quasar | 5304204c73f6a5ff58c1a9e784139111a477b274b29f93666ba9e0d5fd4f36f5

General

Target

70d30b23348309c31e6428730d77012f_JaffaCakes118.exe
Size

349KB
MD5

70d30b23348309c31e6428730d77012f
SHA1

2d3e3669099989d1bcbbf59170eaf0e66d82aef7
SHA256

5304204c73f6a5ff58c1a9e784139111a477b274b29f93666ba9e0d5fd4f36f5
SHA512

9cff8845e74094fa2daf19666b6817de04d9b96ae85b5a35f2313a4cc520b87f7fb30d88801d3a740877a89a46de4542ad124779148b5ef6ba9917a261effaa1
SSDEEP

6144:yKMJx4pweP7kJS3i37EOv2l3e6NfAwfBMyb0ezPcLf/9t:yKoS8wOvEe6lzfBEmQ9t

Score

10^/10

quasar rat2020 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

rat2020

C2

rat25565.ddns.net:25565

Mutex

QSR_MUTEX_N4xtXyWxcnI1berfYb

Attributes

encryption_key
OtebFaj10j3Qk2642HWk
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
EpicGames Client
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1860-1-0x0000000001300000-0x000000000135E000-memory.dmp	family_quasar
\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
behavioral1/memory/2652-10-0x0000000000C70000-0x0000000000CCE000-memory.dmp	family_quasar

Executes dropped EXE 2 IoCs

Processes:

Client.exeClient.exe

pid process

2652 Client.exe
2772 Client.exe

pid	process
2652	Client.exe
2772	Client.exe

Loads dropped DLL 7 IoCs

Processes:

70d30b23348309c31e6428730d77012f_JaffaCakes118.exeWerFault.execmd.exe

pid	process
1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2484	cmd.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2132 2652 WerFault.exe Client.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2492 schtasks.exe
2720 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2972 PING.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

70d30b23348309c31e6428730d77012f_JaffaCakes118.exeClient.exe

description pid process

Token: SeDebugPrivilege 1860 70d30b23348309c31e6428730d77012f_JaffaCakes118.exe
Token: SeDebugPrivilege 2652 Client.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

2652 Client.exe

flow	ioc
2	ip-api.com

pid	pid_target	process	target process
2132	2652	WerFault.exe	Client.exe

pid	process
2492	schtasks.exe
2720	schtasks.exe

pid	process
2972	PING.EXE

description	pid	process
Token: SeDebugPrivilege	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe
Token: SeDebugPrivilege	2652	Client.exe

pid	process
2652	Client.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

70d30b23348309c31e6428730d77012f_JaffaCakes118.exeClient.execmd.exe

description	pid	process	target process
PID 1860 wrote to memory of 2720	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	schtasks.exe
PID 1860 wrote to memory of 2720	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	schtasks.exe
PID 1860 wrote to memory of 2720	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	schtasks.exe
PID 1860 wrote to memory of 2720	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	schtasks.exe
PID 1860 wrote to memory of 2652	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	Client.exe
PID 1860 wrote to memory of 2652	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	Client.exe
PID 1860 wrote to memory of 2652	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	Client.exe
PID 1860 wrote to memory of 2652	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	Client.exe
PID 2652 wrote to memory of 2492	2652	Client.exe	schtasks.exe
PID 2652 wrote to memory of 2492	2652	Client.exe	schtasks.exe
PID 2652 wrote to memory of 2492	2652	Client.exe	schtasks.exe
PID 2652 wrote to memory of 2492	2652	Client.exe	schtasks.exe
PID 2652 wrote to memory of 2484	2652	Client.exe	cmd.exe
PID 2652 wrote to memory of 2484	2652	Client.exe	cmd.exe
PID 2652 wrote to memory of 2484	2652	Client.exe	cmd.exe
PID 2652 wrote to memory of 2484	2652	Client.exe	cmd.exe
PID 2652 wrote to memory of 2132	2652	Client.exe	WerFault.exe
PID 2652 wrote to memory of 2132	2652	Client.exe	WerFault.exe
PID 2652 wrote to memory of 2132	2652	Client.exe	WerFault.exe
PID 2652 wrote to memory of 2132	2652	Client.exe	WerFault.exe
PID 2484 wrote to memory of 3000	2484	cmd.exe	chcp.com
PID 2484 wrote to memory of 3000	2484	cmd.exe	chcp.com
PID 2484 wrote to memory of 3000	2484	cmd.exe	chcp.com
PID 2484 wrote to memory of 3000	2484	cmd.exe	chcp.com
PID 2484 wrote to memory of 2972	2484	cmd.exe	PING.EXE
PID 2484 wrote to memory of 2972	2484	cmd.exe	PING.EXE
PID 2484 wrote to memory of 2972	2484	cmd.exe	PING.EXE
PID 2484 wrote to memory of 2972	2484	cmd.exe	PING.EXE
PID 2484 wrote to memory of 2772	2484	cmd.exe	Client.exe
PID 2484 wrote to memory of 2772	2484	cmd.exe	Client.exe
PID 2484 wrote to memory of 2772	2484	cmd.exe	Client.exe
PID 2484 wrote to memory of 2772	2484	cmd.exe	Client.exe

C:\Users\Admin\AppData\Local\Temp\70d30b23348309c31e6428730d77012f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\70d30b23348309c31e6428730d77012f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "EpicGames Client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\70d30b23348309c31e6428730d77012f_JaffaCakes118.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2720

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "EpicGames Client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2492

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\7HWu6u3vO0Pv.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:3000

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:2972

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
4⤵
- Executes dropped EXE
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 1444
3⤵
- Loads dropped DLL
- Program crash
PID:2132

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7HWu6u3vO0Pv.bat
Filesize
207B

MD5
36bee66c6c9652c4d4418a73181fdddd

SHA1
8dbecc4fe48cdf0902e26e844c7b78961a3ceac5

SHA256
27a64579bb2c01df2a77d2fc6edb5f5f3eeee9e95034db65c39760175b230d93

SHA512
f412910125d37b87247234fd051be9a12e8f7992e91922f15d9712f1cbb930002a6185d836a1d1dcf4072152950229710cb98ff07d1318d0a86fe2ef5bdaf2ef

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
349KB

MD5
70d30b23348309c31e6428730d77012f

SHA1
2d3e3669099989d1bcbbf59170eaf0e66d82aef7

SHA256
5304204c73f6a5ff58c1a9e784139111a477b274b29f93666ba9e0d5fd4f36f5

SHA512
9cff8845e74094fa2daf19666b6817de04d9b96ae85b5a35f2313a4cc520b87f7fb30d88801d3a740877a89a46de4542ad124779148b5ef6ba9917a261effaa1

Download Submit
memory/1860-0-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

Filesize
4KB

Download
memory/1860-1-0x0000000001300000-0x000000000135E000-memory.dmp

Filesize
376KB

Download
memory/1860-2-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/1860-11-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/2652-10-0x0000000000C70000-0x0000000000CCE000-memory.dmp

Filesize
376KB

Download
memory/2652-12-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/2652-9-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/2652-30-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads