quasar | 00c7cb06bebe0da961155dc00f7ea7f96a3b04c89ae82408e7ece6968c91c3c3

General

Target

Uni.exe
Size

409KB
MD5

7417c8c73e614f293152575f46134216
SHA1

cc68f7f5e7c769efb5b3e06bfb3a2f9329f37805
SHA256

00c7cb06bebe0da961155dc00f7ea7f96a3b04c89ae82408e7ece6968c91c3c3
SHA512

897a859e609028157f2721d76b97497d4b9f821d2b8be3359d1192ddc3a83d4b7449db25c63c3c260067b796c122194c48747dc611c98dc1e33aab82a20b98b0
SSDEEP

6144:nMr2pJAJcC0B632U3GRbMfgvKFFhTEDPX1NbKoEn5MSU+h2f8/14m:LpyJcC+82U3GRGGp1M5Ys2f8/6m

Score

10^/10

quasar slave spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SLAVE

C2

even-lemon.gl.at.ply.gg:33587

Mutex

$Sxr-dOMA5C0pQTTpKjVsCp

Attributes

encryption_key
UBXs44u6E81wxBGZxQHk
install_name
$sxr-powershell.exe
log_directory
$SXR-KEYLOGS
reconnect_delay
3000
startup_key
$sxr-powershell
subdirectory
$sxr-seroxen2

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2916-1-0x0000000000BA0000-0x0000000000C0C000-memory.dmp	family_quasar
\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe	family_quasar
behavioral2/memory/2776-11-0x0000000000DD0000-0x0000000000E3C000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

$sxr-powershell.exe

pid process

2776 $sxr-powershell.exe
Loads dropped DLL 1 IoCs

Processes:

Uni.exe

pid process

2916 Uni.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeSCHTASKS.exeschtasks.exe

pid process

2672 schtasks.exe
1952 SCHTASKS.exe
2616 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Uni.exe$sxr-powershell.exe

description pid process

Token: SeDebugPrivilege 2916 Uni.exe
Token: SeDebugPrivilege 2776 $sxr-powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

$sxr-powershell.exe

pid process

2776 $sxr-powershell.exe

pid	process
2776	$sxr-powershell.exe

pid	process
2916	Uni.exe

flow	ioc
2	ip-api.com

pid	process
2672	schtasks.exe
1952	SCHTASKS.exe
2616	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2916	Uni.exe
Token: SeDebugPrivilege	2776	$sxr-powershell.exe

pid	process
2776	$sxr-powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

Uni.exe$sxr-powershell.exe

description	pid	process	target process
PID 2916 wrote to memory of 2672	2916	Uni.exe	schtasks.exe
PID 2916 wrote to memory of 2672	2916	Uni.exe	schtasks.exe
PID 2916 wrote to memory of 2672	2916	Uni.exe	schtasks.exe
PID 2916 wrote to memory of 2672	2916	Uni.exe	schtasks.exe
PID 2916 wrote to memory of 2776	2916	Uni.exe	$sxr-powershell.exe
PID 2916 wrote to memory of 2776	2916	Uni.exe	$sxr-powershell.exe
PID 2916 wrote to memory of 2776	2916	Uni.exe	$sxr-powershell.exe
PID 2916 wrote to memory of 2776	2916	Uni.exe	$sxr-powershell.exe
PID 2916 wrote to memory of 1952	2916	Uni.exe	SCHTASKS.exe
PID 2916 wrote to memory of 1952	2916	Uni.exe	SCHTASKS.exe
PID 2916 wrote to memory of 1952	2916	Uni.exe	SCHTASKS.exe
PID 2916 wrote to memory of 1952	2916	Uni.exe	SCHTASKS.exe
PID 2776 wrote to memory of 2616	2776	$sxr-powershell.exe	schtasks.exe
PID 2776 wrote to memory of 2616	2776	$sxr-powershell.exe	schtasks.exe
PID 2776 wrote to memory of 2616	2776	$sxr-powershell.exe	schtasks.exe
PID 2776 wrote to memory of 2616	2776	$sxr-powershell.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Uni.exe
"C:\Users\Admin\AppData\Local\Temp\Uni.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "$sxr-powershell" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Uni.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2672
- C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe
  "C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "$sxr-powershell" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2616
- C:\Windows\SysWOW64\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "$77Uni.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Uni.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe

Filesize
409KB

MD5
7417c8c73e614f293152575f46134216

SHA1
cc68f7f5e7c769efb5b3e06bfb3a2f9329f37805

SHA256
00c7cb06bebe0da961155dc00f7ea7f96a3b04c89ae82408e7ece6968c91c3c3

SHA512
897a859e609028157f2721d76b97497d4b9f821d2b8be3359d1192ddc3a83d4b7449db25c63c3c260067b796c122194c48747dc611c98dc1e33aab82a20b98b0

Download Submit
memory/2776-10-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/2776-11-0x0000000000DD0000-0x0000000000E3C000-memory.dmp

Filesize
432KB

Download
memory/2776-12-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/2776-15-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/2776-16-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/2916-0-0x00000000740FE000-0x00000000740FF000-memory.dmp

Filesize
4KB

Download
memory/2916-1-0x0000000000BA0000-0x0000000000C0C000-memory.dmp

Filesize
432KB

Download
memory/2916-2-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/2916-13-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads