quasar | 790c606fd4e39779b55dacfaa684be5aea2cd3cebd9b26f089c3498399b4b757

Analysis

max time kernel
48s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SynapseX.exe
Size

3.1MB
MD5

674a2f40a3cfdeb19b4787406f9f947b
SHA1

2fb5232fe4c078a35270aca9dc57f7f8f69b0328
SHA256

790c606fd4e39779b55dacfaa684be5aea2cd3cebd9b26f089c3498399b4b757
SHA512

feab371f1cd8adbd45e560329f4353a91b176a9b5897bf803633ea9f13698a6c6b67c38466f0077f3c93ff0a06467bf43e32a5e1a4ee9d623878f6177d1c918c
SSDEEP

49152:3v6lL26AaNeWgPhlmVqvMQ7XSKWCS21J/LoGd+THHB72eh2NT:3viL26AaNeWgPhlmVqkQ7XSKWCSG

Score

10^/10

quasar chase spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Chase

Synapsedoggystyle-51191.portmap.host:51191

Mutex

bfe1d049-722e-41ed-b777-d417eb22f6e7

Attributes

encryption_key
33F77912B4CF70A0AD1E582014B5294301E27672
install_name
Synapase.exe
log_directory
Windows Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
document

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/320-1-0x00000000006F0000-0x0000000000A14000-memory.dmp	family_quasar
C:\Program Files\document\Synapase.exe	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Synapase.exe

pid process

916 Synapase.exe

pid	process
916	Synapase.exe

Drops file in Program Files directory 5 IoCs

Processes:

SynapseX.exeSynapase.exe

description	ioc	process
File created	C:\Program Files\document\Synapase.exe	SynapseX.exe
File opened for modification	C:\Program Files\document\Synapase.exe	SynapseX.exe
File opened for modification	C:\Program Files\document	SynapseX.exe
File opened for modification	C:\Program Files\document\Synapase.exe	Synapase.exe
File opened for modification	C:\Program Files\document	Synapase.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

828 schtasks.exe
2192 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SynapseX.exeSynapase.exe

description pid process

Token: SeDebugPrivilege 320 SynapseX.exe
Token: SeDebugPrivilege 916 Synapase.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Synapase.exe

pid process

916 Synapase.exe

pid	process
828	schtasks.exe
2192	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	320	SynapseX.exe
Token: SeDebugPrivilege	916	Synapase.exe

pid	process
916	Synapase.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SynapseX.exeSynapase.exe

description	pid	process	target process
PID 320 wrote to memory of 828	320	SynapseX.exe	schtasks.exe
PID 320 wrote to memory of 828	320	SynapseX.exe	schtasks.exe
PID 320 wrote to memory of 916	320	SynapseX.exe	Synapase.exe
PID 320 wrote to memory of 916	320	SynapseX.exe	Synapase.exe
PID 916 wrote to memory of 2192	916	Synapase.exe	schtasks.exe
PID 916 wrote to memory of 2192	916	Synapase.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SynapseX.exe
"C:\Users\Admin\AppData\Local\Temp\SynapseX.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\document\Synapase.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:828

C:\Program Files\document\Synapase.exe
"C:\Program Files\document\Synapase.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files\document\Synapase.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2192

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\document\Synapase.exe
Filesize
3.1MB

MD5
674a2f40a3cfdeb19b4787406f9f947b

SHA1
2fb5232fe4c078a35270aca9dc57f7f8f69b0328

SHA256
790c606fd4e39779b55dacfaa684be5aea2cd3cebd9b26f089c3498399b4b757

SHA512
feab371f1cd8adbd45e560329f4353a91b176a9b5897bf803633ea9f13698a6c6b67c38466f0077f3c93ff0a06467bf43e32a5e1a4ee9d623878f6177d1c918c

Download Submit
memory/320-0-0x00007FFEC4133000-0x00007FFEC4135000-memory.dmp

Filesize
8KB

Download
memory/320-1-0x00000000006F0000-0x0000000000A14000-memory.dmp

Filesize
3.1MB

Download
memory/320-2-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmp

Filesize
10.8MB

Download
memory/320-9-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmp

Filesize
10.8MB

Download
memory/916-10-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmp

Filesize
10.8MB

Download
memory/916-11-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmp

Filesize
10.8MB

Download
memory/916-12-0x000000001BB50000-0x000000001BBA0000-memory.dmp

Filesize
320KB

Download
memory/916-13-0x000000001BC60000-0x000000001BD12000-memory.dmp

Filesize
712KB

Download
memory/916-14-0x00007FFEC4130000-0x00007FFEC4BF1000-memory.dmp

Filesize
10.8MB

Download