quasar | 956866f40e28cef19324cb165382d5cd5aee0b67c0cb9dd4a39f5bddc6ac56c4

Analysis

max time kernel
297s
max time network
300s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uni/Uni - Copy (10) - Copy - Copy - Copy.exe
Size

409KB
MD5

b70fdac25a99501e3cae11f1b775249e
SHA1

3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
SHA256

51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
SHA512

43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
SSDEEP

12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

Score

10^/10

quasar seroxen spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

panel-slave.gl.at.ply.gg:57059

panel-slave.gl.at.ply.gg:27892

Mutex

$Sxr-rpL8EItHN3pqIQQVy2

Attributes

encryption_key
Lme7VBS3l58VwLM69PNM
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SeroXen
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2908-1-0x0000000000140000-0x00000000001AC000-memory.dmp	family_quasar
\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
behavioral1/memory/468-12-0x0000000000B20000-0x0000000000B8C000-memory.dmp	family_quasar
behavioral1/memory/1316-29-0x0000000000250000-0x00000000002BC000-memory.dmp	family_quasar
behavioral1/memory/1736-41-0x00000000012E0000-0x000000000134C000-memory.dmp	family_quasar
behavioral1/memory/2744-53-0x00000000012E0000-0x000000000134C000-memory.dmp	family_quasar

Executes dropped EXE 4 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exe

pid process

468 Client.exe
1316 Client.exe
1736 Client.exe
2744 Client.exe
Loads dropped DLL 4 IoCs

Processes:

Uni - Copy (10) - Copy - Copy - Copy.execmd.execmd.execmd.exe

pid process

2908 Uni - Copy (10) - Copy - Copy - Copy.exe
2372 cmd.exe
1980 cmd.exe
2400 cmd.exe
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 api.ipify.org
11 api.ipify.org
15 ip-api.com
17 api.ipify.org
21 ip-api.com
27 ip-api.com
29 api.ipify.org
2 ip-api.com
23 api.ipify.org
8 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

SCHTASKS.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

1848 SCHTASKS.exe
484 schtasks.exe
996 schtasks.exe
1932 schtasks.exe
1756 schtasks.exe
2748 schtasks.exe
Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

272 PING.EXE
700 PING.EXE
2024 PING.EXE
1632 PING.EXE

pid	process
468	Client.exe
1316	Client.exe
1736	Client.exe
2744	Client.exe

pid	process
2908	Uni - Copy (10) - Copy - Copy - Copy.exe
2372	cmd.exe
1980	cmd.exe
2400	cmd.exe

flow	ioc
6	api.ipify.org
11	api.ipify.org
15	ip-api.com
17	api.ipify.org
21	ip-api.com
27	ip-api.com
29	api.ipify.org
2	ip-api.com
23	api.ipify.org
8	ip-api.com

pid	process
1848	SCHTASKS.exe
484	schtasks.exe
996	schtasks.exe
1932	schtasks.exe
1756	schtasks.exe
2748	schtasks.exe

pid	process
272	PING.EXE
700	PING.EXE
2024	PING.EXE
1632	PING.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Uni - Copy (10) - Copy - Copy - Copy.exeClient.exeClient.exeClient.exeClient.exe

description	pid	process
Token: SeDebugPrivilege	2908	Uni - Copy (10) - Copy - Copy - Copy.exe
Token: SeDebugPrivilege	468	Client.exe
Token: SeDebugPrivilege	1316	Client.exe
Token: SeDebugPrivilege	1736	Client.exe
Token: SeDebugPrivilege	2744	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Uni - Copy (10) - Copy - Copy - Copy.exeClient.execmd.exeClient.execmd.exeClient.exe

description	pid	process	target process
PID 2908 wrote to memory of 2748	2908	Uni - Copy (10) - Copy - Copy - Copy.exe	schtasks.exe
PID 2908 wrote to memory of 2748	2908	Uni - Copy (10) - Copy - Copy - Copy.exe	schtasks.exe
PID 2908 wrote to memory of 2748	2908	Uni - Copy (10) - Copy - Copy - Copy.exe	schtasks.exe
PID 2908 wrote to memory of 2748	2908	Uni - Copy (10) - Copy - Copy - Copy.exe	schtasks.exe
PID 2908 wrote to memory of 468	2908	Uni - Copy (10) - Copy - Copy - Copy.exe	Client.exe
PID 2908 wrote to memory of 468	2908	Uni - Copy (10) - Copy - Copy - Copy.exe	Client.exe
PID 2908 wrote to memory of 468	2908	Uni - Copy (10) - Copy - Copy - Copy.exe	Client.exe
PID 2908 wrote to memory of 468	2908	Uni - Copy (10) - Copy - Copy - Copy.exe	Client.exe
PID 2908 wrote to memory of 468	2908	Uni - Copy (10) - Copy - Copy - Copy.exe	Client.exe
PID 2908 wrote to memory of 468	2908	Uni - Copy (10) - Copy - Copy - Copy.exe	Client.exe
PID 2908 wrote to memory of 468	2908	Uni - Copy (10) - Copy - Copy - Copy.exe	Client.exe
PID 2908 wrote to memory of 1848	2908	Uni - Copy (10) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 2908 wrote to memory of 1848	2908	Uni - Copy (10) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 2908 wrote to memory of 1848	2908	Uni - Copy (10) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 2908 wrote to memory of 1848	2908	Uni - Copy (10) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 468 wrote to memory of 484	468	Client.exe	schtasks.exe
PID 468 wrote to memory of 484	468	Client.exe	schtasks.exe
PID 468 wrote to memory of 484	468	Client.exe	schtasks.exe
PID 468 wrote to memory of 484	468	Client.exe	schtasks.exe
PID 468 wrote to memory of 2372	468	Client.exe	cmd.exe
PID 468 wrote to memory of 2372	468	Client.exe	cmd.exe
PID 468 wrote to memory of 2372	468	Client.exe	cmd.exe
PID 468 wrote to memory of 2372	468	Client.exe	cmd.exe
PID 2372 wrote to memory of 764	2372	cmd.exe	chcp.com
PID 2372 wrote to memory of 764	2372	cmd.exe	chcp.com
PID 2372 wrote to memory of 764	2372	cmd.exe	chcp.com
PID 2372 wrote to memory of 764	2372	cmd.exe	chcp.com
PID 2372 wrote to memory of 272	2372	cmd.exe	PING.EXE
PID 2372 wrote to memory of 272	2372	cmd.exe	PING.EXE
PID 2372 wrote to memory of 272	2372	cmd.exe	PING.EXE
PID 2372 wrote to memory of 272	2372	cmd.exe	PING.EXE
PID 2372 wrote to memory of 1316	2372	cmd.exe	Client.exe
PID 2372 wrote to memory of 1316	2372	cmd.exe	Client.exe
PID 2372 wrote to memory of 1316	2372	cmd.exe	Client.exe
PID 2372 wrote to memory of 1316	2372	cmd.exe	Client.exe
PID 2372 wrote to memory of 1316	2372	cmd.exe	Client.exe
PID 2372 wrote to memory of 1316	2372	cmd.exe	Client.exe
PID 2372 wrote to memory of 1316	2372	cmd.exe	Client.exe
PID 1316 wrote to memory of 996	1316	Client.exe	schtasks.exe
PID 1316 wrote to memory of 996	1316	Client.exe	schtasks.exe
PID 1316 wrote to memory of 996	1316	Client.exe	schtasks.exe
PID 1316 wrote to memory of 996	1316	Client.exe	schtasks.exe
PID 1316 wrote to memory of 1980	1316	Client.exe	cmd.exe
PID 1316 wrote to memory of 1980	1316	Client.exe	cmd.exe
PID 1316 wrote to memory of 1980	1316	Client.exe	cmd.exe
PID 1316 wrote to memory of 1980	1316	Client.exe	cmd.exe
PID 1980 wrote to memory of 1500	1980	cmd.exe	chcp.com
PID 1980 wrote to memory of 1500	1980	cmd.exe	chcp.com
PID 1980 wrote to memory of 1500	1980	cmd.exe	chcp.com
PID 1980 wrote to memory of 1500	1980	cmd.exe	chcp.com
PID 1980 wrote to memory of 700	1980	cmd.exe	PING.EXE
PID 1980 wrote to memory of 700	1980	cmd.exe	PING.EXE
PID 1980 wrote to memory of 700	1980	cmd.exe	PING.EXE
PID 1980 wrote to memory of 700	1980	cmd.exe	PING.EXE
PID 1980 wrote to memory of 1736	1980	cmd.exe	Client.exe
PID 1980 wrote to memory of 1736	1980	cmd.exe	Client.exe
PID 1980 wrote to memory of 1736	1980	cmd.exe	Client.exe
PID 1980 wrote to memory of 1736	1980	cmd.exe	Client.exe
PID 1980 wrote to memory of 1736	1980	cmd.exe	Client.exe
PID 1980 wrote to memory of 1736	1980	cmd.exe	Client.exe
PID 1980 wrote to memory of 1736	1980	cmd.exe	Client.exe
PID 1736 wrote to memory of 1932	1736	Client.exe	schtasks.exe
PID 1736 wrote to memory of 1932	1736	Client.exe	schtasks.exe
PID 1736 wrote to memory of 1932	1736	Client.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy - Copy - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy - Copy - Copy.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy - Copy - Copy.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2748

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:484

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\6T2EkNtUzOUj.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:764

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:272

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:996

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\pyiA6stCPfYX.bat" "
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\chcp.com
chcp 65001
6⤵
PID:1500

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:700

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
7⤵
- Creates scheduled task(s)
PID:1932

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\CmEgFPjsq3qq.bat" "
7⤵
- Loads dropped DLL
PID:2400

C:\Windows\SysWOW64\chcp.com
chcp 65001
8⤵
PID:2136

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:2024

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
9⤵
- Creates scheduled task(s)
PID:1756

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\T4leozn94eXL.bat" "
9⤵
PID:1336

C:\Windows\SysWOW64\chcp.com
chcp 65001
10⤵
PID:1280

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
10⤵
- Runs ping.exe
PID:1632

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Uni - Copy (10) - Copy - Copy - Copy.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy - Copy - Copy.exe'" /sc onlogon /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:1848

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6T2EkNtUzOUj.bat
Filesize
207B

MD5
5ec3fbd2c6aac6cf9f5fc745c9ae2b9e

SHA1
669bb4e63d107cbe91b9022743f6d145b7321fac

SHA256
7b8bfd22562fc9ded9e9d5ddc7230048475845067d49a9d1366eef4431361ee5

SHA512
9c22716d22c65691d5d5224d0d933fa8bd45baa77f45053e4e90d84d227e61eeb32e5ef52d51a04a20ea5b72edf480287527983d5848e84331662ea09184420d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CmEgFPjsq3qq.bat
Filesize
207B

MD5
fdfc67bedec0dbad7660438161c303a8

SHA1
88e866a3c4820ce482322ac0dd2518f33fef0d41

SHA256
33723c6e0ddef8c60fa0ece25a1388cf75f619eea3c2d7a131d445f379cb9321

SHA512
6a9e311d7dc3f79ff0e9d501406a8d871f696a45ff0b8f2bc8d8ac10399eaffdec4ce94e288e366246dc81088b746e08da8ee402905fc892adcd51bad1fbd800

Download Submit
C:\Users\Admin\AppData\Local\Temp\T4leozn94eXL.bat
Filesize
207B

MD5
4f52c6a4dc66d74c137202182e0c6b13

SHA1
6b66646f79f80e91fc02a35edfb5cf317fc3835e

SHA256
cf8f09edc904e6e4e4af23037d7d1c38b07199ab04746f7971a7b17cc1cd304b

SHA512
027a6ddc485048a597302706f2ec84178ca065bac3b39cca882296e3d90ca19efd390aff539e6bf50e1836e048cd7352d596df53c7fc862fdfccbd745555abbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\pyiA6stCPfYX.bat
Filesize
207B

MD5
8098ba56d72222f8e28379eec0a1a19a

SHA1
d1cf0531a3d6dd72ebaaa26b66048731f5c2161a

SHA256
87d0bf9cf7b417cd12eea26fc7e756739fb265327c6e5f29a5cbf752bf212c7b

SHA512
5db5ad11d197884a8e06598e220600a64953b39ce03990b8ef854c032776aa642b7b5c54d49471e8619f53348495d6ddeeafcc8f548169d9a3b31f073c36c926

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
409KB

MD5
b70fdac25a99501e3cae11f1b775249e

SHA1
3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

SHA256
51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

SHA512
43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

Download Submit
memory/468-26-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/468-13-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/468-14-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/468-12-0x0000000000B20000-0x0000000000B8C000-memory.dmp

Filesize
432KB

Download
memory/468-16-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/1316-29-0x0000000000250000-0x00000000002BC000-memory.dmp

Filesize
432KB

Download
memory/1736-41-0x00000000012E0000-0x000000000134C000-memory.dmp

Filesize
432KB

Download
memory/2744-53-0x00000000012E0000-0x000000000134C000-memory.dmp

Filesize
432KB

Download
memory/2908-15-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-3-0x000000007420E000-0x000000007420F000-memory.dmp

Filesize
4KB

Download
memory/2908-0-0x000000007420E000-0x000000007420F000-memory.dmp

Filesize
4KB

Download
memory/2908-2-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-4-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-1-0x0000000000140000-0x00000000001AC000-memory.dmp

Filesize
432KB

Download