quasar | 4571773a3e6ad8353ea567bdc05858a3cc8190ff8fbd40a5c844514bbbf0e6a8

General

Target

Microsoft Edge.exe
Size

3.2MB
MD5

0e44355a17e4f66fb5b41acad632bb1b
SHA1

ce7b6aa56b5dae9ff102a37000473239ea63c222
SHA256

4571773a3e6ad8353ea567bdc05858a3cc8190ff8fbd40a5c844514bbbf0e6a8
SHA512

b9d0e0c17774731eb23a56f01f05f4977cf2fb5c8922af38552bef4051ec578e6d3ddf038c94e0ede3986005260dbdb4458dc01a28ff8b3f665b32b6f471459f
SSDEEP

49152:8vBt62XlaSFNWPjljiFa2RoUYIpsivoGdt0THHB72eh2NT9:8vr62XlaSFNWPjljiFXRoUYIps29

Score

10^/10

quasar leo spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Leo

C2

192.168.178.103:42069

Mutex

d48a83a9-fbfc-4973-b9da-e23962f730b0

Attributes

encryption_key
4C3EB5E019E09906D9FE073B58F6E628B0707200
install_name
msedge.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft Edge
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/2652-0-0x0000000000A30000-0x0000000000D64000-memory.dmp	family_quasar
behavioral1/files/0x000800000002320b-8.dat	family_quasar
behavioral1/files/0x000800000002320b-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
3968	msedge.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir	msedge.exe
File created	C:\Windows\system32\SubDir\msedge.exe	Microsoft Edge.exe
File opened for modification	C:\Windows\system32\SubDir\msedge.exe	Microsoft Edge.exe
File opened for modification	C:\Windows\system32\SubDir	Microsoft Edge.exe
File opened for modification	C:\Windows\system32\SubDir\msedge.exe	msedge.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2768	schtasks.exe
3744	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2652	Microsoft Edge.exe
Token: SeDebugPrivilege	3968	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3968	msedge.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 3744	2652	Microsoft Edge.exe	91
PID 2652 wrote to memory of 3744	2652	Microsoft Edge.exe	91
PID 2652 wrote to memory of 3968	2652	Microsoft Edge.exe	93
PID 2652 wrote to memory of 3968	2652	Microsoft Edge.exe	93
PID 3968 wrote to memory of 2768	3968	msedge.exe	96
PID 3968 wrote to memory of 2768	3968	msedge.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Microsoft Edge.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft Edge.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Microsoft Edge" /sc ONLOGON /tr "C:\Windows\system32\SubDir\msedge.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3744
- C:\Windows\system32\SubDir\msedge.exe
  "C:\Windows\system32\SubDir\msedge.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Microsoft Edge" /sc ONLOGON /tr "C:\Windows\system32\SubDir\msedge.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\SubDir\msedge.exe

Filesize
450KB

MD5
67c0d55c1f47af58e3311c86bf5f2596

SHA1
4d854dc73f39a47a80108e2c0a3c6480385a87cb

SHA256
c0195a5f1a8843e8d7b8f7bd633451faa6c0d8fa984ba042fbc283ef9f2bccbc

SHA512
f14182c0036e3477fb3fd32cc92b8b231a39ba81c071f43e19d1a6b6be913ade419fe3c9704d94a85e7c8cd7f0c01e36e61fd694c3ab87ca4dffe548aa90b188

Download Submit
C:\Windows\system32\SubDir\msedge.exe

Filesize
708KB

MD5
b83ed39d22cfb219aa056b348352e6d3

SHA1
f58f3bcfd647150366195797f80ab8984bb032ff

SHA256
ba41f87499d3c1996235df0f0426a55229a4030b9c1379e51c1fb1bfbd9d65a0

SHA512
20062a6322a6d9e5ef8ba8173a9549fd43acee57e276ce52ca207d8cb02532ef13a801b1b1526b502467994ae2ef9036d3b156107ac542865b228f0d0690e197

Download Submit
memory/2652-0-0x0000000000A30000-0x0000000000D64000-memory.dmp

Filesize
3.2MB

Download
memory/2652-1-0x00007FFD2EDE0000-0x00007FFD2F8A1000-memory.dmp

Filesize
10.8MB

Download
memory/2652-2-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Filesize
64KB

Download
memory/2652-9-0x00007FFD2EDE0000-0x00007FFD2F8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3968-10-0x00007FFD2EDE0000-0x00007FFD2F8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3968-11-0x0000000002830000-0x0000000002840000-memory.dmp

Filesize
64KB

Download
memory/3968-12-0x000000001BAF0000-0x000000001BB40000-memory.dmp

Filesize
320KB

Download
memory/3968-13-0x000000001BC00000-0x000000001BCB2000-memory.dmp

Filesize
712KB

Download
memory/3968-14-0x000000001C2F0000-0x000000001C818000-memory.dmp

Filesize
5.2MB

Download
memory/3968-16-0x00007FFD2EDE0000-0x00007FFD2F8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3968-17-0x0000000002830000-0x0000000002840000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads