quasar | 2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220

Analysis

max time kernel
225s
max time network
255s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
03-06-2024 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Silent-Skull.exe
Size

348KB
MD5

8436d16727f4b911f5480809103baa87
SHA1

50a1b81af0bf85af5a3ef841fe49746675313120
SHA256

2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220
SHA512

ae668799e2caca582c437271e7ee51c5d679a64a7dec26e4a31909bf948d6c9f0d467a2d39b625af8471267431adeec70b89513100690c6937aae21e1b6c521d
SSDEEP

3072:9FxkhjvK3tFGW8jrQ+G/3NFZLZICSAr0EXZtiNLBPp64PFvqv5bnux7E3MpdMGTE:9LL3HRsM+OFZL2HL7CRbu+8gYdfDIui

Score

10^/10

quasar client spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Client

runderscore00-61208.portmap.host:61208

Mutex

QSR_MUTEX_q1SPcFNLEQ1FIcq9Po

Attributes

encryption_key
qQYEXzkyhZKvRSzcxALx
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1680-1-0x00000000004D0000-0x000000000052E000-memory.dmp	family_quasar

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

952 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Silent-Skull.exe

description pid process

Token: SeDebugPrivilege 1680 Silent-Skull.exe

flow	ioc
1	ip-api.com

pid	process
952	PING.EXE

description	pid	process
Token: SeDebugPrivilege	1680	Silent-Skull.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Silent-Skull.execmd.exe

description	pid	process	target process
PID 1680 wrote to memory of 1400	1680	Silent-Skull.exe	cmd.exe
PID 1680 wrote to memory of 1400	1680	Silent-Skull.exe	cmd.exe
PID 1680 wrote to memory of 1400	1680	Silent-Skull.exe	cmd.exe
PID 1400 wrote to memory of 4908	1400	cmd.exe	chcp.com
PID 1400 wrote to memory of 4908	1400	cmd.exe	chcp.com
PID 1400 wrote to memory of 4908	1400	cmd.exe	chcp.com
PID 1400 wrote to memory of 952	1400	cmd.exe	PING.EXE
PID 1400 wrote to memory of 952	1400	cmd.exe	PING.EXE
PID 1400 wrote to memory of 952	1400	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\Silent-Skull.exe
"C:\Users\Admin\AppData\Local\Temp\Silent-Skull.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3AmYghhp9oRd.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:4908

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
3⤵
- Runs ping.exe
PID:952

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3AmYghhp9oRd.bat
Filesize
264B

MD5
49f4f48558134679737faed107d530ab

SHA1
0d6693d186ccba268493750232f74a785fcdfdc8

SHA256
7251efdbdc9a894ba9a6ac7fd51c86e965d135e56ef24b597e4afc8bd2524580

SHA512
3063652ca667ba0bdd799e3a0e43802eea09c55b333e1c6133c652073ae6e688e2bbddda18f66e1748cf74f2e1a7875c3bdad4fe0b66035164f8cf15d98c2efa

Download Submit
memory/1680-6-0x0000000005A00000-0x0000000005A12000-memory.dmp

Filesize
72KB

Download
memory/1680-2-0x00000000052E0000-0x00000000057DE000-memory.dmp

Filesize
5.0MB

Download
memory/1680-3-0x0000000004E80000-0x0000000004F12000-memory.dmp

Filesize
584KB

Download
memory/1680-4-0x0000000073910000-0x0000000073FFE000-memory.dmp

Filesize
6.9MB

Download
memory/1680-5-0x0000000004DE0000-0x0000000004E46000-memory.dmp

Filesize
408KB

Download
memory/1680-0-0x000000007391E000-0x000000007391F000-memory.dmp

Filesize
4KB

Download
memory/1680-7-0x0000000005DF0000-0x0000000005E2E000-memory.dmp

Filesize
248KB

Download
memory/1680-8-0x00000000060A0000-0x00000000060AA000-memory.dmp

Filesize
40KB

Download
memory/1680-9-0x000000007391E000-0x000000007391F000-memory.dmp

Filesize
4KB

Download
memory/1680-10-0x0000000073910000-0x0000000073FFE000-memory.dmp

Filesize
6.9MB

Download
memory/1680-1-0x00000000004D0000-0x000000000052E000-memory.dmp

Filesize
376KB

Download
memory/1680-16-0x0000000073910000-0x0000000073FFE000-memory.dmp

Filesize
6.9MB

Download