quasar | 4a424271b9a191afc76110e2bccd45f23cc281853f223d3e27756e16c14b5019

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Update.exe
Size 20.4MB
Sample240601-b2cedsdc2z
SHA256 4a424271b9a191afc76110e2bccd45f23cc281853f223d3e27756e16c14b5019
MD5 88246c2a001042481486e559a6d10d91
SHA1 e64a646ba23b7795ec3dfb5ae4d80b02c7dd274f
SHA512 f3daab1877324bc8ac1f52bc9d1c7327230840fc53899aed47b69dd6b7e996cf3fde70c7efe209fa6fb9d80d58687abbd2f144a66e26de17b99b539d20f6e5ad
SSDEEP 393216:XlHpZSFSVTVyVSJXSUEJRnpyQnXUWJjv0xamVNA3guo9N:9p0FmyVSNSUE7npyQnkWJjv0DV23o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar emmassub discovery execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

EmmasSub

85.23.24.170:4782
85.23.109.34:4782
82.128.254.93:4782

Mutex

f82c7021-f558-4f6f-bbb3-fbe420c708e5

Attributes

encryption_key
4DC093FC202D016F95DCEE92AAF2874F56ACC3F2
install_name
RuntimeBroker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
WindowsSecureManager

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/files/0x0006000000016ceb-24.dat	family_quasar
behavioral1/memory/2008-35-0x0000000000300000-0x0000000000624000-memory.dmp	family_quasar
behavioral1/memory/1836-45-0x00000000008C0000-0x0000000000BE4000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2524	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
1424	Update.tmp
2008	RunMe.exe
1836	RuntimeBroker.exe

Loads dropped DLL 3 IoCs

pid	Process
1252	Update.exe
1424	Update.tmp
1424	Update.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe	RunMe.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager	RunMe.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager	RuntimeBroker.exe
File created	C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe	RunMe.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\MyFolder\RunMe.exe	Update.tmp
File created	C:\Program Files (x86)\MyFolder\unins000.dat	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-GAO2A.tmp	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-NHV56.tmp	Update.tmp
File opened for modification	C:\Program Files (x86)\MyFolder\unins000.dat	Update.tmp
File opened for modification	C:\Program Files (x86)\MyFolder\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Program Files (x86)\MyFolder\creal.exe	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-39FIV.tmp	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-EC36I.tmp	Update.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2488	schtasks.exe
1948	schtasks.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe\SupportedTypes	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\ = "Tst File"	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\TstFile.myp\shell\open\command	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open\command\ = "\"C:\\Program Files (x86)\\MyFolder\\RunMe.exe\" \"%1\""	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\.myp\OpenWithProgids	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids\TstFile.myp	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open\command	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\TstFile.myp	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\TstFile.myp\DefaultIcon	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe\SupportedTypes\.myp	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\DefaultIcon\ = "C:\\Program Files (x86)\\MyFolder\\RunMe.exe,0"	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\RunMe.exe\SupportedTypes	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	Update.tmp

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1424	Update.tmp
1424	Update.tmp
2524	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	2008	RunMe.exe
Token: SeDebugPrivilege	1836	RuntimeBroker.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1424	Update.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1836	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1424	1252	Update.exe	28
PID 1252 wrote to memory of 1424	1252	Update.exe	28
PID 1252 wrote to memory of 1424	1252	Update.exe	28
PID 1252 wrote to memory of 1424	1252	Update.exe	28
PID 1252 wrote to memory of 1424	1252	Update.exe	28
PID 1252 wrote to memory of 1424	1252	Update.exe	28
PID 1252 wrote to memory of 1424	1252	Update.exe	28
PID 1424 wrote to memory of 2876	1424	Update.tmp	29
PID 1424 wrote to memory of 2876	1424	Update.tmp	29
PID 1424 wrote to memory of 2876	1424	Update.tmp	29
PID 1424 wrote to memory of 2876	1424	Update.tmp	29
PID 2876 wrote to memory of 2524	2876	cmd.exe	31
PID 2876 wrote to memory of 2524	2876	cmd.exe	31
PID 2876 wrote to memory of 2524	2876	cmd.exe	31
PID 2876 wrote to memory of 2524	2876	cmd.exe	31
PID 1424 wrote to memory of 2008	1424	Update.tmp	33
PID 1424 wrote to memory of 2008	1424	Update.tmp	33
PID 1424 wrote to memory of 2008	1424	Update.tmp	33
PID 1424 wrote to memory of 2008	1424	Update.tmp	33
PID 2008 wrote to memory of 2488	2008	RunMe.exe	34
PID 2008 wrote to memory of 2488	2008	RunMe.exe	34
PID 2008 wrote to memory of 2488	2008	RunMe.exe	34
PID 2008 wrote to memory of 1836	2008	RunMe.exe	36
PID 2008 wrote to memory of 1836	2008	RunMe.exe	36
PID 2008 wrote to memory of 1836	2008	RunMe.exe	36
PID 1836 wrote to memory of 1948	1836	RuntimeBroker.exe	37
PID 1836 wrote to memory of 1948	1836	RuntimeBroker.exe	37
PID 1836 wrote to memory of 1948	1836	RuntimeBroker.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Update.exe
"C:\Users\Admin\AppData\Local\Temp\Update.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\is-55J0B.tmp\Update.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-55J0B.tmp\Update.tmp" /SL5="$70122,20549816,832512,C:\Users\Admin\AppData\Local\Temp\Update.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\MyFolder\me.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\WINDOWS\system32\WindowsSecureManager\RuntimeBroker.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2524
- - C:\Program Files (x86)\MyFolder\RunMe.exe
    "C:\Program Files (x86)\MyFolder\RunMe.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:2488
  - - C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe
      "C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

me.bat

Path C:\Program Files (x86)\MyFolder\me.bat
Size 130B
SHA256 b2fce48164d3196f4ec0d85766cb37a9dd12e5a2b478a10583d38c2561616f6b
MD5 0829830a1636e2958b07fc827cb5d3d7
SHA1 6051bfbf49df5f44c41f20104a079a8d0f7acb94
SHA512 ac40f48729c6b14e3d43c55f46a12584de8e48b74473f8011071d4869fbdfac30aa27f91e73d99584b88c88e02d7a03901a168c3403566fb40c1d3198cf91755
MD5 SHA1 SHA512

Submit Download

RunMe.exe

Path \Program Files (x86)\MyFolder\RunMe.exe
Size 3.1MB
SHA256 36be936ba0fc160a314bfaf9be4c8689730ad9c11c3cf6fb7d066c43a934b257
MD5 392a6ea0718747e4ad443f730047715b
SHA1 808d682efeb32bd7f98e49b7b99350683162059e
SHA512 b033da7b04a2dc9a342de4970ae1fe26cda4d82bd3fe4a2a2f34507675832912cc6d66456a8a846f75a705523514d4b52bbd120e7b629c3d38467d999d2e95b4
SSDEEP 49152:Dv4z92YpaQI6oPZlhP3Reybewo5GRJ63bR3LoGdvZTHHB72eh2NT:Dvi92YpaQI6oPZlhP3Yybewo5GRJ6Jf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Update.tmp

Path \Users\Admin\AppData\Local\Temp\is-55J0B.tmp\Update.tmp
Size 3.1MB
SHA256 3b9ccf0ba93ecc3640ec5637d3bcfa030c260e6a6222ac7a4bebdd0a91af9a66
MD5 6a4ac87c4331dc724e6fea16e0ab4b7e
SHA1 3dcab7b5fc73352c01eb24e827626670fa323cec
SHA512 dc8e3c8a90cd7751f069c5e00c40abbd66a407eeea783829c82242ff9d52fa9389220aed896705dd81911a9d007d3a394cb24c7c3c1e08020bbc2d3c371a9eb6
SSDEEP 49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1252-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1252-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Download

memory/1252-10-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1252-39-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1424-9-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/1424-11-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/1424-38-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/1836-45-0x00000000008C0000-0x0000000000BE4000-memory.dmp

Download

memory/2008-35-0x0000000000300000-0x0000000000624000-memory.dmp

Download