quasar | 4b49068a198e8dcc90d1ae5d623c2cf669c93e067573b26c880b56b14e550e3a

General

Target

4b49068a198e8dcc90d1ae5d623c2cf669c93e067573b26c880b56b14e550e3a.exe
Size

3.1MB
MD5

b05ef4b68b309f9aefa705d3c0ab50e1
SHA1

ffbf50f019be8426868b616960713fa4f596905c
SHA256

4b49068a198e8dcc90d1ae5d623c2cf669c93e067573b26c880b56b14e550e3a
SHA512

e77b2fd9d92fd286cedd1f7a70767968a9048b02206493b43aaac11b73a29fbc8819a28f2fb7b765c87cfbf734fad0fda40483bb495a2f177833c31a5ce9294b
SSDEEP

49152:2vPI22SsaNYfdPBldt698dBcjHKyRJ68bR3LoGdJJTHHB72eh2NT:2vA22SsaNYfdPBldt6+dBcjHKyRJ6GZ

Score

10^/10

quasar 1st spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

1st

C2

94.156.8.44:4787

94.156.8.44:6606

Mutex

8c89b218-c255-48cb-be3d-4ac14fe780fa

Attributes

encryption_key
4785083178D87EB2AD342D8849D0672AE29F1744
install_name
softgui.exe
log_directory
Logs
reconnect_delay
3000
startup_key
softgui.svc
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2792-0-0x0000000000B70000-0x0000000000E94000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\softgui.exe	family_quasar
behavioral1/memory/796-10-0x0000000001370000-0x0000000001694000-memory.dmp	family_quasar

Detects Windows executables referencing non-Windows User-Agents 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2792-0-0x0000000000B70000-0x0000000000E94000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
C:\Users\Admin\AppData\Roaming\SubDir\softgui.exe	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/796-10-0x0000000001370000-0x0000000001694000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2792-0-0x0000000000B70000-0x0000000000E94000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
C:\Users\Admin\AppData\Roaming\SubDir\softgui.exe	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/796-10-0x0000000001370000-0x0000000001694000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing common artifacts observed in infostealers 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2792-0-0x0000000000B70000-0x0000000000E94000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer
C:\Users\Admin\AppData\Roaming\SubDir\softgui.exe	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral1/memory/796-10-0x0000000001370000-0x0000000001694000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer

Executes dropped EXE 1 IoCs

Processes:

softgui.exe

pid process

796 softgui.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1936 schtasks.exe
2644 schtasks.exe

pid	process
796	softgui.exe

pid	process
1936	schtasks.exe
2644	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4b49068a198e8dcc90d1ae5d623c2cf669c93e067573b26c880b56b14e550e3a.exesoftgui.exe

description	pid	process
Token: SeDebugPrivilege	2792	4b49068a198e8dcc90d1ae5d623c2cf669c93e067573b26c880b56b14e550e3a.exe
Token: SeDebugPrivilege	796	softgui.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

softgui.exe

pid process

796 softgui.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

softgui.exe

pid process

796 softgui.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

softgui.exe

pid process

796 softgui.exe

pid	process
796	softgui.exe

pid	process
796	softgui.exe

pid	process
796	softgui.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

4b49068a198e8dcc90d1ae5d623c2cf669c93e067573b26c880b56b14e550e3a.exesoftgui.exe

description	pid	process	target process
PID 2792 wrote to memory of 1936	2792	4b49068a198e8dcc90d1ae5d623c2cf669c93e067573b26c880b56b14e550e3a.exe	schtasks.exe
PID 2792 wrote to memory of 1936	2792	4b49068a198e8dcc90d1ae5d623c2cf669c93e067573b26c880b56b14e550e3a.exe	schtasks.exe
PID 2792 wrote to memory of 1936	2792	4b49068a198e8dcc90d1ae5d623c2cf669c93e067573b26c880b56b14e550e3a.exe	schtasks.exe
PID 2792 wrote to memory of 796	2792	4b49068a198e8dcc90d1ae5d623c2cf669c93e067573b26c880b56b14e550e3a.exe	softgui.exe
PID 2792 wrote to memory of 796	2792	4b49068a198e8dcc90d1ae5d623c2cf669c93e067573b26c880b56b14e550e3a.exe	softgui.exe
PID 2792 wrote to memory of 796	2792	4b49068a198e8dcc90d1ae5d623c2cf669c93e067573b26c880b56b14e550e3a.exe	softgui.exe
PID 796 wrote to memory of 2644	796	softgui.exe	schtasks.exe
PID 796 wrote to memory of 2644	796	softgui.exe	schtasks.exe
PID 796 wrote to memory of 2644	796	softgui.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4b49068a198e8dcc90d1ae5d623c2cf669c93e067573b26c880b56b14e550e3a.exe
"C:\Users\Admin\AppData\Local\Temp\4b49068a198e8dcc90d1ae5d623c2cf669c93e067573b26c880b56b14e550e3a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "softgui.svc" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\softgui.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1936

C:\Users\Admin\AppData\Roaming\SubDir\softgui.exe
"C:\Users\Admin\AppData\Roaming\SubDir\softgui.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "softgui.svc" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\softgui.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2644

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\softgui.exe
Filesize
3.1MB

MD5
b05ef4b68b309f9aefa705d3c0ab50e1

SHA1
ffbf50f019be8426868b616960713fa4f596905c

SHA256
4b49068a198e8dcc90d1ae5d623c2cf669c93e067573b26c880b56b14e550e3a

SHA512
e77b2fd9d92fd286cedd1f7a70767968a9048b02206493b43aaac11b73a29fbc8819a28f2fb7b765c87cfbf734fad0fda40483bb495a2f177833c31a5ce9294b

Download Submit
memory/796-8-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/796-10-0x0000000001370000-0x0000000001694000-memory.dmp

Filesize
3.1MB

Download
memory/796-11-0x000000001B200000-0x000000001B280000-memory.dmp

Filesize
512KB

Download
memory/796-12-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/796-13-0x000000001B200000-0x000000001B280000-memory.dmp

Filesize
512KB

Download
memory/2792-0-0x0000000000B70000-0x0000000000E94000-memory.dmp

Filesize
3.1MB

Download
memory/2792-1-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2792-2-0x000000001B110000-0x000000001B190000-memory.dmp

Filesize
512KB

Download
memory/2792-9-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads