quasar | 956866f40e28cef19324cb165382d5cd5aee0b67c0cb9dd4a39f5bddc6ac56c4

Analysis

max time kernel
297s
max time network
300s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uni/Uni - Copy (13) - Copy - Copy - Copy.exe
Size

409KB
MD5

b70fdac25a99501e3cae11f1b775249e
SHA1

3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
SHA256

51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
SHA512

43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
SSDEEP

12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

Score

10^/10

quasar seroxen spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

panel-slave.gl.at.ply.gg:57059

panel-slave.gl.at.ply.gg:27892

Mutex

$Sxr-rpL8EItHN3pqIQQVy2

Attributes

encryption_key
Lme7VBS3l58VwLM69PNM
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SeroXen
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

Processes:

resource	yara_rule
behavioral19/memory/1740-1-0x00000000010C0000-0x000000000112C000-memory.dmp	family_quasar
\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
behavioral19/memory/2352-12-0x00000000002F0000-0x000000000035C000-memory.dmp	family_quasar
behavioral19/memory/1940-29-0x0000000000BE0000-0x0000000000C4C000-memory.dmp	family_quasar
behavioral19/memory/2196-41-0x0000000000CC0000-0x0000000000D2C000-memory.dmp	family_quasar
behavioral19/memory/2624-53-0x00000000011D0000-0x000000000123C000-memory.dmp	family_quasar

Executes dropped EXE 4 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exe

pid process

2352 Client.exe
1940 Client.exe
2196 Client.exe
2624 Client.exe
Loads dropped DLL 4 IoCs

Processes:

Uni - Copy (13) - Copy - Copy - Copy.execmd.execmd.execmd.exe

pid process

1740 Uni - Copy (13) - Copy - Copy - Copy.exe
2100 cmd.exe
2932 cmd.exe
2428 cmd.exe
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ip-api.com
23 api.ipify.org
27 ip-api.com
29 api.ipify.org
2 ip-api.com
6 api.ipify.org
11 api.ipify.org
8 ip-api.com
17 api.ipify.org
21 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeSCHTASKS.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2576 schtasks.exe
468 SCHTASKS.exe
632 schtasks.exe
2028 schtasks.exe
2676 schtasks.exe
2468 schtasks.exe
Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

2084 PING.EXE
2280 PING.EXE
2784 PING.EXE
1228 PING.EXE

pid	process
2352	Client.exe
1940	Client.exe
2196	Client.exe
2624	Client.exe

pid	process
1740	Uni - Copy (13) - Copy - Copy - Copy.exe
2100	cmd.exe
2932	cmd.exe
2428	cmd.exe

flow	ioc
15	ip-api.com
23	api.ipify.org
27	ip-api.com
29	api.ipify.org
2	ip-api.com
6	api.ipify.org
11	api.ipify.org
8	ip-api.com
17	api.ipify.org
21	ip-api.com

pid	process
2576	schtasks.exe
468	SCHTASKS.exe
632	schtasks.exe
2028	schtasks.exe
2676	schtasks.exe
2468	schtasks.exe

pid	process
2084	PING.EXE
2280	PING.EXE
2784	PING.EXE
1228	PING.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Uni - Copy (13) - Copy - Copy - Copy.exeClient.exeClient.exeClient.exeClient.exe

description	pid	process
Token: SeDebugPrivilege	1740	Uni - Copy (13) - Copy - Copy - Copy.exe
Token: SeDebugPrivilege	2352	Client.exe
Token: SeDebugPrivilege	1940	Client.exe
Token: SeDebugPrivilege	2196	Client.exe
Token: SeDebugPrivilege	2624	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Uni - Copy (13) - Copy - Copy - Copy.exeClient.execmd.exeClient.execmd.exeClient.exe

description	pid	process	target process
PID 1740 wrote to memory of 2576	1740	Uni - Copy (13) - Copy - Copy - Copy.exe	schtasks.exe
PID 1740 wrote to memory of 2576	1740	Uni - Copy (13) - Copy - Copy - Copy.exe	schtasks.exe
PID 1740 wrote to memory of 2576	1740	Uni - Copy (13) - Copy - Copy - Copy.exe	schtasks.exe
PID 1740 wrote to memory of 2576	1740	Uni - Copy (13) - Copy - Copy - Copy.exe	schtasks.exe
PID 1740 wrote to memory of 2352	1740	Uni - Copy (13) - Copy - Copy - Copy.exe	Client.exe
PID 1740 wrote to memory of 2352	1740	Uni - Copy (13) - Copy - Copy - Copy.exe	Client.exe
PID 1740 wrote to memory of 2352	1740	Uni - Copy (13) - Copy - Copy - Copy.exe	Client.exe
PID 1740 wrote to memory of 2352	1740	Uni - Copy (13) - Copy - Copy - Copy.exe	Client.exe
PID 1740 wrote to memory of 2352	1740	Uni - Copy (13) - Copy - Copy - Copy.exe	Client.exe
PID 1740 wrote to memory of 2352	1740	Uni - Copy (13) - Copy - Copy - Copy.exe	Client.exe
PID 1740 wrote to memory of 2352	1740	Uni - Copy (13) - Copy - Copy - Copy.exe	Client.exe
PID 1740 wrote to memory of 468	1740	Uni - Copy (13) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 1740 wrote to memory of 468	1740	Uni - Copy (13) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 1740 wrote to memory of 468	1740	Uni - Copy (13) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 1740 wrote to memory of 468	1740	Uni - Copy (13) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 2352 wrote to memory of 632	2352	Client.exe	schtasks.exe
PID 2352 wrote to memory of 632	2352	Client.exe	schtasks.exe
PID 2352 wrote to memory of 632	2352	Client.exe	schtasks.exe
PID 2352 wrote to memory of 632	2352	Client.exe	schtasks.exe
PID 2352 wrote to memory of 2100	2352	Client.exe	cmd.exe
PID 2352 wrote to memory of 2100	2352	Client.exe	cmd.exe
PID 2352 wrote to memory of 2100	2352	Client.exe	cmd.exe
PID 2352 wrote to memory of 2100	2352	Client.exe	cmd.exe
PID 2100 wrote to memory of 2344	2100	cmd.exe	chcp.com
PID 2100 wrote to memory of 2344	2100	cmd.exe	chcp.com
PID 2100 wrote to memory of 2344	2100	cmd.exe	chcp.com
PID 2100 wrote to memory of 2344	2100	cmd.exe	chcp.com
PID 2100 wrote to memory of 2084	2100	cmd.exe	PING.EXE
PID 2100 wrote to memory of 2084	2100	cmd.exe	PING.EXE
PID 2100 wrote to memory of 2084	2100	cmd.exe	PING.EXE
PID 2100 wrote to memory of 2084	2100	cmd.exe	PING.EXE
PID 2100 wrote to memory of 1940	2100	cmd.exe	Client.exe
PID 2100 wrote to memory of 1940	2100	cmd.exe	Client.exe
PID 2100 wrote to memory of 1940	2100	cmd.exe	Client.exe
PID 2100 wrote to memory of 1940	2100	cmd.exe	Client.exe
PID 2100 wrote to memory of 1940	2100	cmd.exe	Client.exe
PID 2100 wrote to memory of 1940	2100	cmd.exe	Client.exe
PID 2100 wrote to memory of 1940	2100	cmd.exe	Client.exe
PID 1940 wrote to memory of 2028	1940	Client.exe	schtasks.exe
PID 1940 wrote to memory of 2028	1940	Client.exe	schtasks.exe
PID 1940 wrote to memory of 2028	1940	Client.exe	schtasks.exe
PID 1940 wrote to memory of 2028	1940	Client.exe	schtasks.exe
PID 1940 wrote to memory of 2932	1940	Client.exe	cmd.exe
PID 1940 wrote to memory of 2932	1940	Client.exe	cmd.exe
PID 1940 wrote to memory of 2932	1940	Client.exe	cmd.exe
PID 1940 wrote to memory of 2932	1940	Client.exe	cmd.exe
PID 2932 wrote to memory of 952	2932	cmd.exe	chcp.com
PID 2932 wrote to memory of 952	2932	cmd.exe	chcp.com
PID 2932 wrote to memory of 952	2932	cmd.exe	chcp.com
PID 2932 wrote to memory of 952	2932	cmd.exe	chcp.com
PID 2932 wrote to memory of 2280	2932	cmd.exe	PING.EXE
PID 2932 wrote to memory of 2280	2932	cmd.exe	PING.EXE
PID 2932 wrote to memory of 2280	2932	cmd.exe	PING.EXE
PID 2932 wrote to memory of 2280	2932	cmd.exe	PING.EXE
PID 2932 wrote to memory of 2196	2932	cmd.exe	Client.exe
PID 2932 wrote to memory of 2196	2932	cmd.exe	Client.exe
PID 2932 wrote to memory of 2196	2932	cmd.exe	Client.exe
PID 2932 wrote to memory of 2196	2932	cmd.exe	Client.exe
PID 2932 wrote to memory of 2196	2932	cmd.exe	Client.exe
PID 2932 wrote to memory of 2196	2932	cmd.exe	Client.exe
PID 2932 wrote to memory of 2196	2932	cmd.exe	Client.exe
PID 2196 wrote to memory of 2676	2196	Client.exe	schtasks.exe
PID 2196 wrote to memory of 2676	2196	Client.exe	schtasks.exe
PID 2196 wrote to memory of 2676	2196	Client.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (13) - Copy - Copy - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (13) - Copy - Copy - Copy.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (13) - Copy - Copy - Copy.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2576

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:632

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\vQs0hPx6e9kx.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:2344

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:2084

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:2028

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\27tA26kvjHVA.bat" "
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\SysWOW64\chcp.com
chcp 65001
6⤵
PID:952

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:2280

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
7⤵
- Creates scheduled task(s)
PID:2676

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\lca6Pckc9ZZy.bat" "
7⤵
- Loads dropped DLL
PID:2428

C:\Windows\SysWOW64\chcp.com
chcp 65001
8⤵
PID:2996

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:2784

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
9⤵
- Creates scheduled task(s)
PID:2468

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\jEkNXyoCu5At.bat" "
9⤵
PID:1384

C:\Windows\SysWOW64\chcp.com
chcp 65001
10⤵
PID:2224

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
10⤵
- Runs ping.exe
PID:1228

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Uni - Copy (13) - Copy - Copy - Copy.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (13) - Copy - Copy - Copy.exe'" /sc onlogon /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:468

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\27tA26kvjHVA.bat
Filesize
207B

MD5
cb2020201e6cb429842162c08eaee42b

SHA1
59d0e33f71ac43bb3afdbf026ff9f9b4b35422ce

SHA256
bb7e6c621c3b2e1882c50739ed95c186d251dfedfa0706558f611f43955d34a9

SHA512
b716077917dbe60c978d88403188f3a290f94ea93e120baaaed2036a46f10266246630165e0821fefb0a60f3aa0394e459ba6b92fcb606ac71a65e1586b74e74

Download Submit
C:\Users\Admin\AppData\Local\Temp\jEkNXyoCu5At.bat
Filesize
207B

MD5
35ad33abbd779adee91b5146d0e8bf70

SHA1
1aa118bb05d9bbcc532236fddff9712c508f486e

SHA256
956270d66e71be16e833415c4bfb889b8e0ec9297520c59f6e10d44c972401a6

SHA512
815447e70331e7276f8fbdbb9cc96914a2dc73ce223e4c918c409e9aa2b2917416f7f5e99da78b3b06096ba1ef91e9a8f3975701420fb715ff9857d76af5d66c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lca6Pckc9ZZy.bat
Filesize
207B

MD5
1f29ec195ae8db97e5983603adf2bcab

SHA1
76befdaed28c4269a40b8a08b24100e0fbbf73a6

SHA256
38ccb5a1d4e9ac6cde0421edfae74a69647e4961544fb5f8bb1abe914b699461

SHA512
d1c63f2fa77101fd820aac0c0cd0d4697404a33ce7662f8fdec8d11e31a3315e9988b651cdfe56a854fefa9c129a1ebfc79cfd5d16963887d8c186e39c0ba7aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\vQs0hPx6e9kx.bat
Filesize
207B

MD5
b1d795f0300778b35f106927c364661b

SHA1
b875b24d6cd6cf2806381338d8fc73bd859a579f

SHA256
207548cd87b0e84eead9daf1bdeb174e11ff7806677b9da7c4fbe67ef7a955b7

SHA512
c2dad8ad1dc615a2f5512ec8554fc4e661f0f591702b83b4e2bd4606d3bb806185e28b4093fe600e264aeb147e692668f1f96a736932721ea730b7bf81e5aaf1

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
409KB

MD5
b70fdac25a99501e3cae11f1b775249e

SHA1
3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

SHA256
51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

SHA512
43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

Download Submit
memory/1740-3-0x000000007434E000-0x000000007434F000-memory.dmp

Filesize
4KB

Download
memory/1740-4-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/1740-0-0x000000007434E000-0x000000007434F000-memory.dmp

Filesize
4KB

Download
memory/1740-15-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/1740-2-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/1740-1-0x00000000010C0000-0x000000000112C000-memory.dmp

Filesize
432KB

Download
memory/1940-29-0x0000000000BE0000-0x0000000000C4C000-memory.dmp

Filesize
432KB

Download
memory/2196-41-0x0000000000CC0000-0x0000000000D2C000-memory.dmp

Filesize
432KB

Download
memory/2352-12-0x00000000002F0000-0x000000000035C000-memory.dmp

Filesize
432KB

Download
memory/2352-26-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2352-16-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2352-14-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2352-13-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2624-53-0x00000000011D0000-0x000000000123C000-memory.dmp

Filesize
432KB

Download