quasar | 4a424271b9a191afc76110e2bccd45f23cc281853f223d3e27756e16c14b5019 | Triage

Analysis

max time kernel
118s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 11:57

Sharing

Report Analysis Logs

General

Target

Update.exe
Size

20.4MB
MD5

88246c2a001042481486e559a6d10d91
SHA1

e64a646ba23b7795ec3dfb5ae4d80b02c7dd274f
SHA256

4a424271b9a191afc76110e2bccd45f23cc281853f223d3e27756e16c14b5019
SHA512

f3daab1877324bc8ac1f52bc9d1c7327230840fc53899aed47b69dd6b7e996cf3fde70c7efe209fa6fb9d80d58687abbd2f144a66e26de17b99b539d20f6e5ad
SSDEEP

393216:XlHpZSFSVTVyVSJXSUEJRnpyQnXUWJjv0xamVNA3guo9N:9p0FmyVSNSUE7npyQnkWJjv0DV23o

Score

10^/10

quasar emmassub discovery execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

EmmasSub

C2

85.23.24.170:4782

85.23.109.34:4782

82.128.254.93:4782

Mutex

f82c7021-f558-4f6f-bbb3-fbe420c708e5

Attributes

encryption_key
4DC093FC202D016F95DCEE92AAF2874F56ACC3F2
install_name
RuntimeBroker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
WindowsSecureManager

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\MyFolder\RunMe.exe	family_quasar
behavioral3/memory/2168-80-0x00000000008B0000-0x0000000000BD4000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2616 powershell.exe
Executes dropped EXE 3 IoCs

Processes:

Update.tmpRunMe.exeRuntimeBroker.exe

pid process

3620 Update.tmp
2168 RunMe.exe
2548 RuntimeBroker.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

RunMe.exeRuntimeBroker.exe

description	ioc	process
File created	C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe	RunMe.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe	RunMe.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager	RunMe.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager	RuntimeBroker.exe

Drops file in Program Files directory 8 IoCs

Processes:

Update.tmp

description	ioc	process
File created	C:\Program Files (x86)\MyFolder\is-BD7J0.tmp	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-78U7T.tmp	Update.tmp
File opened for modification	C:\Program Files (x86)\MyFolder\unins000.dat	Update.tmp
File opened for modification	C:\Program Files (x86)\MyFolder\RunMe.exe	Update.tmp
File opened for modification	C:\Program Files (x86)\MyFolder\creal.exe	Update.tmp
File created	C:\Program Files (x86)\MyFolder\unins000.dat	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-HGR99.tmp	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-UFSHS.tmp	Update.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4412 schtasks.exe
2176 schtasks.exe

Modifies registry class 19 IoCs

Processes:

Update.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe\SupportedTypes	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\.myp\OpenWithProgids	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\TstFile.myp\DefaultIcon	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\RunMe.exe\SupportedTypes	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open\command\ = "\"C:\\Program Files (x86)\\MyFolder\\RunMe.exe\" \"%1\""	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\TstFile.myp	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\TstFile.myp\shell\open\command	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open\command	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe\SupportedTypes\.myp	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids\TstFile.myp	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\ = "Tst File"	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\DefaultIcon\ = "C:\\Program Files (x86)\\MyFolder\\RunMe.exe,0"	Update.tmp

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Update.tmppowershell.exe

pid process

3620 Update.tmp
3620 Update.tmp
2616 powershell.exe
2616 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeRunMe.exeRuntimeBroker.exe

description pid process

Token: SeDebugPrivilege 2616 powershell.exe
Token: SeDebugPrivilege 2168 RunMe.exe
Token: SeDebugPrivilege 2548 RuntimeBroker.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Update.tmp

pid process

3620 Update.tmp
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RuntimeBroker.exe

pid process

2548 RuntimeBroker.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Update.exeUpdate.tmpcmd.exeRunMe.exeRuntimeBroker.exe

description	pid	process	target process
PID 4912 wrote to memory of 3620	4912	Update.exe	Update.tmp
PID 4912 wrote to memory of 3620	4912	Update.exe	Update.tmp
PID 4912 wrote to memory of 3620	4912	Update.exe	Update.tmp
PID 3620 wrote to memory of 3376	3620	Update.tmp	cmd.exe
PID 3620 wrote to memory of 3376	3620	Update.tmp	cmd.exe
PID 3620 wrote to memory of 3376	3620	Update.tmp	cmd.exe
PID 3376 wrote to memory of 2616	3376	cmd.exe	powershell.exe
PID 3376 wrote to memory of 2616	3376	cmd.exe	powershell.exe
PID 3376 wrote to memory of 2616	3376	cmd.exe	powershell.exe
PID 3620 wrote to memory of 2168	3620	Update.tmp	RunMe.exe
PID 3620 wrote to memory of 2168	3620	Update.tmp	RunMe.exe
PID 2168 wrote to memory of 2176	2168	RunMe.exe	schtasks.exe
PID 2168 wrote to memory of 2176	2168	RunMe.exe	schtasks.exe
PID 2168 wrote to memory of 2548	2168	RunMe.exe	RuntimeBroker.exe
PID 2168 wrote to memory of 2548	2168	RunMe.exe	RuntimeBroker.exe
PID 2548 wrote to memory of 4412	2548	RuntimeBroker.exe	schtasks.exe
PID 2548 wrote to memory of 4412	2548	RuntimeBroker.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Update.exe
"C:\Users\Admin\AppData\Local\Temp\Update.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4912

C:\Users\Admin\AppData\Local\Temp\is-2GQNG.tmp\Update.tmp
"C:\Users\Admin\AppData\Local\Temp\is-2GQNG.tmp\Update.tmp" /SL5="$50214,20549816,832512,C:\Users\Admin\AppData\Local\Temp\Update.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3620

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\MyFolder\me.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:3376

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionProcess 'C:\WINDOWS\system32\WindowsSecureManager\RuntimeBroker.exe'"
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Program Files (x86)\MyFolder\RunMe.exe
"C:\Program Files (x86)\MyFolder\RunMe.exe"
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2176

C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe
"C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:4412

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\MyFolder\RunMe.exe
Filesize
3.1MB

MD5
392a6ea0718747e4ad443f730047715b

SHA1
808d682efeb32bd7f98e49b7b99350683162059e

SHA256
36be936ba0fc160a314bfaf9be4c8689730ad9c11c3cf6fb7d066c43a934b257

SHA512
b033da7b04a2dc9a342de4970ae1fe26cda4d82bd3fe4a2a2f34507675832912cc6d66456a8a846f75a705523514d4b52bbd120e7b629c3d38467d999d2e95b4

Download Submit
C:\Program Files (x86)\MyFolder\me.bat
Filesize
130B

MD5
0829830a1636e2958b07fc827cb5d3d7

SHA1
6051bfbf49df5f44c41f20104a079a8d0f7acb94

SHA256
b2fce48164d3196f4ec0d85766cb37a9dd12e5a2b478a10583d38c2561616f6b

SHA512
ac40f48729c6b14e3d43c55f46a12584de8e48b74473f8011071d4869fbdfac30aa27f91e73d99584b88c88e02d7a03901a168c3403566fb40c1d3198cf91755

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s5rrlixe.y55.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2GQNG.tmp\Update.tmp
Filesize
3.1MB

MD5
6a4ac87c4331dc724e6fea16e0ab4b7e

SHA1
3dcab7b5fc73352c01eb24e827626670fa323cec

SHA256
3b9ccf0ba93ecc3640ec5637d3bcfa030c260e6a6222ac7a4bebdd0a91af9a66

SHA512
dc8e3c8a90cd7751f069c5e00c40abbd66a407eeea783829c82242ff9d52fa9389220aed896705dd81911a9d007d3a394cb24c7c3c1e08020bbc2d3c371a9eb6

Download Submit
memory/2168-80-0x00000000008B0000-0x0000000000BD4000-memory.dmp

Filesize
3.1MB

Download
memory/2548-92-0x000000001CBC0000-0x000000001CC72000-memory.dmp

Filesize
712KB

Download
memory/2548-91-0x000000001C590000-0x000000001C5E0000-memory.dmp

Filesize
320KB

Download
memory/2616-44-0x00000000071F0000-0x0000000007222000-memory.dmp

Filesize
200KB

Download
memory/2616-59-0x0000000007430000-0x00000000074D3000-memory.dmp

Filesize
652KB

Download
memory/2616-26-0x00000000053E0000-0x0000000005A08000-memory.dmp

Filesize
6.2MB

Download
memory/2616-27-0x0000000073400000-0x0000000073BB0000-memory.dmp

Filesize
7.7MB

Download
memory/2616-28-0x0000000073400000-0x0000000073BB0000-memory.dmp

Filesize
7.7MB

Download
memory/2616-29-0x0000000005AC0000-0x0000000005AE2000-memory.dmp

Filesize
136KB

Download
memory/2616-30-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Filesize
408KB

Download
memory/2616-31-0x0000000005BD0000-0x0000000005C36000-memory.dmp

Filesize
408KB

Download
memory/2616-24-0x000000007340E000-0x000000007340F000-memory.dmp

Filesize
4KB

Download
memory/2616-41-0x0000000005C40000-0x0000000005F94000-memory.dmp

Filesize
3.3MB

Download
memory/2616-42-0x0000000006240000-0x000000000625E000-memory.dmp

Filesize
120KB

Download
memory/2616-43-0x0000000006270000-0x00000000062BC000-memory.dmp

Filesize
304KB

Download
memory/2616-45-0x000000006F8B0000-0x000000006F8FC000-memory.dmp

Filesize
304KB

Download
memory/2616-71-0x0000000073400000-0x0000000073BB0000-memory.dmp

Filesize
7.7MB

Download
memory/2616-55-0x0000000006810000-0x000000000682E000-memory.dmp

Filesize
120KB

Download
memory/2616-56-0x0000000073400000-0x0000000073BB0000-memory.dmp

Filesize
7.7MB

Download
memory/2616-68-0x00000000078D0000-0x00000000078D8000-memory.dmp

Filesize
32KB

Download
memory/2616-25-0x0000000002C80000-0x0000000002CB6000-memory.dmp

Filesize
216KB

Download
memory/2616-58-0x0000000073400000-0x0000000073BB0000-memory.dmp

Filesize
7.7MB

Download
memory/2616-61-0x0000000007590000-0x00000000075AA000-memory.dmp

Filesize
104KB

Download
memory/2616-60-0x0000000007BD0000-0x000000000824A000-memory.dmp

Filesize
6.5MB

Download
memory/2616-62-0x0000000007620000-0x000000000762A000-memory.dmp

Filesize
40KB

Download
memory/2616-63-0x0000000007830000-0x00000000078C6000-memory.dmp

Filesize
600KB

Download
memory/2616-64-0x00000000077B0000-0x00000000077C1000-memory.dmp

Filesize
68KB

Download
memory/2616-65-0x00000000077E0000-0x00000000077EE000-memory.dmp

Filesize
56KB

Download
memory/2616-66-0x00000000077F0000-0x0000000007804000-memory.dmp

Filesize
80KB

Download
memory/2616-67-0x00000000078F0000-0x000000000790A000-memory.dmp

Filesize
104KB

Download
memory/3620-57-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/3620-73-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/3620-12-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/3620-83-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/3620-6-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4912-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4912-8-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4912-84-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4912-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download