quasar | b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd

General

Target

b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
Size

539KB
MD5

c05d4bfb1c0e89db58fa981980938b76
SHA1

12801b26c7b68224c8540ad08ad9387110d0fd46
SHA256

b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd
SHA512

926f6d48a44b7b56667e5b74dc3f7cff513f6ae02edd07df0ca2e5bc21690e5cdef77213307d8595a9a4127b582f5fc50aab0b97350e08b7486c33e4ada651c5
SSDEEP

12288:unm5pMGjw5LSk0zWbzGsoYFAY7NvlDmmM:um5GGjw5LSk0zWbzRoYbvlSH

Score

10^/10

quasar controlhost spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Controlhost

C2

121.43.158.106:4782

yc01h.11ychos.xyz:4782

Mutex

QSR_MUTEX_GFWuzMTNQOijYUKopR

Attributes

encryption_key
Xym3BhtshKCyrit7obQT8XbWGz4i7Yw4
install_name
Controlhost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Controlhost
subdirectory
Controlhost

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2400-1-0x00000000000B0000-0x000000000013C000-memory.dmp	family_quasar

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2400-1-0x00000000000B0000-0x000000000013C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables containing common artifacts observed in infostealers 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2400-1-0x00000000000B0000-0x000000000013C000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2544 2400 WerFault.exe b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2448 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

description pid process

Token: SeDebugPrivilege 2400 b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

pid process

2400 b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

flow	ioc
2	ip-api.com

pid	pid_target	process	target process
2544	2400	WerFault.exe	b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

pid	process
2448	PING.EXE

description	pid	process
Token: SeDebugPrivilege	2400	b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

pid	process
2400	b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.execmd.exe

description	pid	process	target process
PID 2400 wrote to memory of 2596	2400	b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe	cmd.exe
PID 2400 wrote to memory of 2596	2400	b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe	cmd.exe
PID 2400 wrote to memory of 2596	2400	b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe	cmd.exe
PID 2400 wrote to memory of 2596	2400	b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe	cmd.exe
PID 2400 wrote to memory of 2544	2400	b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe	WerFault.exe
PID 2400 wrote to memory of 2544	2400	b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe	WerFault.exe
PID 2400 wrote to memory of 2544	2400	b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe	WerFault.exe
PID 2400 wrote to memory of 2544	2400	b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe	WerFault.exe
PID 2596 wrote to memory of 2428	2596	cmd.exe	chcp.com
PID 2596 wrote to memory of 2428	2596	cmd.exe	chcp.com
PID 2596 wrote to memory of 2428	2596	cmd.exe	chcp.com
PID 2596 wrote to memory of 2428	2596	cmd.exe	chcp.com
PID 2596 wrote to memory of 2448	2596	cmd.exe	PING.EXE
PID 2596 wrote to memory of 2448	2596	cmd.exe	PING.EXE
PID 2596 wrote to memory of 2448	2596	cmd.exe	PING.EXE
PID 2596 wrote to memory of 2448	2596	cmd.exe	PING.EXE
PID 2596 wrote to memory of 1484	2596	cmd.exe	b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 2596 wrote to memory of 1484	2596	cmd.exe	b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 2596 wrote to memory of 1484	2596	cmd.exe	b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 2596 wrote to memory of 1484	2596	cmd.exe	b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
"C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\x3Lid85K0rQq.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:2428

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
3⤵
- Runs ping.exe
PID:2448

C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
"C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe"
3⤵
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 1464
2⤵
- Program crash
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x3Lid85K0rQq.bat

Filesize
261B

MD5
1ff0e8236a1065cfde659e7e0fd99814

SHA1
ec3f3e108dc0b4f03720981cf24cea010154cc65

SHA256
bfcd187bfeeb9e3818c176962d12f5c11e9fc013926c2e3d33281eaa6aebbf81

SHA512
66a2ef46b9203b33d958f5cf1e0949b95c5e18c2aac9328daee1b4d26153d74af4ae8dd5988d8fcad0809af403d52d607b14048a09d00d2ee4ba829831d47765

Download Submit
memory/2400-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/2400-1-0x00000000000B0000-0x000000000013C000-memory.dmp

Filesize
560KB

Download
memory/2400-2-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/2400-4-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/2400-5-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads