quasar | 00c7cb06bebe0da961155dc00f7ea7f96a3b04c89ae82408e7ece6968c91c3c3 | Triage

Analysis

max time kernel
1780s
max time network
1790s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 17:28

Sharing

Report Analysis Logs

General

Target

Uni.exe
Size

409KB
MD5

7417c8c73e614f293152575f46134216
SHA1

cc68f7f5e7c769efb5b3e06bfb3a2f9329f37805
SHA256

00c7cb06bebe0da961155dc00f7ea7f96a3b04c89ae82408e7ece6968c91c3c3
SHA512

897a859e609028157f2721d76b97497d4b9f821d2b8be3359d1192ddc3a83d4b7449db25c63c3c260067b796c122194c48747dc611c98dc1e33aab82a20b98b0
SSDEEP

6144:nMr2pJAJcC0B632U3GRbMfgvKFFhTEDPX1NbKoEn5MSU+h2f8/14m:LpyJcC+82U3GRGGp1M5Ys2f8/6m

Score

10^/10

quasar slave spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SLAVE

C2

even-lemon.gl.at.ply.gg:33587

Mutex

$Sxr-dOMA5C0pQTTpKjVsCp

Attributes

encryption_key
UBXs44u6E81wxBGZxQHk
install_name
$sxr-powershell.exe
log_directory
$SXR-KEYLOGS
reconnect_delay
3000
startup_key
$sxr-powershell
subdirectory
$sxr-seroxen2

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral2/memory/840-1-0x0000000000CA0000-0x0000000000D0C000-memory.dmp	family_quasar
behavioral2/files/0x0039000000013362-5.dat	family_quasar
behavioral2/memory/2880-10-0x00000000010B0000-0x000000000111C000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2880	$sxr-powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
840	Uni.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
2688	schtasks.exe
2840	SCHTASKS.exe
2520	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	Uni.exe
Token: SeDebugPrivilege	2880	$sxr-powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2880	$sxr-powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2688	840	Uni.exe	29
PID 840 wrote to memory of 2688	840	Uni.exe	29
PID 840 wrote to memory of 2688	840	Uni.exe	29
PID 840 wrote to memory of 2688	840	Uni.exe	29
PID 840 wrote to memory of 2880	840	Uni.exe	31
PID 840 wrote to memory of 2880	840	Uni.exe	31
PID 840 wrote to memory of 2880	840	Uni.exe	31
PID 840 wrote to memory of 2880	840	Uni.exe	31
PID 840 wrote to memory of 2840	840	Uni.exe	32
PID 840 wrote to memory of 2840	840	Uni.exe	32
PID 840 wrote to memory of 2840	840	Uni.exe	32
PID 840 wrote to memory of 2840	840	Uni.exe	32
PID 2880 wrote to memory of 2520	2880	$sxr-powershell.exe	34
PID 2880 wrote to memory of 2520	2880	$sxr-powershell.exe	34
PID 2880 wrote to memory of 2520	2880	$sxr-powershell.exe	34
PID 2880 wrote to memory of 2520	2880	$sxr-powershell.exe	34

C:\Users\Admin\AppData\Local\Temp\Uni.exe
"C:\Users\Admin\AppData\Local\Temp\Uni.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "$sxr-powershell" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Uni.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2688
- C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe
  "C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "$sxr-powershell" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2520
- C:\Windows\SysWOW64\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "$77Uni.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Uni.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe

Filesize
409KB

MD5
7417c8c73e614f293152575f46134216

SHA1
cc68f7f5e7c769efb5b3e06bfb3a2f9329f37805

SHA256
00c7cb06bebe0da961155dc00f7ea7f96a3b04c89ae82408e7ece6968c91c3c3

SHA512
897a859e609028157f2721d76b97497d4b9f821d2b8be3359d1192ddc3a83d4b7449db25c63c3c260067b796c122194c48747dc611c98dc1e33aab82a20b98b0

Download Submit
memory/840-0-0x0000000073F8E000-0x0000000073F8F000-memory.dmp

Filesize
4KB

Download
memory/840-1-0x0000000000CA0000-0x0000000000D0C000-memory.dmp

Filesize
432KB

Download
memory/840-2-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/840-13-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-11-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-10-0x00000000010B0000-0x000000000111C000-memory.dmp

Filesize
432KB

Download
memory/2880-12-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-15-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-16-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download