quasar | 17b628d201487fd1986f872585e31ea259e7b6e646f902bad75489b3ac056859

General

Target

incognito.exe
Size

3.1MB
MD5

d56706ab10b8ec541dc89d0d430503e6
SHA1

28d163151f6be7e38932bab63ec66cdfef2af3c2
SHA256

17b628d201487fd1986f872585e31ea259e7b6e646f902bad75489b3ac056859
SHA512

f51fcf15d5e9ae0347317b59a8f24689aae9e74549718c2bfb61590abc8cba358b169deca1e7897d5d58a2ed954672dbcea288a44a7a737507f703a3850800c2
SSDEEP

49152:3vXI22SsaNYfdPBldt698dBcjHwNxeFH2Ff8mZkqoGWcATHHB72eh2NT:3vY22SsaNYfdPBldt6+dBcjH0xeFYD

Score

10^/10

quasar rat - fake incognito spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

RAT - fake incognito

C2

192.168.4.30:4782

Mutex

d94dce9f-b2a7-4e68-b727-6888151a6b4e

Attributes

encryption_key
40B0884053AA1A1D9985C8E042F5C321462F78A6
install_name
Incognito.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Incognito
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4012-1-0x0000000000390000-0x00000000006B4000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Incognito.exe	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Incognito.exe

pid process

1216 Incognito.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3424 schtasks.exe
196 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

incognito.exeIncognito.exe

description pid process

Token: SeDebugPrivilege 4012 incognito.exe
Token: SeDebugPrivilege 1216 Incognito.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Incognito.exe

pid process

1216 Incognito.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Incognito.exe

pid process

1216 Incognito.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Incognito.exe

pid process

1216 Incognito.exe

pid	process
1216	Incognito.exe

pid	process
3424	schtasks.exe
196	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	4012	incognito.exe
Token: SeDebugPrivilege	1216	Incognito.exe

pid	process
1216	Incognito.exe

pid	process
1216	Incognito.exe

pid	process
1216	Incognito.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

incognito.exeIncognito.exe

description	pid	process	target process
PID 4012 wrote to memory of 3424	4012	incognito.exe	schtasks.exe
PID 4012 wrote to memory of 3424	4012	incognito.exe	schtasks.exe
PID 4012 wrote to memory of 1216	4012	incognito.exe	Incognito.exe
PID 4012 wrote to memory of 1216	4012	incognito.exe	Incognito.exe
PID 1216 wrote to memory of 196	1216	Incognito.exe	schtasks.exe
PID 1216 wrote to memory of 196	1216	Incognito.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\incognito.exe
"C:\Users\Admin\AppData\Local\Temp\incognito.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4012

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Incognito.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:3424

C:\Users\Admin\AppData\Roaming\SubDir\Incognito.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Incognito.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Incognito.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:196

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Incognito.exe.log
Filesize
1KB

MD5
d63ff49d7c92016feb39812e4db10419

SHA1
2307d5e35ca9864ffefc93acf8573ea995ba189b

SHA256
375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

SHA512
00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Incognito.exe
Filesize
3.1MB

MD5
d56706ab10b8ec541dc89d0d430503e6

SHA1
28d163151f6be7e38932bab63ec66cdfef2af3c2

SHA256
17b628d201487fd1986f872585e31ea259e7b6e646f902bad75489b3ac056859

SHA512
f51fcf15d5e9ae0347317b59a8f24689aae9e74549718c2bfb61590abc8cba358b169deca1e7897d5d58a2ed954672dbcea288a44a7a737507f703a3850800c2

Download Submit
memory/1216-11-0x00007FF878840000-0x00007FF87922C000-memory.dmp

Filesize
9.9MB

Download
memory/1216-12-0x00007FF878840000-0x00007FF87922C000-memory.dmp

Filesize
9.9MB

Download
memory/1216-14-0x000000001C4E0000-0x000000001C592000-memory.dmp

Filesize
712KB

Download
memory/1216-13-0x000000001C3D0000-0x000000001C420000-memory.dmp

Filesize
320KB

Download
memory/1216-15-0x00007FF878840000-0x00007FF87922C000-memory.dmp

Filesize
9.9MB

Download
memory/4012-0-0x00007FF878843000-0x00007FF878844000-memory.dmp

Filesize
4KB

Download
memory/4012-1-0x0000000000390000-0x00000000006B4000-memory.dmp

Filesize
3.1MB

Download
memory/4012-2-0x00007FF878840000-0x00007FF87922C000-memory.dmp

Filesize
9.9MB

Download
memory/4012-10-0x00007FF878840000-0x00007FF87922C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads