quasar | 34488fe08fe3d2e51142541f8ef6ac0f912ffd5d2ea5ea35cd93c0be7a76e66e

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Internal.exe
Size

3.1MB
MD5

be5b55bb6d4f8664c9bf666d6c0a7091
SHA1

61d5d4e5ef19f45534b0cee932bf6c221a4d894e
SHA256

34488fe08fe3d2e51142541f8ef6ac0f912ffd5d2ea5ea35cd93c0be7a76e66e
SHA512

55e1ade5ae25cc8a6ba4b78ea67f1f707a805efe30299876182a957cbc69db3e5e817d435f94b437a93ef2395b17dcd879754b4e22ebaa0e7c94771735763122
SSDEEP

49152:LvEuf2NUaNmwzPWlvdaKM7ZxTwqSeEErHIk/uVWoGdRcTHHB72eh2NT:Lvzf2NUaNmwzPWlvdaB7ZxTwqSeSE

Score

10^/10

quasar svchost spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

svchost

192.168.0.120:4782

Mutex

9fde5542-6125-4272-a814-17dab286fa9f

Attributes

encryption_key
7D71500E67A8C0039FEB5CC2A22FA4DAC65EF711
install_name
svchost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svchost
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1368-1-0x0000000000890000-0x0000000000BB4000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe	family_quasar

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

3588 svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2156 schtasks.exe
4072 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Internal.exesvchost.exe

description pid process

Token: SeDebugPrivilege 1368 Internal.exe
Token: SeDebugPrivilege 3588 svchost.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

svchost.exe

pid process

3588 svchost.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

svchost.exe

pid process

3588 svchost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid process

3588 svchost.exe

pid	process
3588	svchost.exe

pid	process
2156	schtasks.exe
4072	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1368	Internal.exe
Token: SeDebugPrivilege	3588	svchost.exe

pid	process
3588	svchost.exe

pid	process
3588	svchost.exe

pid	process
3588	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Internal.exesvchost.exe

description	pid	process	target process
PID 1368 wrote to memory of 2156	1368	Internal.exe	schtasks.exe
PID 1368 wrote to memory of 2156	1368	Internal.exe	schtasks.exe
PID 1368 wrote to memory of 3588	1368	Internal.exe	svchost.exe
PID 1368 wrote to memory of 3588	1368	Internal.exe	svchost.exe
PID 3588 wrote to memory of 4072	3588	svchost.exe	schtasks.exe
PID 3588 wrote to memory of 4072	3588	svchost.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Internal.exe
"C:\Users\Admin\AppData\Local\Temp\Internal.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2156

C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3588

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:4072

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
Filesize
3.1MB

MD5
be5b55bb6d4f8664c9bf666d6c0a7091

SHA1
61d5d4e5ef19f45534b0cee932bf6c221a4d894e

SHA256
34488fe08fe3d2e51142541f8ef6ac0f912ffd5d2ea5ea35cd93c0be7a76e66e

SHA512
55e1ade5ae25cc8a6ba4b78ea67f1f707a805efe30299876182a957cbc69db3e5e817d435f94b437a93ef2395b17dcd879754b4e22ebaa0e7c94771735763122

Download Submit
memory/1368-0-0x00007FFB1AA53000-0x00007FFB1AA55000-memory.dmp

Filesize
8KB

Download
memory/1368-1-0x0000000000890000-0x0000000000BB4000-memory.dmp

Filesize
3.1MB

Download
memory/1368-2-0x00007FFB1AA50000-0x00007FFB1B511000-memory.dmp

Filesize
10.8MB

Download
memory/1368-9-0x00007FFB1AA50000-0x00007FFB1B511000-memory.dmp

Filesize
10.8MB

Download
memory/3588-10-0x00007FFB1AA50000-0x00007FFB1B511000-memory.dmp

Filesize
10.8MB

Download
memory/3588-11-0x000000001CCF0000-0x000000001CD40000-memory.dmp

Filesize
320KB

Download
memory/3588-12-0x000000001CE00000-0x000000001CEB2000-memory.dmp

Filesize
712KB

Download
memory/3588-13-0x00007FFB1AA50000-0x00007FFB1B511000-memory.dmp

Filesize
10.8MB

Download