quasar | cf9ef2af812e7e3fe4ce9d1f875279110f318d678c5f053e5d767b02eadc2694

Analysis

max time kernel
130s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/04/2024, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
quaser.exe
Size 506KB
Sample240401-pc8cesef36
SHA256 cf9ef2af812e7e3fe4ce9d1f875279110f318d678c5f053e5d767b02eadc2694
MD5 9e4f25a9371519abfcb0e850b339f267
SHA1 6baa935a6dd575bf89c6d35e895553ec2108a11d
SHA512 e6776ce8454ca443f0f9a7fa855942bd6d8f7c765d60b1f7cd8f63ca787c5032c33297ed23b9bf73b54222219225234d8bf136ad8be56a64fefde4c0f5fe72d7
SSDEEP 12288:gUBgyoyvfLUlzVx1ziaod6QdGB8lDQ5IUhNv1K:gUXvfLUlzVxZ+d6QdGcDSIULE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar welcome spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

welcome

185.144.28.50:8080
80.85.154.22:8080

Mutex

QSR_MUTEX_KOCkZ8aUXzJpoMsKnJ

Attributes

encryption_key
y4kgXabXHGVPR1ljHctQ
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svchost
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0024000000015c3c-5.dat	family_quasar
behavioral1/memory/2984-18-0x00000000008B0000-0x000000000090E000-memory.dmp	family_quasar
behavioral1/memory/2488-27-0x0000000001040000-0x000000000109E000-memory.dmp	family_quasar
behavioral1/memory/2488-29-0x0000000000F60000-0x0000000000FA0000-memory.dmp	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
2984	Client-built.exe
2488	Client.exe

Loads dropped DLL 5 IoCs

pid	Process
2456	quaser.exe
2456	quaser.exe
2456	quaser.exe
2456	quaser.exe
2984	Client-built.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1972	schtasks.exe
2320	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	Client-built.exe
Token: SeDebugPrivilege	2488	Client.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2828	DllHost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2984	2456	quaser.exe	28
PID 2456 wrote to memory of 2984	2456	quaser.exe	28
PID 2456 wrote to memory of 2984	2456	quaser.exe	28
PID 2456 wrote to memory of 2984	2456	quaser.exe	28
PID 2984 wrote to memory of 1972	2984	Client-built.exe	30
PID 2984 wrote to memory of 1972	2984	Client-built.exe	30
PID 2984 wrote to memory of 1972	2984	Client-built.exe	30
PID 2984 wrote to memory of 1972	2984	Client-built.exe	30
PID 2984 wrote to memory of 2488	2984	Client-built.exe	32
PID 2984 wrote to memory of 2488	2984	Client-built.exe	32
PID 2984 wrote to memory of 2488	2984	Client-built.exe	32
PID 2984 wrote to memory of 2488	2984	Client-built.exe	32
PID 2488 wrote to memory of 2320	2488	Client.exe	34
PID 2488 wrote to memory of 2320	2488	Client.exe	34
PID 2488 wrote to memory of 2320	2488	Client.exe	34
PID 2488 wrote to memory of 2320	2488	Client.exe	34

C:\Users\Admin\AppData\Local\Temp\quaser.exe
"C:\Users\Admin\AppData\Local\Temp\quaser.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1972
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:2320

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

queen.png

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\queen.png
Size 101KB
SHA256 cf204a8fc7e6e1939e3f24a9fac5bb1379a9dd4424c445be2148ff5798d15ac2
MD5 88b250186af7fde15809e6754f51b550
SHA1 34e60a8cf59a07014f8fb7a58aec8eb0243c6821
SHA512 006d2c94367b055cd46a11298f618d963549bab69688ba6962409ff8348de7233634f1709acf2e92deea845b2da2b44318544acf18c73111df54b21353ba503b
SSDEEP 3072:1bTXzDKYdsChUtgnVxPYsge1JtU7byTyG:1fXnKYyQznvAvMtU7bTG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client-built.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
Size 348KB
SHA256 5713a4e54db781fc56f1f47ed76f78c55f26cc72b140c7c568ef9855e7fe0200
MD5 44213d3f1efeb4f26428c774fb49d69e
SHA1 42f5b0067445c282fab040a0f75d5f5db8877b80
SHA512 d4b4a86bca9926b1e7049a0b07119e06742df82bbf6f5d50a55affa726010cbacb34fc25e602656a6d09deacb3593a804f1e581da7ce150e4b8f4fbdeeabc6c8
SSDEEP 6144:1cNHXf500MFt6PStARE4FboRGEfhDyx0tRNO:md50ja+lfZK0tfO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2456-30-0x0000000002280000-0x0000000002282000-memory.dmp

Download

memory/2488-36-0x0000000000F60000-0x0000000000FA0000-memory.dmp

Download

memory/2488-35-0x0000000074600000-0x0000000074CEE000-memory.dmp

Download

memory/2488-28-0x0000000074600000-0x0000000074CEE000-memory.dmp

Download

memory/2488-27-0x0000000001040000-0x000000000109E000-memory.dmp

Download

memory/2488-29-0x0000000000F60000-0x0000000000FA0000-memory.dmp

Download

memory/2828-32-0x0000000000280000-0x0000000000281000-memory.dmp

Download

memory/2828-31-0x0000000000130000-0x0000000000132000-memory.dmp

Download

memory/2828-37-0x0000000000280000-0x0000000000281000-memory.dmp

Download

memory/2984-20-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Download

memory/2984-34-0x0000000074600000-0x0000000074CEE000-memory.dmp

Download

memory/2984-19-0x0000000074600000-0x0000000074CEE000-memory.dmp

Download

memory/2984-18-0x00000000008B0000-0x000000000090E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads