quasar | 7869d203ee2ffc4d75d4d542cc2e3a970ca249d675e8bc7bd4f9cc85c80cab69

General

Target

client.exe
Size

3.1MB
MD5

4dfff8420e0d2f3a0e30a3ae8e005830
SHA1

379546834fa347bdcf6a4aa1a9d956b540d33b55
SHA256

7869d203ee2ffc4d75d4d542cc2e3a970ca249d675e8bc7bd4f9cc85c80cab69
SHA512

6f4de859019a9ed236f6ddcbb03737c9e643368ae74fea3b36f7254a1b691448fb5f5befe4997554ed96f099309908f6b0a42d46161d3727d07620b1ecca94cb
SSDEEP

49152:2vBt62XlaSFNWPjljiFa2RoUYIlQcMbKLoGdFewTHHB72eh2NT:2vr62XlaSFNWPjljiFXRoUYIlQcM2

Score

10^/10

quasar watchdog spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

watchdog

C2

142.115.43.39:8080

Mutex

1c1f3ace-a14c-4361-99eb-65aedb6d50fd

Attributes

encryption_key
3FAEE4D5FC9BC245D4CA5F4165EAFD34E8D5FE16
install_name
watchdog.exe
log_directory
logs
reconnect_delay
3000
startup_key
watchdog
subdirectory
drivers

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4700-1-0x0000000000290000-0x00000000005B4000-memory.dmp	family_quasar
C:\Windows\System32\drivers\watchdog.exe	family_quasar

Drops file in Drivers directory 3 IoCs

Processes:

client.exewatchdog.exe

description	ioc	process
File created	C:\Windows\system32\drivers\watchdog.exe	client.exe
File opened for modification	C:\Windows\system32\drivers\watchdog.exe	client.exe
File opened for modification	C:\Windows\system32\drivers\watchdog.exe	watchdog.exe

Executes dropped EXE 1 IoCs

Processes:

watchdog.exe

pid process

1084 watchdog.exe

pid	process
1084	watchdog.exe

Drops file in System32 directory 2 IoCs

Processes:

client.exewatchdog.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers	client.exe
File opened for modification	C:\Windows\system32\drivers	watchdog.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4260 schtasks.exe
592 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4480 PING.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

client.exewatchdog.exe

description pid process

Token: SeDebugPrivilege 4700 client.exe
Token: SeDebugPrivilege 1084 watchdog.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

watchdog.exe

pid process

1084 watchdog.exe

pid	process
4260	schtasks.exe
592	schtasks.exe

pid	process
4480	PING.EXE

description	pid	process
Token: SeDebugPrivilege	4700	client.exe
Token: SeDebugPrivilege	1084	watchdog.exe

pid	process
1084	watchdog.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

client.exewatchdog.execmd.exe

description	pid	process	target process
PID 4700 wrote to memory of 592	4700	client.exe	schtasks.exe
PID 4700 wrote to memory of 592	4700	client.exe	schtasks.exe
PID 4700 wrote to memory of 1084	4700	client.exe	watchdog.exe
PID 4700 wrote to memory of 1084	4700	client.exe	watchdog.exe
PID 1084 wrote to memory of 4260	1084	watchdog.exe	schtasks.exe
PID 1084 wrote to memory of 4260	1084	watchdog.exe	schtasks.exe
PID 1084 wrote to memory of 4156	1084	watchdog.exe	schtasks.exe
PID 1084 wrote to memory of 4156	1084	watchdog.exe	schtasks.exe
PID 1084 wrote to memory of 1896	1084	watchdog.exe	cmd.exe
PID 1084 wrote to memory of 1896	1084	watchdog.exe	cmd.exe
PID 1896 wrote to memory of 4420	1896	cmd.exe	chcp.com
PID 1896 wrote to memory of 4420	1896	cmd.exe	chcp.com
PID 1896 wrote to memory of 4480	1896	cmd.exe	PING.EXE
PID 1896 wrote to memory of 4480	1896	cmd.exe	PING.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\client.exe
"C:\Users\Admin\AppData\Local\Temp\client.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "watchdog" /sc ONLOGON /tr "C:\Windows\system32\drivers\watchdog.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:592

C:\Windows\system32\drivers\watchdog.exe
"C:\Windows\system32\drivers\watchdog.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "watchdog" /sc ONLOGON /tr "C:\Windows\system32\drivers\watchdog.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:4260

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /delete /tn "watchdog" /f
3⤵
PID:4156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DgaxBjQgXIR0.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:4420

C:\Windows\system32\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:4480

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DgaxBjQgXIR0.bat
Filesize
203B

MD5
f4e2e62945b1d8cd38c15e9ddca594a4

SHA1
48ea069f686c869bb1ea53ba8bfd6eb344d183b1

SHA256
bc4932e210ebd8a2f3745339933ac68330ccdc2eeb24ad2dba37aadf7da9afae

SHA512
f163ba72e6c6fa461ef0f4e77324aa5f876967ec05e41bebd18704defaeeb2043c844a64006840f47b4626eefca926be27f2b38757656bb066afdc5aa914fbdf

Download Submit
C:\Windows\System32\drivers\watchdog.exe
Filesize
3.1MB

MD5
4dfff8420e0d2f3a0e30a3ae8e005830

SHA1
379546834fa347bdcf6a4aa1a9d956b540d33b55

SHA256
7869d203ee2ffc4d75d4d542cc2e3a970ca249d675e8bc7bd4f9cc85c80cab69

SHA512
6f4de859019a9ed236f6ddcbb03737c9e643368ae74fea3b36f7254a1b691448fb5f5befe4997554ed96f099309908f6b0a42d46161d3727d07620b1ecca94cb

Download Submit
memory/1084-11-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Filesize
9.9MB

Download
memory/1084-10-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Filesize
9.9MB

Download
memory/1084-12-0x000000001B760000-0x000000001B7B0000-memory.dmp

Filesize
320KB

Download
memory/1084-13-0x000000001B870000-0x000000001B922000-memory.dmp

Filesize
712KB

Download
memory/1084-16-0x000000001B810000-0x000000001B822000-memory.dmp

Filesize
72KB

Download
memory/1084-17-0x000000001BF60000-0x000000001BF9E000-memory.dmp

Filesize
248KB

Download
memory/1084-18-0x000000001C7D0000-0x000000001CCF6000-memory.dmp

Filesize
5.1MB

Download
memory/1084-20-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Filesize
9.9MB

Download
memory/1084-29-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Filesize
9.9MB

Download
memory/4700-2-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Filesize
9.9MB

Download
memory/4700-9-0x00007FFDC0CF0000-0x00007FFDC16DC000-memory.dmp

Filesize
9.9MB

Download
memory/4700-0-0x00007FFDC0CF3000-0x00007FFDC0CF4000-memory.dmp

Filesize
4KB

Download
memory/4700-1-0x0000000000290000-0x00000000005B4000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads