quasar | 7869d203ee2ffc4d75d4d542cc2e3a970ca249d675e8bc7bd4f9cc85c80cab69

General

Target

client.exe
Size

3.1MB
MD5

4dfff8420e0d2f3a0e30a3ae8e005830
SHA1

379546834fa347bdcf6a4aa1a9d956b540d33b55
SHA256

7869d203ee2ffc4d75d4d542cc2e3a970ca249d675e8bc7bd4f9cc85c80cab69
SHA512

6f4de859019a9ed236f6ddcbb03737c9e643368ae74fea3b36f7254a1b691448fb5f5befe4997554ed96f099309908f6b0a42d46161d3727d07620b1ecca94cb
SSDEEP

49152:2vBt62XlaSFNWPjljiFa2RoUYIlQcMbKLoGdFewTHHB72eh2NT:2vr62XlaSFNWPjljiFXRoUYIlQcM2

Score

10^/10

quasar watchdog spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

watchdog

C2

142.115.43.39:8080

Mutex

1c1f3ace-a14c-4361-99eb-65aedb6d50fd

Attributes

encryption_key
3FAEE4D5FC9BC245D4CA5F4165EAFD34E8D5FE16
install_name
watchdog.exe
log_directory
logs
reconnect_delay
3000
startup_key
watchdog
subdirectory
drivers

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2864-1-0x0000000000750000-0x0000000000A74000-memory.dmp	family_quasar
C:\Windows\System32\drivers\watchdog.exe	family_quasar

Drops file in Drivers directory 3 IoCs

Processes:

watchdog.execlient.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\watchdog.exe	watchdog.exe
File created	C:\Windows\system32\drivers\watchdog.exe	client.exe
File opened for modification	C:\Windows\system32\drivers\watchdog.exe	client.exe

Executes dropped EXE 1 IoCs

Processes:

watchdog.exe

pid process

2000 watchdog.exe

pid	process
2000	watchdog.exe

Drops file in System32 directory 2 IoCs

Processes:

client.exewatchdog.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers	client.exe
File opened for modification	C:\Windows\system32\drivers	watchdog.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4684 schtasks.exe
776 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

client.exewatchdog.exe

description pid process

Token: SeDebugPrivilege 2864 client.exe
Token: SeDebugPrivilege 2000 watchdog.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

watchdog.exe

pid process

2000 watchdog.exe

pid	process
4684	schtasks.exe
776	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2864	client.exe
Token: SeDebugPrivilege	2000	watchdog.exe

pid	process
2000	watchdog.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

client.exewatchdog.exe

description	pid	process	target process
PID 2864 wrote to memory of 776	2864	client.exe	schtasks.exe
PID 2864 wrote to memory of 776	2864	client.exe	schtasks.exe
PID 2864 wrote to memory of 2000	2864	client.exe	watchdog.exe
PID 2864 wrote to memory of 2000	2864	client.exe	watchdog.exe
PID 2000 wrote to memory of 4684	2000	watchdog.exe	schtasks.exe
PID 2000 wrote to memory of 4684	2000	watchdog.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\client.exe
"C:\Users\Admin\AppData\Local\Temp\client.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "watchdog" /sc ONLOGON /tr "C:\Windows\system32\drivers\watchdog.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:776

C:\Windows\system32\drivers\watchdog.exe
"C:\Windows\system32\drivers\watchdog.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "watchdog" /sc ONLOGON /tr "C:\Windows\system32\drivers\watchdog.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:4684

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\drivers\watchdog.exe
Filesize
3.1MB

MD5
4dfff8420e0d2f3a0e30a3ae8e005830

SHA1
379546834fa347bdcf6a4aa1a9d956b540d33b55

SHA256
7869d203ee2ffc4d75d4d542cc2e3a970ca249d675e8bc7bd4f9cc85c80cab69

SHA512
6f4de859019a9ed236f6ddcbb03737c9e643368ae74fea3b36f7254a1b691448fb5f5befe4997554ed96f099309908f6b0a42d46161d3727d07620b1ecca94cb

Download Submit
memory/2000-10-0x00007FF8C0680000-0x00007FF8C1141000-memory.dmp

Filesize
10.8MB

Download
memory/2000-11-0x00007FF8C0680000-0x00007FF8C1141000-memory.dmp

Filesize
10.8MB

Download
memory/2000-12-0x0000000001AC0000-0x0000000001B10000-memory.dmp

Filesize
320KB

Download
memory/2000-13-0x000000001C5A0000-0x000000001C652000-memory.dmp

Filesize
712KB

Download
memory/2000-16-0x0000000003350000-0x0000000003362000-memory.dmp

Filesize
72KB

Download
memory/2000-17-0x000000001BDA0000-0x000000001BDDC000-memory.dmp

Filesize
240KB

Download
memory/2000-18-0x00007FF8C0680000-0x00007FF8C1141000-memory.dmp

Filesize
10.8MB

Download
memory/2864-0-0x00007FF8C0683000-0x00007FF8C0685000-memory.dmp

Filesize
8KB

Download
memory/2864-1-0x0000000000750000-0x0000000000A74000-memory.dmp

Filesize
3.1MB

Download
memory/2864-2-0x00007FF8C0680000-0x00007FF8C1141000-memory.dmp

Filesize
10.8MB

Download
memory/2864-9-0x00007FF8C0680000-0x00007FF8C1141000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads