quasar | 4a424271b9a191afc76110e2bccd45f23cc281853f223d3e27756e16c14b5019

General

Target

Update.exe
Size

20.4MB
MD5

88246c2a001042481486e559a6d10d91
SHA1

e64a646ba23b7795ec3dfb5ae4d80b02c7dd274f
SHA256

4a424271b9a191afc76110e2bccd45f23cc281853f223d3e27756e16c14b5019
SHA512

f3daab1877324bc8ac1f52bc9d1c7327230840fc53899aed47b69dd6b7e996cf3fde70c7efe209fa6fb9d80d58687abbd2f144a66e26de17b99b539d20f6e5ad
SSDEEP

393216:XlHpZSFSVTVyVSJXSUEJRnpyQnXUWJjv0xamVNA3guo9N:9p0FmyVSNSUE7npyQnkWJjv0DV23o

Score

10^/10

quasar emmassub discovery execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

EmmasSub

C2

85.23.24.170:4782

85.23.109.34:4782

82.128.254.93:4782

Mutex

f82c7021-f558-4f6f-bbb3-fbe420c708e5

Attributes

encryption_key
4DC093FC202D016F95DCEE92AAF2874F56ACC3F2
install_name
RuntimeBroker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
WindowsSecureManager

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
\Program Files (x86)\MyFolder\RunMe.exe	family_quasar
behavioral1/memory/2008-35-0x0000000000300000-0x0000000000624000-memory.dmp	family_quasar
behavioral1/memory/1836-45-0x00000000008C0000-0x0000000000BE4000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2524 powershell.exe
Executes dropped EXE 3 IoCs

Processes:

Update.tmpRunMe.exeRuntimeBroker.exe

pid process

1424 Update.tmp
2008 RunMe.exe
1836 RuntimeBroker.exe
Loads dropped DLL 3 IoCs

Processes:

Update.exeUpdate.tmp

pid process

1252 Update.exe
1424 Update.tmp
1424 Update.tmp
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2524	powershell.exe

pid	process
1424	Update.tmp
2008	RunMe.exe
1836	RuntimeBroker.exe

pid	process
1252	Update.exe
1424	Update.tmp
1424	Update.tmp

Drops file in System32 directory 5 IoCs

Processes:

RunMe.exeRuntimeBroker.exe

description	ioc	process
File opened for modification	C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe	RunMe.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager	RunMe.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager	RuntimeBroker.exe
File created	C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe	RunMe.exe

Drops file in Program Files directory 9 IoCs

Processes:

Update.tmppowershell.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\MyFolder\RunMe.exe	Update.tmp
File created	C:\Program Files (x86)\MyFolder\unins000.dat	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-GAO2A.tmp	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-NHV56.tmp	Update.tmp
File opened for modification	C:\Program Files (x86)\MyFolder\unins000.dat	Update.tmp
File opened for modification	C:\Program Files (x86)\MyFolder\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Program Files (x86)\MyFolder\creal.exe	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-39FIV.tmp	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-EC36I.tmp	Update.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2488 schtasks.exe
1948 schtasks.exe

pid	process
2488	schtasks.exe
1948	schtasks.exe

Modifies registry class 19 IoCs

Processes:

Update.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe\SupportedTypes	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\ = "Tst File"	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\TstFile.myp\shell\open\command	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open\command\ = "\"C:\\Program Files (x86)\\MyFolder\\RunMe.exe\" \"%1\""	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\.myp\OpenWithProgids	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids\TstFile.myp	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open\command	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\TstFile.myp	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\TstFile.myp\DefaultIcon	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe\SupportedTypes\.myp	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\DefaultIcon\ = "C:\\Program Files (x86)\\MyFolder\\RunMe.exe,0"	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\RunMe.exe\SupportedTypes	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	Update.tmp

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Update.tmppowershell.exe

pid process

1424 Update.tmp
1424 Update.tmp
2524 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeRunMe.exeRuntimeBroker.exe

description pid process

Token: SeDebugPrivilege 2524 powershell.exe
Token: SeDebugPrivilege 2008 RunMe.exe
Token: SeDebugPrivilege 1836 RuntimeBroker.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Update.tmp

pid process

1424 Update.tmp
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RuntimeBroker.exe

pid process

1836 RuntimeBroker.exe

pid	process
1424	Update.tmp
1424	Update.tmp
2524	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	2008	RunMe.exe
Token: SeDebugPrivilege	1836	RuntimeBroker.exe

pid	process
1424	Update.tmp

pid	process
1836	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

Update.exeUpdate.tmpcmd.exeRunMe.exeRuntimeBroker.exe

description	pid	process	target process
PID 1252 wrote to memory of 1424	1252	Update.exe	Update.tmp
PID 1252 wrote to memory of 1424	1252	Update.exe	Update.tmp
PID 1252 wrote to memory of 1424	1252	Update.exe	Update.tmp
PID 1252 wrote to memory of 1424	1252	Update.exe	Update.tmp
PID 1252 wrote to memory of 1424	1252	Update.exe	Update.tmp
PID 1252 wrote to memory of 1424	1252	Update.exe	Update.tmp
PID 1252 wrote to memory of 1424	1252	Update.exe	Update.tmp
PID 1424 wrote to memory of 2876	1424	Update.tmp	cmd.exe
PID 1424 wrote to memory of 2876	1424	Update.tmp	cmd.exe
PID 1424 wrote to memory of 2876	1424	Update.tmp	cmd.exe
PID 1424 wrote to memory of 2876	1424	Update.tmp	cmd.exe
PID 2876 wrote to memory of 2524	2876	cmd.exe	powershell.exe
PID 2876 wrote to memory of 2524	2876	cmd.exe	powershell.exe
PID 2876 wrote to memory of 2524	2876	cmd.exe	powershell.exe
PID 2876 wrote to memory of 2524	2876	cmd.exe	powershell.exe
PID 1424 wrote to memory of 2008	1424	Update.tmp	RunMe.exe
PID 1424 wrote to memory of 2008	1424	Update.tmp	RunMe.exe
PID 1424 wrote to memory of 2008	1424	Update.tmp	RunMe.exe
PID 1424 wrote to memory of 2008	1424	Update.tmp	RunMe.exe
PID 2008 wrote to memory of 2488	2008	RunMe.exe	schtasks.exe
PID 2008 wrote to memory of 2488	2008	RunMe.exe	schtasks.exe
PID 2008 wrote to memory of 2488	2008	RunMe.exe	schtasks.exe
PID 2008 wrote to memory of 1836	2008	RunMe.exe	RuntimeBroker.exe
PID 2008 wrote to memory of 1836	2008	RunMe.exe	RuntimeBroker.exe
PID 2008 wrote to memory of 1836	2008	RunMe.exe	RuntimeBroker.exe
PID 1836 wrote to memory of 1948	1836	RuntimeBroker.exe	schtasks.exe
PID 1836 wrote to memory of 1948	1836	RuntimeBroker.exe	schtasks.exe
PID 1836 wrote to memory of 1948	1836	RuntimeBroker.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Update.exe
"C:\Users\Admin\AppData\Local\Temp\Update.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252

C:\Users\Admin\AppData\Local\Temp\is-55J0B.tmp\Update.tmp
"C:\Users\Admin\AppData\Local\Temp\is-55J0B.tmp\Update.tmp" /SL5="$70122,20549816,832512,C:\Users\Admin\AppData\Local\Temp\Update.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\MyFolder\me.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:2876

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionProcess 'C:\WINDOWS\system32\WindowsSecureManager\RuntimeBroker.exe'"
4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Program Files (x86)\MyFolder\RunMe.exe
"C:\Program Files (x86)\MyFolder\RunMe.exe"
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2488

C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe
"C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\MyFolder\me.bat

Filesize
130B

MD5
0829830a1636e2958b07fc827cb5d3d7

SHA1
6051bfbf49df5f44c41f20104a079a8d0f7acb94

SHA256
b2fce48164d3196f4ec0d85766cb37a9dd12e5a2b478a10583d38c2561616f6b

SHA512
ac40f48729c6b14e3d43c55f46a12584de8e48b74473f8011071d4869fbdfac30aa27f91e73d99584b88c88e02d7a03901a168c3403566fb40c1d3198cf91755

Download Submit
\Program Files (x86)\MyFolder\RunMe.exe

Filesize
3.1MB

MD5
392a6ea0718747e4ad443f730047715b

SHA1
808d682efeb32bd7f98e49b7b99350683162059e

SHA256
36be936ba0fc160a314bfaf9be4c8689730ad9c11c3cf6fb7d066c43a934b257

SHA512
b033da7b04a2dc9a342de4970ae1fe26cda4d82bd3fe4a2a2f34507675832912cc6d66456a8a846f75a705523514d4b52bbd120e7b629c3d38467d999d2e95b4

Download Submit
\Users\Admin\AppData\Local\Temp\is-55J0B.tmp\Update.tmp

Filesize
3.1MB

MD5
6a4ac87c4331dc724e6fea16e0ab4b7e

SHA1
3dcab7b5fc73352c01eb24e827626670fa323cec

SHA256
3b9ccf0ba93ecc3640ec5637d3bcfa030c260e6a6222ac7a4bebdd0a91af9a66

SHA512
dc8e3c8a90cd7751f069c5e00c40abbd66a407eeea783829c82242ff9d52fa9389220aed896705dd81911a9d007d3a394cb24c7c3c1e08020bbc2d3c371a9eb6

Download Submit
memory/1252-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1252-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/1252-10-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1252-39-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1424-9-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1424-11-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1424-38-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1836-45-0x00000000008C0000-0x0000000000BE4000-memory.dmp

Filesize
3.1MB

Download
memory/2008-35-0x0000000000300000-0x0000000000624000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads