quasar | 31f0e68a0fb8a6e1714ade7379d486d56aa1421d2f22ff3d632c1fe24f59457a

Analysis

max time kernel
25s
max time network
16s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CzSOSINT.exe
Size

297KB
MD5

311c6835775d900f12ece1d138aee2a6
SHA1

95ea06961562ddfa77f645be03f95d08d1cdb2e0
SHA256

31f0e68a0fb8a6e1714ade7379d486d56aa1421d2f22ff3d632c1fe24f59457a
SHA512

19cc40219e209fc878ea2beb5cb81917cd3bf43684d9c1d42643581c38b5db393ae8c2362d167521002e466a80fe24b08163aefda5aa7d266b4731f5c985d500
SSDEEP

6144:9eQCIpHePBK7UOYz1mhJCtWY9XcNfPHDpu74NpgtcZRg/+wPO:0ae5mYzcLC0YuF8kHX/g/

Score

10^/10

quasar rslavereel spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

RSlaveReel

147.185.221.19:33587

Mutex

$Sxr-PODin6zbdvLuVkqKla

Attributes

encryption_key
myaDwGp04jmlN7Zrz509
install_name
WindowsDllRunHost.exe
log_directory
Update Logs
reconnect_delay
3000
startup_key
WindowsBIOSUpdx64
subdirectory
orbitpaid

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000153c7-12.dat	family_quasar
behavioral1/memory/2548-15-0x0000000000E00000-0x0000000000E6C000-memory.dmp	family_quasar
behavioral1/memory/2592-26-0x00000000000F0000-0x000000000015C000-memory.dmp	family_quasar

Executes dropped EXE 3 IoCs

pid	Process
768	IDTOIPBYR_0.exe
2548	Update.exe
2592	WindowsDllRunHost.exe

Loads dropped DLL 2 IoCs

pid	Process
3004	CzSOSINT.exe
2548	Update.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2808	SCHTASKS.exe
2732	schtasks.exe
2920	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	Update.exe
Token: SeDebugPrivilege	2592	WindowsDllRunHost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2592	WindowsDllRunHost.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 768	3004	CzSOSINT.exe	28
PID 3004 wrote to memory of 768	3004	CzSOSINT.exe	28
PID 3004 wrote to memory of 768	3004	CzSOSINT.exe	28
PID 3004 wrote to memory of 2548	3004	CzSOSINT.exe	29
PID 3004 wrote to memory of 2548	3004	CzSOSINT.exe	29
PID 3004 wrote to memory of 2548	3004	CzSOSINT.exe	29
PID 3004 wrote to memory of 2548	3004	CzSOSINT.exe	29
PID 3004 wrote to memory of 2548	3004	CzSOSINT.exe	29
PID 3004 wrote to memory of 2548	3004	CzSOSINT.exe	29
PID 3004 wrote to memory of 2548	3004	CzSOSINT.exe	29
PID 2548 wrote to memory of 2732	2548	Update.exe	31
PID 2548 wrote to memory of 2732	2548	Update.exe	31
PID 2548 wrote to memory of 2732	2548	Update.exe	31
PID 2548 wrote to memory of 2732	2548	Update.exe	31
PID 2548 wrote to memory of 2592	2548	Update.exe	33
PID 2548 wrote to memory of 2592	2548	Update.exe	33
PID 2548 wrote to memory of 2592	2548	Update.exe	33
PID 2548 wrote to memory of 2592	2548	Update.exe	33
PID 2548 wrote to memory of 2592	2548	Update.exe	33
PID 2548 wrote to memory of 2592	2548	Update.exe	33
PID 2548 wrote to memory of 2592	2548	Update.exe	33
PID 2592 wrote to memory of 2920	2592	WindowsDllRunHost.exe	34
PID 2592 wrote to memory of 2920	2592	WindowsDllRunHost.exe	34
PID 2592 wrote to memory of 2920	2592	WindowsDllRunHost.exe	34
PID 2592 wrote to memory of 2920	2592	WindowsDllRunHost.exe	34
PID 2548 wrote to memory of 2808	2548	Update.exe	36
PID 2548 wrote to memory of 2808	2548	Update.exe	36
PID 2548 wrote to memory of 2808	2548	Update.exe	36
PID 2548 wrote to memory of 2808	2548	Update.exe	36

C:\Users\Admin\AppData\Local\Temp\CzSOSINT.exe
"C:\Users\Admin\AppData\Local\Temp\CzSOSINT.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.exe
  "C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.exe"
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Users\Admin\AppData\Local\Temp\Update.exe
  "C:\Users\Admin\AppData\Local\Temp\Update.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "WindowsBIOSUpdx64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Update.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2732
- - C:\Users\Admin\AppData\Roaming\orbitpaid\WindowsDllRunHost.exe
    "C:\Users\Admin\AppData\Roaming\orbitpaid\WindowsDllRunHost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "WindowsBIOSUpdx64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\orbitpaid\WindowsDllRunHost.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:2920
- - C:\Windows\SysWOW64\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "$77Update.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Update.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Update.exe

Filesize
409KB

MD5
b551c695865c6d7f51346d324f7d4604

SHA1
dc8cc6bf41bf725fb8747c21d264dd7d9ec5ad72

SHA256
bb450aec5b543dd30c3ce33c731340a3c601afa75ca2670dfc0bf547be064dd0

SHA512
6a7cf624887b19fceb7f08dd06965c1a4ca8b07390447a411ef60738070ab19258d4ad96b489782b0f3e46c1e153e27293d2725123af72c57dd112bc61d51ba1

Download Submit
\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.exe

Filesize
139KB

MD5
224ce6bc7b94e1843e1f1623d856e93b

SHA1
5a28a76369bc15982f0ba95c79e74c496db0df14

SHA256
7d520ade71bbd117074f1c071c68021edbf8c0ff79729cdca6a556eac338bafd

SHA512
6508be341f8b224657f288c543ee1bc99895d03d9fe0f27fdfbbe39261d6683555e53592f25ba0f523d74a84dbba39e1f86e18d9173c3820c1c8df3c01817ff6

Download Submit
memory/2548-15-0x0000000000E00000-0x0000000000E6C000-memory.dmp

Filesize
432KB

Download
memory/2548-16-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download
memory/2548-17-0x0000000004A60000-0x0000000004AA0000-memory.dmp

Filesize
256KB

Download
memory/2548-29-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download
memory/2592-25-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download
memory/2592-26-0x00000000000F0000-0x000000000015C000-memory.dmp

Filesize
432KB

Download
memory/2592-27-0x0000000004910000-0x0000000004950000-memory.dmp

Filesize
256KB

Download
memory/2592-30-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download
memory/3004-2-0x000000001B540000-0x000000001B5C0000-memory.dmp

Filesize
512KB

Download
memory/3004-1-0x000007FEF4E60000-0x000007FEF584C000-memory.dmp

Filesize
9.9MB

Download
memory/3004-14-0x000007FEF4E60000-0x000007FEF584C000-memory.dmp

Filesize
9.9MB

Download
memory/3004-0-0x0000000001250000-0x00000000012A0000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads