quasar | 6f4dd3d2ea6b1310b9c9e2063aba85396ea82e63f777a5dd5b42dac67c0ae630

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

agent64.exe
Size

3.1MB
MD5

488550eeb4ae87c8f9510e04e222261d
SHA1

18c1785375af65ec82a161d13354656282412803
SHA256

6f4dd3d2ea6b1310b9c9e2063aba85396ea82e63f777a5dd5b42dac67c0ae630
SHA512

4ea8274a28e8ee68633b5ebd07e68916d80d9d807ee62c3700f9cfb5bd990ba6c88b8ac7bdac893964139ea9a949a2ee092334d45b48fbe590c1345ada594514
SSDEEP

49152:fvSI22SsaNYfdPBldt698dBcjHslRJ6sbR3LoGd5/THHB72eh2NT:fv/22SsaNYfdPBldt6+dBcjHslRJ62

Score

10^/10

quasar god spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

God

88.209.197.253:4782

Mutex

5b9901b6-5e69-4eaa-a9f2-55ce43b72785

Attributes

encryption_key
CEAEA9FD2F3E18352164BB4D9A6F56EFF5E2D896
install_name
COM Surrogate.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Update
subdirectory
System32

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/1708-0-0x0000000000A60000-0x0000000000D84000-memory.dmp	family_quasar
behavioral1/files/0x0009000000015c5e-6.dat	family_quasar
behavioral1/memory/1748-9-0x0000000001260000-0x0000000001584000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
1748	COM Surrogate.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2116	schtasks.exe
2532	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	agent64.exe
Token: SeDebugPrivilege	1748	COM Surrogate.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1748	COM Surrogate.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2116	1708	agent64.exe	28
PID 1708 wrote to memory of 2116	1708	agent64.exe	28
PID 1708 wrote to memory of 2116	1708	agent64.exe	28
PID 1708 wrote to memory of 1748	1708	agent64.exe	30
PID 1708 wrote to memory of 1748	1708	agent64.exe	30
PID 1708 wrote to memory of 1748	1708	agent64.exe	30
PID 1748 wrote to memory of 2532	1748	COM Surrogate.exe	31
PID 1748 wrote to memory of 2532	1748	COM Surrogate.exe	31
PID 1748 wrote to memory of 2532	1748	COM Surrogate.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\agent64.exe
"C:\Users\Admin\AppData\Local\Temp\agent64.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\System32\COM Surrogate.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2116
- C:\Users\Admin\AppData\Roaming\System32\COM Surrogate.exe
  "C:\Users\Admin\AppData\Roaming\System32\COM Surrogate.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\System32\COM Surrogate.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\System32\COM Surrogate.exe

Filesize
3.1MB

MD5
488550eeb4ae87c8f9510e04e222261d

SHA1
18c1785375af65ec82a161d13354656282412803

SHA256
6f4dd3d2ea6b1310b9c9e2063aba85396ea82e63f777a5dd5b42dac67c0ae630

SHA512
4ea8274a28e8ee68633b5ebd07e68916d80d9d807ee62c3700f9cfb5bd990ba6c88b8ac7bdac893964139ea9a949a2ee092334d45b48fbe590c1345ada594514

Download Submit
memory/1708-0-0x0000000000A60000-0x0000000000D84000-memory.dmp

Filesize
3.1MB

Download
memory/1708-1-0x000007FEF5860000-0x000007FEF624C000-memory.dmp

Filesize
9.9MB

Download
memory/1708-2-0x000000001B4A0000-0x000000001B520000-memory.dmp

Filesize
512KB

Download
memory/1708-8-0x000007FEF5860000-0x000007FEF624C000-memory.dmp

Filesize
9.9MB

Download
memory/1748-10-0x000007FEF5860000-0x000007FEF624C000-memory.dmp

Filesize
9.9MB

Download
memory/1748-9-0x0000000001260000-0x0000000001584000-memory.dmp

Filesize
3.1MB

Download
memory/1748-11-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/1748-12-0x000007FEF5860000-0x000007FEF624C000-memory.dmp

Filesize
9.9MB

Download
memory/1748-13-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads