quasar | c458feb66832df6a0c361d951c60bcda34c4f5c82652d25c5e4a1aa4c41d8d94

General

Target

yourcute.exe
Size

3.1MB
MD5

561d2b135a6200ef094b222eb47af87a
SHA1

4db2f2254cae3695a0ffa7ccdc13097db254cd8c
SHA256

c458feb66832df6a0c361d951c60bcda34c4f5c82652d25c5e4a1aa4c41d8d94
SHA512

6bd32a9099968b13150a16ee919684e319a67a55dc436fb36157901528e5ccf0283daecdafd07876186f00af13a3bba170a6328926156578a2c06455772b0094
SSDEEP

49152:mvyI22SsaNYfdPBldt698dBcjHHCy1JcLoGdVWTHHB72eh2NT:mvf22SsaNYfdPBldt6+dBcjHHCv

Score

10^/10

quasar slave spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Slave

C2

140.238.91.110:36039

Mutex

df49f69a-66a2-4b6e-bb60-18c12b5b14df

Attributes

encryption_key
6A1671418BB270D703D501AB8E9B41E8D413B6D3
install_name
Client.exe
log_directory
Win64ErrorLogs
reconnect_delay
3000
startup_key
Windows Boot Menu
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2940-0-0x0000000000B50000-0x0000000000E74000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

1312 Client.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1012 schtasks.exe
1644 schtasks.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

yourcute.exeClient.exesvchost.exe

description pid process

Token: SeDebugPrivilege 2940 yourcute.exe
Token: SeDebugPrivilege 1312 Client.exe
Token: SeManageVolumePrivilege 3244 svchost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

1312 Client.exe

pid	process
1312	Client.exe

pid	process
1012	schtasks.exe
1644	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2940	yourcute.exe
Token: SeDebugPrivilege	1312	Client.exe
Token: SeManageVolumePrivilege	3244	svchost.exe

pid	process
1312	Client.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

yourcute.exeClient.exe

description	pid	process	target process
PID 2940 wrote to memory of 1012	2940	yourcute.exe	schtasks.exe
PID 2940 wrote to memory of 1012	2940	yourcute.exe	schtasks.exe
PID 2940 wrote to memory of 1312	2940	yourcute.exe	Client.exe
PID 2940 wrote to memory of 1312	2940	yourcute.exe	Client.exe
PID 1312 wrote to memory of 1644	1312	Client.exe	schtasks.exe
PID 1312 wrote to memory of 1644	1312	Client.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\yourcute.exe
"C:\Users\Admin\AppData\Local\Temp\yourcute.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows Boot Menu" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1012

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows Boot Menu" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3244

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
320KB

MD5
2a920508a2b124f086399a2a2fb4d1e6

SHA1
8b55f1b92fe9984b5335a065540c08db0b2970b6

SHA256
4d0609858b4f66a71be54c0b4c7b832b34d3eaf38c5fb281f3a6319eb6ddd3fe

SHA512
6b71aa2cbc649ab05db51aba46d3977768889d5c77ed1eecf22a5d089de4a2565e94f7019bfcf4efad0a1818fbee337303b7d90f07b059c220ab42820af3c6d3

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
561d2b135a6200ef094b222eb47af87a

SHA1
4db2f2254cae3695a0ffa7ccdc13097db254cd8c

SHA256
c458feb66832df6a0c361d951c60bcda34c4f5c82652d25c5e4a1aa4c41d8d94

SHA512
6bd32a9099968b13150a16ee919684e319a67a55dc436fb36157901528e5ccf0283daecdafd07876186f00af13a3bba170a6328926156578a2c06455772b0094

Download Submit
memory/1312-10-0x00007FF9F7000000-0x00007FF9F7AC1000-memory.dmp

Filesize
10.8MB

Download
memory/1312-11-0x00000000015A0000-0x00000000015B0000-memory.dmp

Filesize
64KB

Download
memory/1312-12-0x0000000002DC0000-0x0000000002E10000-memory.dmp

Filesize
320KB

Download
memory/1312-13-0x000000001C210000-0x000000001C2C2000-memory.dmp

Filesize
712KB

Download
memory/1312-14-0x00007FF9F7000000-0x00007FF9F7AC1000-memory.dmp

Filesize
10.8MB

Download
memory/2940-0-0x0000000000B50000-0x0000000000E74000-memory.dmp

Filesize
3.1MB

Download
memory/2940-1-0x00007FF9F7000000-0x00007FF9F7AC1000-memory.dmp

Filesize
10.8MB

Download
memory/2940-2-0x000000001BAB0000-0x000000001BAC0000-memory.dmp

Filesize
64KB

Download
memory/2940-9-0x00007FF9F7000000-0x00007FF9F7AC1000-memory.dmp

Filesize
10.8MB

Download
memory/3244-51-0x000001F5FC490000-0x000001F5FC491000-memory.dmp

Filesize
4KB

Download
memory/3244-57-0x000001F5FC490000-0x000001F5FC491000-memory.dmp

Filesize
4KB

Download
memory/3244-48-0x000001F5FC490000-0x000001F5FC491000-memory.dmp

Filesize
4KB

Download
memory/3244-49-0x000001F5FC490000-0x000001F5FC491000-memory.dmp

Filesize
4KB

Download
memory/3244-50-0x000001F5FC490000-0x000001F5FC491000-memory.dmp

Filesize
4KB

Download
memory/3244-31-0x000001F5F3E80000-0x000001F5F3E90000-memory.dmp

Filesize
64KB

Download
memory/3244-52-0x000001F5FC490000-0x000001F5FC491000-memory.dmp

Filesize
4KB

Download
memory/3244-53-0x000001F5FC490000-0x000001F5FC491000-memory.dmp

Filesize
4KB

Download
memory/3244-54-0x000001F5FC490000-0x000001F5FC491000-memory.dmp

Filesize
4KB

Download
memory/3244-55-0x000001F5FC490000-0x000001F5FC491000-memory.dmp

Filesize
4KB

Download
memory/3244-56-0x000001F5FC490000-0x000001F5FC491000-memory.dmp

Filesize
4KB

Download
memory/3244-47-0x000001F5FC470000-0x000001F5FC471000-memory.dmp

Filesize
4KB

Download
memory/3244-58-0x000001F5FC0C0000-0x000001F5FC0C1000-memory.dmp

Filesize
4KB

Download
memory/3244-59-0x000001F5FC0B0000-0x000001F5FC0B1000-memory.dmp

Filesize
4KB

Download
memory/3244-61-0x000001F5FC0C0000-0x000001F5FC0C1000-memory.dmp

Filesize
4KB

Download
memory/3244-64-0x000001F5FC0B0000-0x000001F5FC0B1000-memory.dmp

Filesize
4KB

Download
memory/3244-67-0x000001F5FBFF0000-0x000001F5FBFF1000-memory.dmp

Filesize
4KB

Download
memory/3244-79-0x000001F5FC1F0000-0x000001F5FC1F1000-memory.dmp

Filesize
4KB

Download
memory/3244-81-0x000001F5FC200000-0x000001F5FC201000-memory.dmp

Filesize
4KB

Download
memory/3244-82-0x000001F5FC200000-0x000001F5FC201000-memory.dmp

Filesize
4KB

Download
memory/3244-83-0x000001F5FC310000-0x000001F5FC311000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads