quasar | ae0e11a13ffa7d349b3fbd4e1966d25a5a339b164ed6cc87bbf8da76abde8866

General

Target

Patch Fix.exe
Size

1.0MB
MD5

0b44f548d340e9275d94971241bb8f7a
SHA1

f33be25f3f0e471e9e65613e0493cf1900b22422
SHA256

ae0e11a13ffa7d349b3fbd4e1966d25a5a339b164ed6cc87bbf8da76abde8866
SHA512

633629ea7a8a64dc00560bc3e1ed5de25ca234cdadabfcc83ac52e779464c72035111332c11162ddf2a971660c915b3e7eced02c132f07788cc5d46e73dfb577
SSDEEP

24576:aNxY7AJDq1S1pOefXNV8PYabTFSlPZFfk4:aNxvtXOefb8xleR7

Score

10^/10

quasar chrome persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Chrome

C2

qassar23.ddns.net:1993

Mutex

QSR_MUTEX_Uk4K1FeKx4DjEtnjXG

Attributes

encryption_key
4rkb9eRfFISIy758S45s
install_name
Update service.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Chrome
subdirectory
microsofte

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2040-21-0x0000000000090000-0x00000000000EE000-memory.dmp	family_quasar
behavioral1/memory/2040-23-0x0000000000090000-0x00000000000EE000-memory.dmp	family_quasar

Drops startup file 2 IoCs

Processes:

cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

Chrome.exe

pid process

880 Chrome.exe
Loads dropped DLL 4 IoCs

Processes:

cmd.exeChrome.exe

pid process

2816 cmd.exe
2816 cmd.exe
880 Chrome.exe
880 Chrome.exe

pid	process
880	Chrome.exe

pid	process
2816	cmd.exe
2816	cmd.exe
880	Chrome.exe
880	Chrome.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome.exe"	reg.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

2284 PING.EXE
2080 PING.EXE
2884 PING.EXE
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

Patch Fix.exeChrome.exe

pid process

2436 Patch Fix.exe
2436 Patch Fix.exe
2436 Patch Fix.exe
2436 Patch Fix.exe
2436 Patch Fix.exe
880 Chrome.exe
880 Chrome.exe
880 Chrome.exe
880 Chrome.exe

pid	process
2284	PING.EXE
2080	PING.EXE
2884	PING.EXE

pid	process
2436	Patch Fix.exe
2436	Patch Fix.exe
2436	Patch Fix.exe
2436	Patch Fix.exe
2436	Patch Fix.exe
880	Chrome.exe
880	Chrome.exe
880	Chrome.exe
880	Chrome.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Patch Fix.exeChrome.exe

description	pid	process
Token: SeDebugPrivilege	2436	Patch Fix.exe
Token: SeRestorePrivilege	2436	Patch Fix.exe
Token: SeBackupPrivilege	2436	Patch Fix.exe
Token: SeDebugPrivilege	880	Chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Patch Fix.execmd.execmd.exeChrome.exe

description	pid	process	target process
PID 2436 wrote to memory of 2360	2436	Patch Fix.exe	cmd.exe
PID 2436 wrote to memory of 2360	2436	Patch Fix.exe	cmd.exe
PID 2436 wrote to memory of 2360	2436	Patch Fix.exe	cmd.exe
PID 2436 wrote to memory of 2360	2436	Patch Fix.exe	cmd.exe
PID 2436 wrote to memory of 2360	2436	Patch Fix.exe	cmd.exe
PID 2436 wrote to memory of 2360	2436	Patch Fix.exe	cmd.exe
PID 2436 wrote to memory of 2360	2436	Patch Fix.exe	cmd.exe
PID 2360 wrote to memory of 2284	2360	cmd.exe	PING.EXE
PID 2360 wrote to memory of 2284	2360	cmd.exe	PING.EXE
PID 2360 wrote to memory of 2284	2360	cmd.exe	PING.EXE
PID 2360 wrote to memory of 2284	2360	cmd.exe	PING.EXE
PID 2360 wrote to memory of 2284	2360	cmd.exe	PING.EXE
PID 2360 wrote to memory of 2284	2360	cmd.exe	PING.EXE
PID 2360 wrote to memory of 2284	2360	cmd.exe	PING.EXE
PID 2436 wrote to memory of 2816	2436	Patch Fix.exe	cmd.exe
PID 2436 wrote to memory of 2816	2436	Patch Fix.exe	cmd.exe
PID 2436 wrote to memory of 2816	2436	Patch Fix.exe	cmd.exe
PID 2436 wrote to memory of 2816	2436	Patch Fix.exe	cmd.exe
PID 2436 wrote to memory of 2816	2436	Patch Fix.exe	cmd.exe
PID 2436 wrote to memory of 2816	2436	Patch Fix.exe	cmd.exe
PID 2436 wrote to memory of 2816	2436	Patch Fix.exe	cmd.exe
PID 2816 wrote to memory of 2080	2816	cmd.exe	PING.EXE
PID 2816 wrote to memory of 2080	2816	cmd.exe	PING.EXE
PID 2816 wrote to memory of 2080	2816	cmd.exe	PING.EXE
PID 2816 wrote to memory of 2080	2816	cmd.exe	PING.EXE
PID 2816 wrote to memory of 2080	2816	cmd.exe	PING.EXE
PID 2816 wrote to memory of 2080	2816	cmd.exe	PING.EXE
PID 2816 wrote to memory of 2080	2816	cmd.exe	PING.EXE
PID 2360 wrote to memory of 2672	2360	cmd.exe	reg.exe
PID 2360 wrote to memory of 2672	2360	cmd.exe	reg.exe
PID 2360 wrote to memory of 2672	2360	cmd.exe	reg.exe
PID 2360 wrote to memory of 2672	2360	cmd.exe	reg.exe
PID 2360 wrote to memory of 2672	2360	cmd.exe	reg.exe
PID 2360 wrote to memory of 2672	2360	cmd.exe	reg.exe
PID 2360 wrote to memory of 2672	2360	cmd.exe	reg.exe
PID 2816 wrote to memory of 2884	2816	cmd.exe	PING.EXE
PID 2816 wrote to memory of 2884	2816	cmd.exe	PING.EXE
PID 2816 wrote to memory of 2884	2816	cmd.exe	PING.EXE
PID 2816 wrote to memory of 2884	2816	cmd.exe	PING.EXE
PID 2816 wrote to memory of 2884	2816	cmd.exe	PING.EXE
PID 2816 wrote to memory of 2884	2816	cmd.exe	PING.EXE
PID 2816 wrote to memory of 2884	2816	cmd.exe	PING.EXE
PID 2816 wrote to memory of 880	2816	cmd.exe	Chrome.exe
PID 2816 wrote to memory of 880	2816	cmd.exe	Chrome.exe
PID 2816 wrote to memory of 880	2816	cmd.exe	Chrome.exe
PID 2816 wrote to memory of 880	2816	cmd.exe	Chrome.exe
PID 2816 wrote to memory of 880	2816	cmd.exe	Chrome.exe
PID 2816 wrote to memory of 880	2816	cmd.exe	Chrome.exe
PID 2816 wrote to memory of 880	2816	cmd.exe	Chrome.exe
PID 880 wrote to memory of 2040	880	Chrome.exe	InstallUtil.exe
PID 880 wrote to memory of 2040	880	Chrome.exe	InstallUtil.exe
PID 880 wrote to memory of 2040	880	Chrome.exe	InstallUtil.exe
PID 880 wrote to memory of 2040	880	Chrome.exe	InstallUtil.exe
PID 880 wrote to memory of 2040	880	Chrome.exe	InstallUtil.exe
PID 880 wrote to memory of 2040	880	Chrome.exe	InstallUtil.exe
PID 880 wrote to memory of 2040	880	Chrome.exe	InstallUtil.exe
PID 880 wrote to memory of 2040	880	Chrome.exe	InstallUtil.exe
PID 880 wrote to memory of 2040	880	Chrome.exe	InstallUtil.exe
PID 880 wrote to memory of 2040	880	Chrome.exe	InstallUtil.exe
PID 880 wrote to memory of 2040	880	Chrome.exe	InstallUtil.exe
PID 880 wrote to memory of 2040	880	Chrome.exe	InstallUtil.exe
PID 880 wrote to memory of 1428	880	Chrome.exe	InstallUtil.exe
PID 880 wrote to memory of 1428	880	Chrome.exe	InstallUtil.exe
PID 880 wrote to memory of 1428	880	Chrome.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\Patch Fix.exe
"C:\Users\Admin\AppData\Local\Temp\Patch Fix.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 36 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Chrome" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2360

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 36
3⤵
- Runs ping.exe
PID:2284

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Chrome" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe"
3⤵
- Adds Run key to start application
PID:2672

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 37 > nul && copy "C:\Users\Admin\AppData\Local\Temp\Patch Fix.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe" && ping 127.0.0.1 -n 37 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe"
2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 37
3⤵
- Runs ping.exe
PID:2080

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 37
3⤵
- Runs ping.exe
PID:2884

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
4⤵
PID:2040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
4⤵
PID:1428

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe
Filesize
1.0MB

MD5
0b44f548d340e9275d94971241bb8f7a

SHA1
f33be25f3f0e471e9e65613e0493cf1900b22422

SHA256
ae0e11a13ffa7d349b3fbd4e1966d25a5a339b164ed6cc87bbf8da76abde8866

SHA512
633629ea7a8a64dc00560bc3e1ed5de25ca234cdadabfcc83ac52e779464c72035111332c11162ddf2a971660c915b3e7eced02c132f07788cc5d46e73dfb577

Download Submit
memory/880-14-0x0000000000160000-0x000000000026A000-memory.dmp

Filesize
1.0MB

Download
memory/880-15-0x0000000000630000-0x000000000064A000-memory.dmp

Filesize
104KB

Download
memory/880-16-0x0000000000B60000-0x0000000000B66000-memory.dmp

Filesize
24KB

Download
memory/1428-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2040-18-0x0000000000090000-0x00000000000EE000-memory.dmp

Filesize
376KB

Download
memory/2040-19-0x0000000000090000-0x00000000000EE000-memory.dmp

Filesize
376KB

Download
memory/2040-21-0x0000000000090000-0x00000000000EE000-memory.dmp

Filesize
376KB

Download
memory/2040-23-0x0000000000090000-0x00000000000EE000-memory.dmp

Filesize
376KB

Download
memory/2040-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2436-0-0x0000000000BF0000-0x0000000000CFA000-memory.dmp

Filesize
1.0MB

Download
memory/2436-1-0x0000000005F70000-0x0000000005FB4000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads