmp

Filesize
3.3MB

Download
memory/2180-11-0x000000001B170000-0x000000001B1F0000-memory.dmp

Filesize
512KB

Download
memory/2180-12-0x000007FEF50F0000-0x000007FEF5ADC000-memory.dmp

Filesize
9.9MB

Download
memory/2180-13-0x000000001B170000-0x000000001B1F0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads