quasar | c458feb66832df6a0c361d951c60bcda34c4f5c82652d25c5e4a1aa4c41d8d94

General

Target

561d2b135a6200ef094b222eb47af87a.exe
Size

3.1MB
MD5

561d2b135a6200ef094b222eb47af87a
SHA1

4db2f2254cae3695a0ffa7ccdc13097db254cd8c
SHA256

c458feb66832df6a0c361d951c60bcda34c4f5c82652d25c5e4a1aa4c41d8d94
SHA512

6bd32a9099968b13150a16ee919684e319a67a55dc436fb36157901528e5ccf0283daecdafd07876186f00af13a3bba170a6328926156578a2c06455772b0094
SSDEEP

49152:mvyI22SsaNYfdPBldt698dBcjHHCy1JcLoGdVWTHHB72eh2NT:mvf22SsaNYfdPBldt6+dBcjHHCv

Score

10^/10

quasar slave spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Slave

C2

140.238.91.110:36039

Mutex

df49f69a-66a2-4b6e-bb60-18c12b5b14df

Attributes

encryption_key
6A1671418BB270D703D501AB8E9B41E8D413B6D3
install_name
Client.exe
log_directory
Win64ErrorLogs
reconnect_delay
3000
startup_key
Windows Boot Menu
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2476-0-0x0000000000D20000-0x0000000001044000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
behavioral1/memory/2496-10-0x0000000000A30000-0x0000000000D54000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

2496 Client.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2536 schtasks.exe
2968 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

561d2b135a6200ef094b222eb47af87a.exeClient.exe

description pid process

Token: SeDebugPrivilege 2476 561d2b135a6200ef094b222eb47af87a.exe
Token: SeDebugPrivilege 2496 Client.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

2496 Client.exe

pid	process
2496	Client.exe

pid	process
2536	schtasks.exe
2968	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2476	561d2b135a6200ef094b222eb47af87a.exe
Token: SeDebugPrivilege	2496	Client.exe

pid	process
2496	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

561d2b135a6200ef094b222eb47af87a.exeClient.exe

description	pid	process	target process
PID 2476 wrote to memory of 2968	2476	561d2b135a6200ef094b222eb47af87a.exe	schtasks.exe
PID 2476 wrote to memory of 2968	2476	561d2b135a6200ef094b222eb47af87a.exe	schtasks.exe
PID 2476 wrote to memory of 2968	2476	561d2b135a6200ef094b222eb47af87a.exe	schtasks.exe
PID 2476 wrote to memory of 2496	2476	561d2b135a6200ef094b222eb47af87a.exe	Client.exe
PID 2476 wrote to memory of 2496	2476	561d2b135a6200ef094b222eb47af87a.exe	Client.exe
PID 2476 wrote to memory of 2496	2476	561d2b135a6200ef094b222eb47af87a.exe	Client.exe
PID 2496 wrote to memory of 2536	2496	Client.exe	schtasks.exe
PID 2496 wrote to memory of 2536	2496	Client.exe	schtasks.exe
PID 2496 wrote to memory of 2536	2496	Client.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\561d2b135a6200ef094b222eb47af87a.exe
"C:\Users\Admin\AppData\Local\Temp\561d2b135a6200ef094b222eb47af87a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Windows Boot Menu" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2968

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Windows Boot Menu" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2536

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
561d2b135a6200ef094b222eb47af87a

SHA1
4db2f2254cae3695a0ffa7ccdc13097db254cd8c

SHA256
c458feb66832df6a0c361d951c60bcda34c4f5c82652d25c5e4a1aa4c41d8d94

SHA512
6bd32a9099968b13150a16ee919684e319a67a55dc436fb36157901528e5ccf0283daecdafd07876186f00af13a3bba170a6328926156578a2c06455772b0094

Download Submit
memory/2476-0-0x0000000000D20000-0x0000000001044000-memory.dmp

Filesize
3.1MB

Download
memory/2476-1-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download
memory/2476-2-0x000000001B500000-0x000000001B580000-memory.dmp

Filesize
512KB

Download
memory/2476-9-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download
memory/2496-8-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download
memory/2496-10-0x0000000000A30000-0x0000000000D54000-memory.dmp

Filesize
3.1MB

Download
memory/2496-11-0x000000001B390000-0x000000001B410000-memory.dmp

Filesize
512KB

Download
memory/2496-12-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download
memory/2496-13-0x000000001B390000-0x000000001B410000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads