quasar | 5304204c73f6a5ff58c1a9e784139111a477b274b29f93666ba9e0d5fd4f36f5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70d30b23348309c31e6428730d77012f_JaffaCakes118.exe
Size 349KB
Sample240525-es3rrsec53
SHA256 5304204c73f6a5ff58c1a9e784139111a477b274b29f93666ba9e0d5fd4f36f5
MD5 70d30b23348309c31e6428730d77012f
SHA1 2d3e3669099989d1bcbbf59170eaf0e66d82aef7
SHA512 9cff8845e74094fa2daf19666b6817de04d9b96ae85b5a35f2313a4cc520b87f7fb30d88801d3a740877a89a46de4542ad124779148b5ef6ba9917a261effaa1
SSDEEP 6144:yKMJx4pweP7kJS3i37EOv2l3e6NfAwfBMyb0ezPcLf/9t:yKoS8wOvEe6lzfBEmQ9t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar rat2020 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

rat2020

rat25565.ddns.net:25565

Mutex

QSR_MUTEX_N4xtXyWxcnI1berfYb

Attributes

encryption_key
OtebFaj10j3Qk2642HWk
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
EpicGames Client
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/1860-1-0x0000000001300000-0x000000000135E000-memory.dmp	family_quasar
behavioral1/files/0x003100000001313a-4.dat	family_quasar
behavioral1/memory/2652-10-0x0000000000C70000-0x0000000000CCE000-memory.dmp	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
2652	Client.exe
2772	Client.exe

Loads dropped DLL 7 IoCs

pid	Process
1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2484	cmd.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2132	2652	WerFault.exe	31

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2492	schtasks.exe
2720	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2972	PING.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe
Token: SeDebugPrivilege	2652	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2652	Client.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2720	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	29
PID 1860 wrote to memory of 2720	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	29
PID 1860 wrote to memory of 2720	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	29
PID 1860 wrote to memory of 2720	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	29
PID 1860 wrote to memory of 2652	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	31
PID 1860 wrote to memory of 2652	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	31
PID 1860 wrote to memory of 2652	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	31
PID 1860 wrote to memory of 2652	1860	70d30b23348309c31e6428730d77012f_JaffaCakes118.exe	31
PID 2652 wrote to memory of 2492	2652	Client.exe	32
PID 2652 wrote to memory of 2492	2652	Client.exe	32
PID 2652 wrote to memory of 2492	2652	Client.exe	32
PID 2652 wrote to memory of 2492	2652	Client.exe	32
PID 2652 wrote to memory of 2484	2652	Client.exe	34
PID 2652 wrote to memory of 2484	2652	Client.exe	34
PID 2652 wrote to memory of 2484	2652	Client.exe	34
PID 2652 wrote to memory of 2484	2652	Client.exe	34
PID 2652 wrote to memory of 2132	2652	Client.exe	36
PID 2652 wrote to memory of 2132	2652	Client.exe	36
PID 2652 wrote to memory of 2132	2652	Client.exe	36
PID 2652 wrote to memory of 2132	2652	Client.exe	36
PID 2484 wrote to memory of 3000	2484	cmd.exe	37
PID 2484 wrote to memory of 3000	2484	cmd.exe	37
PID 2484 wrote to memory of 3000	2484	cmd.exe	37
PID 2484 wrote to memory of 3000	2484	cmd.exe	37
PID 2484 wrote to memory of 2972	2484	cmd.exe	38
PID 2484 wrote to memory of 2972	2484	cmd.exe	38
PID 2484 wrote to memory of 2972	2484	cmd.exe	38
PID 2484 wrote to memory of 2972	2484	cmd.exe	38
PID 2484 wrote to memory of 2772	2484	cmd.exe	39
PID 2484 wrote to memory of 2772	2484	cmd.exe	39
PID 2484 wrote to memory of 2772	2484	cmd.exe	39
PID 2484 wrote to memory of 2772	2484	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\70d30b23348309c31e6428730d77012f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\70d30b23348309c31e6428730d77012f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "EpicGames Client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\70d30b23348309c31e6428730d77012f_JaffaCakes118.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2720
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "EpicGames Client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2492
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\7HWu6u3vO0Pv.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:3000
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:2972
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      PID:2772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 1444
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7HWu6u3vO0Pv.bat

Path C:\Users\Admin\AppData\Local\Temp\7HWu6u3vO0Pv.bat
Size 207B
SHA256 27a64579bb2c01df2a77d2fc6edb5f5f3eeee9e95034db65c39760175b230d93
MD5 36bee66c6c9652c4d4418a73181fdddd
SHA1 8dbecc4fe48cdf0902e26e844c7b78961a3ceac5
SHA512 f412910125d37b87247234fd051be9a12e8f7992e91922f15d9712f1cbb930002a6185d836a1d1dcf4072152950229710cb98ff07d1318d0a86fe2ef5bdaf2ef
MD5 SHA1 SHA512

Submit Download

Client.exe

Path \Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 349KB
SHA256 5304204c73f6a5ff58c1a9e784139111a477b274b29f93666ba9e0d5fd4f36f5
MD5 70d30b23348309c31e6428730d77012f
SHA1 2d3e3669099989d1bcbbf59170eaf0e66d82aef7
SHA512 9cff8845e74094fa2daf19666b6817de04d9b96ae85b5a35f2313a4cc520b87f7fb30d88801d3a740877a89a46de4542ad124779148b5ef6ba9917a261effaa1
SSDEEP 6144:yKMJx4pweP7kJS3i37EOv2l3e6NfAwfBMyb0ezPcLf/9t:yKoS8wOvEe6lzfBEmQ9t
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1860-0-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

Download

memory/1860-1-0x0000000001300000-0x000000000135E000-memory.dmp

Download

memory/1860-2-0x0000000074B80000-0x000000007526E000-memory.dmp

Download

memory/1860-11-0x0000000074B80000-0x000000007526E000-memory.dmp

Download

memory/2652-10-0x0000000000C70000-0x0000000000CCE000-memory.dmp

Download

memory/2652-12-0x0000000074B80000-0x000000007526E000-memory.dmp

Download

memory/2652-9-0x0000000074B80000-0x000000007526E000-memory.dmp

Download

memory/2652-30-0x0000000074B80000-0x000000007526E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads