quasar | 8739b236fb674c2c3516bc43ecf4b6583ea22ca0d4b2fe417b6223d654d52011

Resubmissions

28-05-2024 02:35

240528-c3cl8acg65 10

28-05-2024 02:34

240528-c2ncbsbe8y 10

Analysis

max time kernel
40s
max time network
41s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SynapseX Revamped V1.5/SynapseXBootstrapper.exe
Size

3.1MB
MD5

9434a1822088cedbce057d280c235864
SHA1

c09173a18e5ae2d9d38bd4d3d196adf1423f924e
SHA256

de29011246319ec8b60774d8c4cad4e8299e27eba6dc7699cd257fbdda338336
SHA512

7461b706ef796abc96d7f2549091061910fdf81a77ae0f8d0c20c5de870164410f5dd3b68e3e33a5bb9b77c3ccf59fd787164530b6d2d03688d4dceccb4fb632
SSDEEP

49152:PvnI22SsaNYfdPBldt698dBcjHHeJ/uBx3ioGdyTHHB72eh2NT:PvI22SsaNYfdPBldt6+dBcjH4/X

Score

10^/10

quasar windows update spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Windows Update

skbidiooiilet-31205.portmap.host:31205

Mutex

b2f09b33-2e5b-4ffa-afbf-3f1aaed274a6

Attributes

encryption_key
6F721445F7E0B1CF58980D84A9D49F4458D4EFD9
install_name
Update.exe
log_directory
Logs
reconnect_delay
3000
startup_key
WindowsUpdate
subdirectory
Windows Update

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral3/memory/2436-1-0x0000000000D40000-0x0000000001064000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\Windows Update\Update.exe	family_quasar
behavioral3/memory/2588-10-0x00000000013C0000-0x00000000016E4000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Update.exe

pid process

2588 Update.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2740 schtasks.exe
2944 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SynapseXBootstrapper.exeUpdate.exe

description pid process

Token: SeDebugPrivilege 2436 SynapseXBootstrapper.exe
Token: SeDebugPrivilege 2588 Update.exe

pid	process
2588	Update.exe

pid	process
2740	schtasks.exe
2944	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2436	SynapseXBootstrapper.exe
Token: SeDebugPrivilege	2588	Update.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

SynapseXBootstrapper.exeUpdate.exe

description	pid	process	target process
PID 2436 wrote to memory of 2944	2436	SynapseXBootstrapper.exe	schtasks.exe
PID 2436 wrote to memory of 2944	2436	SynapseXBootstrapper.exe	schtasks.exe
PID 2436 wrote to memory of 2944	2436	SynapseXBootstrapper.exe	schtasks.exe
PID 2436 wrote to memory of 2588	2436	SynapseXBootstrapper.exe	Update.exe
PID 2436 wrote to memory of 2588	2436	SynapseXBootstrapper.exe	Update.exe
PID 2436 wrote to memory of 2588	2436	SynapseXBootstrapper.exe	Update.exe
PID 2588 wrote to memory of 2740	2588	Update.exe	schtasks.exe
PID 2588 wrote to memory of 2740	2588	Update.exe	schtasks.exe
PID 2588 wrote to memory of 2740	2588	Update.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SynapseX Revamped V1.5\SynapseXBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SynapseX Revamped V1.5\SynapseXBootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Update\Update.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2944
- C:\Users\Admin\AppData\Roaming\Windows Update\Update.exe
  "C:\Users\Admin\AppData\Roaming\Windows Update\Update.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Update\Update.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Windows Update\Update.exe

Filesize
3.1MB

MD5
9434a1822088cedbce057d280c235864

SHA1
c09173a18e5ae2d9d38bd4d3d196adf1423f924e

SHA256
de29011246319ec8b60774d8c4cad4e8299e27eba6dc7699cd257fbdda338336

SHA512
7461b706ef796abc96d7f2549091061910fdf81a77ae0f8d0c20c5de870164410f5dd3b68e3e33a5bb9b77c3ccf59fd787164530b6d2d03688d4dceccb4fb632

Download Submit
memory/2436-0-0x000007FEF57D3000-0x000007FEF57D4000-memory.dmp

Filesize
4KB

Download
memory/2436-1-0x0000000000D40000-0x0000000001064000-memory.dmp

Filesize
3.1MB

Download
memory/2436-2-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

Filesize
9.9MB

Download
memory/2436-9-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

Filesize
9.9MB

Download
memory/2588-8-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

Filesize
9.9MB

Download
memory/2588-10-0x00000000013C0000-0x00000000016E4000-memory.dmp

Filesize
3.1MB

Download
memory/2588-11-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

Filesize
9.9MB

Download
memory/2588-12-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

Filesize
9.9MB

Download