Overview

overview

10

Static

static

10

solar.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 11:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    solar.exe

  • Size

    3.1MB

  • MD5

    ca558fea52e3ca7a1b61e0f69ac268b2

  • SHA1

    2445d78506e19c17c99eca0744719c409c1e2c04

  • SHA256

    a3773025a4ff7ba7e2ea475c8e5b2c74bd60f963ad9e27ae7ca0123fbb235976

  • SHA512

    7d3e5cab72a6e7da4d2cc7fca940d58d0c0c82e1a3ee5dfce38317eb6eb6446bac82ed66bfc96c84e1c7917f1a00c1635640daa42ce09fa3ab27c5f213d73396

  • SSDEEP

    49152:DvrI22SsaNYfdPBldt698dBcjHDsqxbR4LoGdYWTHHB72eh2NT:DvU22SsaNYfdPBldt6+dBcjHDsqe

Score
10/10
quasarquasarspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

quasar

C2

cr7stakewin-27924.portmap.host:27924

Mutex

b16a5a4a-0575-4e0e-8ddd-77ced9920af6

Attributes
  • encryption_key

    72EAB2364235F953EB6EBC4967F5FAA96FD1EEE1

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\solar.exe
    "C:\Users\Admin\AppData\Local\Temp\solar.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4040
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:1528
    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3340
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Quasar" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:3252
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /7
    1⤵
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3456
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:848

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Scheduled Task/Job

    1
    T1053

    Persistence

    Scheduled Task/Job

    1
    T1053

    Privilege Escalation

    Scheduled Task/Job

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      Filesize

      3.1MB

      MD5

      ca558fea52e3ca7a1b61e0f69ac268b2

      SHA1

      2445d78506e19c17c99eca0744719c409c1e2c04

      SHA256

      a3773025a4ff7ba7e2ea475c8e5b2c74bd60f963ad9e27ae7ca0123fbb235976

      SHA512

      7d3e5cab72a6e7da4d2cc7fca940d58d0c0c82e1a3ee5dfce38317eb6eb6446bac82ed66bfc96c84e1c7917f1a00c1635640daa42ce09fa3ab27c5f213d73396

      Download Submit
    • memory/3340-17-0x000000001C8C0000-0x000000001C8FC000-memory.dmp
      Filesize

      240KB

      Download
    • memory/3340-33-0x00007FFB06F80000-0x00007FFB07A41000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/3340-18-0x000000001D130000-0x000000001D658000-memory.dmp
      Filesize

      5.2MB

      Download
    • memory/3340-16-0x000000001C150000-0x000000001C162000-memory.dmp
      Filesize

      72KB

      Download
    • memory/3340-10-0x00007FFB06F80000-0x00007FFB07A41000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/3340-11-0x00007FFB06F80000-0x00007FFB07A41000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/3340-12-0x000000001C0B0000-0x000000001C100000-memory.dmp
      Filesize

      320KB

      Download
    • memory/3340-13-0x000000001C1C0000-0x000000001C272000-memory.dmp
      Filesize

      712KB

      Download
    • memory/3456-29-0x000001F80F740000-0x000001F80F741000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3456-27-0x000001F80F740000-0x000001F80F741000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3456-20-0x000001F80F740000-0x000001F80F741000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3456-19-0x000001F80F740000-0x000001F80F741000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3456-25-0x000001F80F740000-0x000001F80F741000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3456-21-0x000001F80F740000-0x000001F80F741000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3456-31-0x000001F80F740000-0x000001F80F741000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3456-30-0x000001F80F740000-0x000001F80F741000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3456-26-0x000001F80F740000-0x000001F80F741000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3456-28-0x000001F80F740000-0x000001F80F741000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4040-0-0x00007FFB06F83000-0x00007FFB06F85000-memory.dmp
      Filesize

      8KB

      Download
    • memory/4040-2-0x00007FFB06F80000-0x00007FFB07A41000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/4040-9-0x00007FFB06F80000-0x00007FFB07A41000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/4040-1-0x0000000000F10000-0x0000000001234000-memory.dmp
      Filesize

      3.1MB

      Download