quasar | 38ed9c3c0a1ff424c8360f8514eb034520061e7eb11a677b5c89dbbcf06260d5

General

Target

hackist.exe
Size

3.1MB
MD5

73d6fb94ebb1a1eb5e507e4c41878c45
SHA1

f03e0daef09bc0e4052640c408bdbab7179400b0
SHA256

38ed9c3c0a1ff424c8360f8514eb034520061e7eb11a677b5c89dbbcf06260d5
SHA512

363cf78f48cbf85bd5d61a831fe7f88981a47411a6c1760d388c7e714ac96d81dba264a606d72f6fbab857929e3621f31b34da5b0750eedf3c2d7d2aac835ce8
SSDEEP

49152:7vYAd23law6wGPAllX3SSLNUpyA9RJ6xbR3LoGdlTHHB72eh2NT:7vJd23law6wGPAllX3bLNUpyA9RJ6T

Score

10^/10

quasar offnn spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Offnn

C2

127.0.0.0:4782

127.0.0.1:4782

revivededd-39870.portmap.host:39870

revivededd-39870.portmap.host:7777

Mutex

0edcddf2-c29d-4f2c-a25e-3d1b6a907f7b

Attributes

encryption_key
A91D3A82F92AE9D8F9D5AE251C12A3542632C240
install_name
Oiwc.exe
log_directory
Logs
reconnect_delay
3000
startup_key
ju
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/1532-0-0x00000000004B0000-0x00000000007D4000-memory.dmp	family_quasar
behavioral2/files/0x00080000000233ee-5.dat	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	Oiwc.exe

Executes dropped EXE 2 IoCs

pid	Process
432	Oiwc.exe
2968	haSI0lJVx1pk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5076	schtasks.exe
1704	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1532	hackist.exe
Token: SeDebugPrivilege	432	Oiwc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
432	Oiwc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 5076	1532	hackist.exe	90
PID 1532 wrote to memory of 5076	1532	hackist.exe	90
PID 1532 wrote to memory of 432	1532	hackist.exe	92
PID 1532 wrote to memory of 432	1532	hackist.exe	92
PID 432 wrote to memory of 1704	432	Oiwc.exe	93
PID 432 wrote to memory of 1704	432	Oiwc.exe	93
PID 432 wrote to memory of 2968	432	Oiwc.exe	101
PID 432 wrote to memory of 2968	432	Oiwc.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\hackist.exe
"C:\Users\Admin\AppData\Local\Temp\hackist.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "ju" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Oiwc.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:5076
- C:\Users\Admin\AppData\Roaming\SubDir\Oiwc.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Oiwc.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "ju" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Oiwc.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1704
- - C:\Users\Admin\AppData\Local\Temp\haSI0lJVx1pk.exe
    "C:\Users\Admin\AppData\Local\Temp\haSI0lJVx1pk.exe"
    3⤵
    - Executes dropped EXE
    PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\haSI0lJVx1pk.exe

Filesize
7.0MB

MD5
a8bd4a6b2f1d00928e61870a5688c13d

SHA1
e17646d5279534f2e3eb0e0cfc8b6c536bc0c095

SHA256
2c51f67e236cf95e2d51df4178699da09869ab077924cff0b3df1c512878ef2f

SHA512
6b5175beea4071668c87b16af3177bbb2cbaff6b28909dc1e09ad5b16b449c62d6adc372a0094de627fe9835f0c474d16708c3f698355ba1664bf321fa19f5fb

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Oiwc.exe

Filesize
3.1MB

MD5
73d6fb94ebb1a1eb5e507e4c41878c45

SHA1
f03e0daef09bc0e4052640c408bdbab7179400b0

SHA256
38ed9c3c0a1ff424c8360f8514eb034520061e7eb11a677b5c89dbbcf06260d5

SHA512
363cf78f48cbf85bd5d61a831fe7f88981a47411a6c1760d388c7e714ac96d81dba264a606d72f6fbab857929e3621f31b34da5b0750eedf3c2d7d2aac835ce8

Download Submit
memory/432-16-0x000000001C9E0000-0x000000001CA1C000-memory.dmp

Filesize
240KB

Download
memory/432-13-0x00007FF973090000-0x00007FF973B51000-memory.dmp

Filesize
10.8MB

Download
memory/432-15-0x000000001BBE0000-0x000000001BBF2000-memory.dmp

Filesize
72KB

Download
memory/432-9-0x00007FF973090000-0x00007FF973B51000-memory.dmp

Filesize
10.8MB

Download
memory/432-10-0x000000001BC10000-0x000000001BC20000-memory.dmp

Filesize
64KB

Download
memory/432-11-0x000000001BB90000-0x000000001BBE0000-memory.dmp

Filesize
320KB

Download
memory/432-12-0x000000001C1E0000-0x000000001C292000-memory.dmp

Filesize
712KB

Download
memory/432-14-0x000000001BC10000-0x000000001BC20000-memory.dmp

Filesize
64KB

Download
memory/1532-2-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/1532-8-0x00007FF973090000-0x00007FF973B51000-memory.dmp

Filesize
10.8MB

Download
memory/1532-0-0x00000000004B0000-0x00000000007D4000-memory.dmp

Filesize
3.1MB

Download
memory/1532-1-0x00007FF973090000-0x00007FF973B51000-memory.dmp

Filesize
10.8MB

Download
memory/2968-28-0x00000142D1600000-0x00000142D1D08000-memory.dmp

Filesize
7.0MB

Download
memory/2968-29-0x00007FF973090000-0x00007FF973B51000-memory.dmp

Filesize
10.8MB

Download
memory/2968-30-0x00000142D2130000-0x00000142D2140000-memory.dmp

Filesize
64KB

Download
memory/2968-31-0x00007FF973090000-0x00007FF973B51000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads