quasar | 00c7cb06bebe0da961155dc00f7ea7f96a3b04c89ae82408e7ece6968c91c3c3

General

Target

Uni.exe
Size

409KB
MD5

7417c8c73e614f293152575f46134216
SHA1

cc68f7f5e7c769efb5b3e06bfb3a2f9329f37805
SHA256

00c7cb06bebe0da961155dc00f7ea7f96a3b04c89ae82408e7ece6968c91c3c3
SHA512

897a859e609028157f2721d76b97497d4b9f821d2b8be3359d1192ddc3a83d4b7449db25c63c3c260067b796c122194c48747dc611c98dc1e33aab82a20b98b0
SSDEEP

6144:nMr2pJAJcC0B632U3GRbMfgvKFFhTEDPX1NbKoEn5MSU+h2f8/14m:LpyJcC+82U3GRGGp1M5Ys2f8/6m

Score

10^/10

quasar slave spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SLAVE

C2

even-lemon.gl.at.ply.gg:33587

Mutex

$Sxr-dOMA5C0pQTTpKjVsCp

Attributes

encryption_key
UBXs44u6E81wxBGZxQHk
install_name
$sxr-powershell.exe
log_directory
$SXR-KEYLOGS
reconnect_delay
3000
startup_key
$sxr-powershell
subdirectory
$sxr-seroxen2

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/840-1-0x0000000000CA0000-0x0000000000D0C000-memory.dmp	family_quasar
\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe	family_quasar
behavioral2/memory/2880-10-0x00000000010B0000-0x000000000111C000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

$sxr-powershell.exe

pid process

2880 $sxr-powershell.exe
Loads dropped DLL 1 IoCs

Processes:

Uni.exe

pid process

840 Uni.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeSCHTASKS.exeschtasks.exe

pid process

2688 schtasks.exe
2840 SCHTASKS.exe
2520 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Uni.exe$sxr-powershell.exe

description pid process

Token: SeDebugPrivilege 840 Uni.exe
Token: SeDebugPrivilege 2880 $sxr-powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

$sxr-powershell.exe

pid process

2880 $sxr-powershell.exe

pid	process
2880	$sxr-powershell.exe

pid	process
840	Uni.exe

flow	ioc
2	ip-api.com

pid	process
2688	schtasks.exe
2840	SCHTASKS.exe
2520	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	840	Uni.exe
Token: SeDebugPrivilege	2880	$sxr-powershell.exe

pid	process
2880	$sxr-powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

Uni.exe$sxr-powershell.exe

description	pid	process	target process
PID 840 wrote to memory of 2688	840	Uni.exe	schtasks.exe
PID 840 wrote to memory of 2688	840	Uni.exe	schtasks.exe
PID 840 wrote to memory of 2688	840	Uni.exe	schtasks.exe
PID 840 wrote to memory of 2688	840	Uni.exe	schtasks.exe
PID 840 wrote to memory of 2880	840	Uni.exe	$sxr-powershell.exe
PID 840 wrote to memory of 2880	840	Uni.exe	$sxr-powershell.exe
PID 840 wrote to memory of 2880	840	Uni.exe	$sxr-powershell.exe
PID 840 wrote to memory of 2880	840	Uni.exe	$sxr-powershell.exe
PID 840 wrote to memory of 2840	840	Uni.exe	SCHTASKS.exe
PID 840 wrote to memory of 2840	840	Uni.exe	SCHTASKS.exe
PID 840 wrote to memory of 2840	840	Uni.exe	SCHTASKS.exe
PID 840 wrote to memory of 2840	840	Uni.exe	SCHTASKS.exe
PID 2880 wrote to memory of 2520	2880	$sxr-powershell.exe	schtasks.exe
PID 2880 wrote to memory of 2520	2880	$sxr-powershell.exe	schtasks.exe
PID 2880 wrote to memory of 2520	2880	$sxr-powershell.exe	schtasks.exe
PID 2880 wrote to memory of 2520	2880	$sxr-powershell.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Uni.exe
"C:\Users\Admin\AppData\Local\Temp\Uni.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "$sxr-powershell" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Uni.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2688

C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe
"C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "$sxr-powershell" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2520

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Uni.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Uni.exe'" /sc onlogon /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:2840

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe
Filesize
409KB

MD5
7417c8c73e614f293152575f46134216

SHA1
cc68f7f5e7c769efb5b3e06bfb3a2f9329f37805

SHA256
00c7cb06bebe0da961155dc00f7ea7f96a3b04c89ae82408e7ece6968c91c3c3

SHA512
897a859e609028157f2721d76b97497d4b9f821d2b8be3359d1192ddc3a83d4b7449db25c63c3c260067b796c122194c48747dc611c98dc1e33aab82a20b98b0

Download Submit
memory/840-0-0x0000000073F8E000-0x0000000073F8F000-memory.dmp

Filesize
4KB

Download
memory/840-1-0x0000000000CA0000-0x0000000000D0C000-memory.dmp

Filesize
432KB

Download
memory/840-2-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/840-13-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-11-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-10-0x00000000010B0000-0x000000000111C000-memory.dmp

Filesize
432KB

Download
memory/2880-12-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-15-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-16-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads