quasar | d72775e6603951c44c96ac31885bca2efb1358c86473a1f2e33c98a62a73a4ac

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

9a8853b2d14a1cc2779bca39bbec62b2
SHA1

93fed5da8104e34f9c42a5e59227829a86d3795d
SHA256

d72775e6603951c44c96ac31885bca2efb1358c86473a1f2e33c98a62a73a4ac
SHA512

c249f9d236bd5bae249cce6be833d5f4ea725efb1c6f79afc30e28657472ce4e6e6ce281c1c14d31974f05e7a0f3555e513886df63b5c326ade7e8239d8de43e
SSDEEP

49152:DvrI22SsaNYfdPBldt698dBcjHyjyPzoGroTHHB72eh2NT:DvU22SsaNYfdPBldt6+dBcjHyjyr

Score

10^/10

quasar slave spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Slave

xcoderreal-54839.portmap.host:54839

Mutex

276d9dc6-b19c-4958-8ac3-89586bd3b515

Attributes

encryption_key
ABCF70C37D1A79A01712038122D1532DF20DF72A
install_name
Client.exe
log_directory
Error Logs
reconnect_delay
3000
startup_key
WOS64
subdirectory
Windows

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1900-0-0x0000000001120000-0x0000000001444000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\Windows\Client.exe	family_quasar
behavioral1/memory/2152-8-0x0000000001090000-0x00000000013B4000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

2152 Client.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2228 schtasks.exe
2656 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Client-built.exeClient.exe

description pid process

Token: SeDebugPrivilege 1900 Client-built.exe
Token: SeDebugPrivilege 2152 Client.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

2152 Client.exe

pid	process
2152	Client.exe

pid	process
2228	schtasks.exe
2656	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1900	Client-built.exe
Token: SeDebugPrivilege	2152	Client.exe

pid	process
2152	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Client-built.exeClient.exe

description	pid	process	target process
PID 1900 wrote to memory of 2228	1900	Client-built.exe	schtasks.exe
PID 1900 wrote to memory of 2228	1900	Client-built.exe	schtasks.exe
PID 1900 wrote to memory of 2228	1900	Client-built.exe	schtasks.exe
PID 1900 wrote to memory of 2152	1900	Client-built.exe	Client.exe
PID 1900 wrote to memory of 2152	1900	Client-built.exe	Client.exe
PID 1900 wrote to memory of 2152	1900	Client-built.exe	Client.exe
PID 2152 wrote to memory of 2656	2152	Client.exe	schtasks.exe
PID 2152 wrote to memory of 2656	2152	Client.exe	schtasks.exe
PID 2152 wrote to memory of 2656	2152	Client.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "WOS64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\Client.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2228

C:\Users\Admin\AppData\Roaming\Windows\Client.exe
"C:\Users\Admin\AppData\Roaming\Windows\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "WOS64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2656

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Windows\Client.exe
Filesize
3.1MB

MD5
9a8853b2d14a1cc2779bca39bbec62b2

SHA1
93fed5da8104e34f9c42a5e59227829a86d3795d

SHA256
d72775e6603951c44c96ac31885bca2efb1358c86473a1f2e33c98a62a73a4ac

SHA512
c249f9d236bd5bae249cce6be833d5f4ea725efb1c6f79afc30e28657472ce4e6e6ce281c1c14d31974f05e7a0f3555e513886df63b5c326ade7e8239d8de43e

Download Submit
memory/1900-0-0x0000000001120000-0x0000000001444000-memory.dmp

Filesize
3.1MB

Download
memory/1900-1-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/1900-2-0x000000001B0A0000-0x000000001B120000-memory.dmp

Filesize
512KB

Download
memory/1900-9-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/2152-10-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/2152-8-0x0000000001090000-0x00000000013B4000-memory.dmp

Filesize
3.1MB

Download
memory/2152-11-0x000000001B230000-0x000000001B2B0000-memory.dmp

Filesize
512KB

Download
memory/2152-12-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/2152-13-0x000000001B230000-0x000000001B2B0000-memory.dmp

Filesize
512KB

Download