quasar | 4a424271b9a191afc76110e2bccd45f23cc281853f223d3e27756e16c14b5019 | Triage

Analysis

max time kernel
101s
max time network
112s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-06-2024 11:57

Sharing

Report Analysis Logs

General

Target

Update.exe
Size

20.4MB
MD5

88246c2a001042481486e559a6d10d91
SHA1

e64a646ba23b7795ec3dfb5ae4d80b02c7dd274f
SHA256

4a424271b9a191afc76110e2bccd45f23cc281853f223d3e27756e16c14b5019
SHA512

f3daab1877324bc8ac1f52bc9d1c7327230840fc53899aed47b69dd6b7e996cf3fde70c7efe209fa6fb9d80d58687abbd2f144a66e26de17b99b539d20f6e5ad
SSDEEP

393216:XlHpZSFSVTVyVSJXSUEJRnpyQnXUWJjv0xamVNA3guo9N:9p0FmyVSNSUE7npyQnkWJjv0DV23o

Score

10^/10

quasar emmassub discovery execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

EmmasSub

C2

85.23.24.170:4782

85.23.109.34:4782

82.128.254.93:4782

Mutex

f82c7021-f558-4f6f-bbb3-fbe420c708e5

Attributes

encryption_key
4DC093FC202D016F95DCEE92AAF2874F56ACC3F2
install_name
RuntimeBroker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
WindowsSecureManager

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\MyFolder\RunMe.exe	family_quasar
behavioral1/memory/3040-282-0x0000000000F70000-0x0000000001294000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1252 powershell.exe
Executes dropped EXE 3 IoCs

Processes:

Update.tmpRunMe.exeRuntimeBroker.exe

pid process

3844 Update.tmp
3040 RunMe.exe
4068 RuntimeBroker.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

RunMe.exeRuntimeBroker.exe

description	ioc	process
File opened for modification	C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe	RunMe.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager	RunMe.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager	RuntimeBroker.exe
File created	C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe	RunMe.exe

Drops file in Program Files directory 8 IoCs

Processes:

Update.tmp

description	ioc	process
File opened for modification	C:\Program Files (x86)\MyFolder\RunMe.exe	Update.tmp
File opened for modification	C:\Program Files (x86)\MyFolder\creal.exe	Update.tmp
File created	C:\Program Files (x86)\MyFolder\unins000.dat	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-E84EF.tmp	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-LKI5B.tmp	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-TVAJT.tmp	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-COGA0.tmp	Update.tmp
File opened for modification	C:\Program Files (x86)\MyFolder\unins000.dat	Update.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1928 schtasks.exe
700 schtasks.exe

Modifies registry class 19 IoCs

Processes:

Update.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\TstFile.myp\shell\open\command	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\.myp\OpenWithProgids	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids\TstFile.myp	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\ = "Tst File"	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open\command\ = "\"C:\\Program Files (x86)\\MyFolder\\RunMe.exe\" \"%1\""	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\RunMe.exe\SupportedTypes	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\DefaultIcon\ = "C:\\Program Files (x86)\\MyFolder\\RunMe.exe,0"	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open\command	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\TstFile.myp	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\TstFile.myp\DefaultIcon	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe\SupportedTypes\.myp	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe\SupportedTypes	Update.tmp

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Update.tmppowershell.exe

pid process

3844 Update.tmp
3844 Update.tmp
1252 powershell.exe
1252 powershell.exe
1252 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeRunMe.exeRuntimeBroker.exe

description pid process

Token: SeDebugPrivilege 1252 powershell.exe
Token: SeDebugPrivilege 3040 RunMe.exe
Token: SeDebugPrivilege 4068 RuntimeBroker.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Update.tmp

pid process

3844 Update.tmp
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RuntimeBroker.exe

pid process

4068 RuntimeBroker.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Update.exeUpdate.tmpcmd.exeRunMe.exeRuntimeBroker.exe

description	pid	process	target process
PID 2896 wrote to memory of 3844	2896	Update.exe	Update.tmp
PID 2896 wrote to memory of 3844	2896	Update.exe	Update.tmp
PID 2896 wrote to memory of 3844	2896	Update.exe	Update.tmp
PID 3844 wrote to memory of 4272	3844	Update.tmp	cmd.exe
PID 3844 wrote to memory of 4272	3844	Update.tmp	cmd.exe
PID 3844 wrote to memory of 4272	3844	Update.tmp	cmd.exe
PID 4272 wrote to memory of 1252	4272	cmd.exe	powershell.exe
PID 4272 wrote to memory of 1252	4272	cmd.exe	powershell.exe
PID 4272 wrote to memory of 1252	4272	cmd.exe	powershell.exe
PID 3844 wrote to memory of 3040	3844	Update.tmp	RunMe.exe
PID 3844 wrote to memory of 3040	3844	Update.tmp	RunMe.exe
PID 3040 wrote to memory of 1928	3040	RunMe.exe	schtasks.exe
PID 3040 wrote to memory of 1928	3040	RunMe.exe	schtasks.exe
PID 3040 wrote to memory of 4068	3040	RunMe.exe	RuntimeBroker.exe
PID 3040 wrote to memory of 4068	3040	RunMe.exe	RuntimeBroker.exe
PID 4068 wrote to memory of 700	4068	RuntimeBroker.exe	schtasks.exe
PID 4068 wrote to memory of 700	4068	RuntimeBroker.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Update.exe
"C:\Users\Admin\AppData\Local\Temp\Update.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896

C:\Users\Admin\AppData\Local\Temp\is-987IU.tmp\Update.tmp
"C:\Users\Admin\AppData\Local\Temp\is-987IU.tmp\Update.tmp" /SL5="$601B6,20549816,832512,C:\Users\Admin\AppData\Local\Temp\Update.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\MyFolder\me.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:4272

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionProcess 'C:\WINDOWS\system32\WindowsSecureManager\RuntimeBroker.exe'"
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Program Files (x86)\MyFolder\RunMe.exe
"C:\Program Files (x86)\MyFolder\RunMe.exe"
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe
"C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:700

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\MyFolder\RunMe.exe
Filesize
3.1MB

MD5
392a6ea0718747e4ad443f730047715b

SHA1
808d682efeb32bd7f98e49b7b99350683162059e

SHA256
36be936ba0fc160a314bfaf9be4c8689730ad9c11c3cf6fb7d066c43a934b257

SHA512
b033da7b04a2dc9a342de4970ae1fe26cda4d82bd3fe4a2a2f34507675832912cc6d66456a8a846f75a705523514d4b52bbd120e7b629c3d38467d999d2e95b4

Download Submit
C:\Program Files (x86)\MyFolder\me.bat
Filesize
130B

MD5
0829830a1636e2958b07fc827cb5d3d7

SHA1
6051bfbf49df5f44c41f20104a079a8d0f7acb94

SHA256
b2fce48164d3196f4ec0d85766cb37a9dd12e5a2b478a10583d38c2561616f6b

SHA512
ac40f48729c6b14e3d43c55f46a12584de8e48b74473f8011071d4869fbdfac30aa27f91e73d99584b88c88e02d7a03901a168c3403566fb40c1d3198cf91755

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t3jebtn3.zv5.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-987IU.tmp\Update.tmp
Filesize
3.1MB

MD5
6a4ac87c4331dc724e6fea16e0ab4b7e

SHA1
3dcab7b5fc73352c01eb24e827626670fa323cec

SHA256
3b9ccf0ba93ecc3640ec5637d3bcfa030c260e6a6222ac7a4bebdd0a91af9a66

SHA512
dc8e3c8a90cd7751f069c5e00c40abbd66a407eeea783829c82242ff9d52fa9389220aed896705dd81911a9d007d3a394cb24c7c3c1e08020bbc2d3c371a9eb6

Download Submit
memory/1252-35-0x0000000008950000-0x000000000899B000-memory.dmp

Filesize
300KB

Download
memory/1252-53-0x0000000009550000-0x0000000009583000-memory.dmp

Filesize
204KB

Download
memory/1252-259-0x0000000009A00000-0x0000000009A08000-memory.dmp

Filesize
32KB

Download
memory/1252-28-0x0000000006ED0000-0x0000000006F06000-memory.dmp

Filesize
216KB

Download
memory/1252-29-0x0000000007600000-0x0000000007C28000-memory.dmp

Filesize
6.2MB

Download
memory/1252-30-0x0000000007C30000-0x0000000007C52000-memory.dmp

Filesize
136KB

Download
memory/1252-31-0x0000000007DB0000-0x0000000007E16000-memory.dmp

Filesize
408KB

Download
memory/1252-32-0x0000000007F20000-0x0000000007F86000-memory.dmp

Filesize
408KB

Download
memory/1252-33-0x0000000007F90000-0x00000000082E0000-memory.dmp

Filesize
3.3MB

Download
memory/1252-34-0x0000000007D80000-0x0000000007D9C000-memory.dmp

Filesize
112KB

Download
memory/1252-254-0x0000000009A20000-0x0000000009A3A000-memory.dmp

Filesize
104KB

Download
memory/1252-36-0x0000000008640000-0x00000000086B6000-memory.dmp

Filesize
472KB

Download
memory/1252-61-0x0000000009AC0000-0x0000000009B54000-memory.dmp

Filesize
592KB

Download
memory/1252-60-0x0000000009890000-0x0000000009935000-memory.dmp

Filesize
660KB

Download
memory/1252-55-0x0000000009530000-0x000000000954E000-memory.dmp

Filesize
120KB

Download
memory/1252-54-0x000000006F3A0000-0x000000006F3EB000-memory.dmp

Filesize
300KB

Download
memory/2896-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2896-8-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2896-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2896-286-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3040-282-0x0000000000F70000-0x0000000001294000-memory.dmp

Filesize
3.1MB

Download
memory/3844-9-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/3844-6-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/3844-276-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/3844-285-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4068-293-0x0000000001200000-0x0000000001250000-memory.dmp

Filesize
320KB

Download
memory/4068-294-0x000000001C2C0000-0x000000001C372000-memory.dmp

Filesize
712KB

Download