quasar | 956866f40e28cef19324cb165382d5cd5aee0b67c0cb9dd4a39f5bddc6ac56c4

Analysis

max time kernel
297s
max time network
297s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uni/Uni - Copy (12) - Copy - Copy.exe
Size

409KB
MD5

b70fdac25a99501e3cae11f1b775249e
SHA1

3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
SHA256

51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
SHA512

43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
SSDEEP

12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

Score

10^/10

quasar seroxen spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

panel-slave.gl.at.ply.gg:57059

panel-slave.gl.at.ply.gg:27892

Mutex

$Sxr-rpL8EItHN3pqIQQVy2

Attributes

encryption_key
Lme7VBS3l58VwLM69PNM
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SeroXen
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

Processes:

resource	yara_rule
behavioral15/memory/108-1-0x00000000010B0000-0x000000000111C000-memory.dmp	family_quasar
\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
behavioral15/memory/672-28-0x0000000001260000-0x00000000012CC000-memory.dmp	family_quasar
behavioral15/memory/1452-40-0x0000000001260000-0x00000000012CC000-memory.dmp	family_quasar
behavioral15/memory/2452-52-0x0000000001260000-0x00000000012CC000-memory.dmp	family_quasar

Executes dropped EXE 4 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exe

pid process

2904 Client.exe
672 Client.exe
1452 Client.exe
2452 Client.exe
Loads dropped DLL 4 IoCs

Processes:

Uni - Copy (12) - Copy - Copy.execmd.execmd.execmd.exe

pid process

108 Uni - Copy (12) - Copy - Copy.exe
2884 cmd.exe
928 cmd.exe
2732 cmd.exe
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
11 api.ipify.org
15 ip-api.com
17 api.ipify.org
21 ip-api.com
23 api.ipify.org
6 api.ipify.org
8 ip-api.com
27 ip-api.com
29 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

SCHTASKS.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

1624 SCHTASKS.exe
2100 schtasks.exe
1604 schtasks.exe
2544 schtasks.exe
2392 schtasks.exe
2892 schtasks.exe
Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

1936 PING.EXE
2320 PING.EXE
2988 PING.EXE
2780 PING.EXE

pid	process
2904	Client.exe
672	Client.exe
1452	Client.exe
2452	Client.exe

pid	process
108	Uni - Copy (12) - Copy - Copy.exe
2884	cmd.exe
928	cmd.exe
2732	cmd.exe

flow	ioc
2	ip-api.com
11	api.ipify.org
15	ip-api.com
17	api.ipify.org
21	ip-api.com
23	api.ipify.org
6	api.ipify.org
8	ip-api.com
27	ip-api.com
29	api.ipify.org

pid	process
1624	SCHTASKS.exe
2100	schtasks.exe
1604	schtasks.exe
2544	schtasks.exe
2392	schtasks.exe
2892	schtasks.exe

pid	process
1936	PING.EXE
2320	PING.EXE
2988	PING.EXE
2780	PING.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Uni - Copy (12) - Copy - Copy.exeClient.exeClient.exeClient.exeClient.exe

description	pid	process
Token: SeDebugPrivilege	108	Uni - Copy (12) - Copy - Copy.exe
Token: SeDebugPrivilege	2904	Client.exe
Token: SeDebugPrivilege	672	Client.exe
Token: SeDebugPrivilege	1452	Client.exe
Token: SeDebugPrivilege	2452	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Uni - Copy (12) - Copy - Copy.exeClient.execmd.exeClient.execmd.exeClient.exe

description	pid	process	target process
PID 108 wrote to memory of 2892	108	Uni - Copy (12) - Copy - Copy.exe	schtasks.exe
PID 108 wrote to memory of 2892	108	Uni - Copy (12) - Copy - Copy.exe	schtasks.exe
PID 108 wrote to memory of 2892	108	Uni - Copy (12) - Copy - Copy.exe	schtasks.exe
PID 108 wrote to memory of 2892	108	Uni - Copy (12) - Copy - Copy.exe	schtasks.exe
PID 108 wrote to memory of 2904	108	Uni - Copy (12) - Copy - Copy.exe	Client.exe
PID 108 wrote to memory of 2904	108	Uni - Copy (12) - Copy - Copy.exe	Client.exe
PID 108 wrote to memory of 2904	108	Uni - Copy (12) - Copy - Copy.exe	Client.exe
PID 108 wrote to memory of 2904	108	Uni - Copy (12) - Copy - Copy.exe	Client.exe
PID 108 wrote to memory of 2904	108	Uni - Copy (12) - Copy - Copy.exe	Client.exe
PID 108 wrote to memory of 2904	108	Uni - Copy (12) - Copy - Copy.exe	Client.exe
PID 108 wrote to memory of 2904	108	Uni - Copy (12) - Copy - Copy.exe	Client.exe
PID 108 wrote to memory of 1624	108	Uni - Copy (12) - Copy - Copy.exe	SCHTASKS.exe
PID 108 wrote to memory of 1624	108	Uni - Copy (12) - Copy - Copy.exe	SCHTASKS.exe
PID 108 wrote to memory of 1624	108	Uni - Copy (12) - Copy - Copy.exe	SCHTASKS.exe
PID 108 wrote to memory of 1624	108	Uni - Copy (12) - Copy - Copy.exe	SCHTASKS.exe
PID 2904 wrote to memory of 2100	2904	Client.exe	schtasks.exe
PID 2904 wrote to memory of 2100	2904	Client.exe	schtasks.exe
PID 2904 wrote to memory of 2100	2904	Client.exe	schtasks.exe
PID 2904 wrote to memory of 2100	2904	Client.exe	schtasks.exe
PID 2904 wrote to memory of 2884	2904	Client.exe	cmd.exe
PID 2904 wrote to memory of 2884	2904	Client.exe	cmd.exe
PID 2904 wrote to memory of 2884	2904	Client.exe	cmd.exe
PID 2904 wrote to memory of 2884	2904	Client.exe	cmd.exe
PID 2884 wrote to memory of 2412	2884	cmd.exe	chcp.com
PID 2884 wrote to memory of 2412	2884	cmd.exe	chcp.com
PID 2884 wrote to memory of 2412	2884	cmd.exe	chcp.com
PID 2884 wrote to memory of 2412	2884	cmd.exe	chcp.com
PID 2884 wrote to memory of 1936	2884	cmd.exe	PING.EXE
PID 2884 wrote to memory of 1936	2884	cmd.exe	PING.EXE
PID 2884 wrote to memory of 1936	2884	cmd.exe	PING.EXE
PID 2884 wrote to memory of 1936	2884	cmd.exe	PING.EXE
PID 2884 wrote to memory of 672	2884	cmd.exe	Client.exe
PID 2884 wrote to memory of 672	2884	cmd.exe	Client.exe
PID 2884 wrote to memory of 672	2884	cmd.exe	Client.exe
PID 2884 wrote to memory of 672	2884	cmd.exe	Client.exe
PID 2884 wrote to memory of 672	2884	cmd.exe	Client.exe
PID 2884 wrote to memory of 672	2884	cmd.exe	Client.exe
PID 2884 wrote to memory of 672	2884	cmd.exe	Client.exe
PID 672 wrote to memory of 1604	672	Client.exe	schtasks.exe
PID 672 wrote to memory of 1604	672	Client.exe	schtasks.exe
PID 672 wrote to memory of 1604	672	Client.exe	schtasks.exe
PID 672 wrote to memory of 1604	672	Client.exe	schtasks.exe
PID 672 wrote to memory of 928	672	Client.exe	cmd.exe
PID 672 wrote to memory of 928	672	Client.exe	cmd.exe
PID 672 wrote to memory of 928	672	Client.exe	cmd.exe
PID 672 wrote to memory of 928	672	Client.exe	cmd.exe
PID 928 wrote to memory of 736	928	cmd.exe	chcp.com
PID 928 wrote to memory of 736	928	cmd.exe	chcp.com
PID 928 wrote to memory of 736	928	cmd.exe	chcp.com
PID 928 wrote to memory of 736	928	cmd.exe	chcp.com
PID 928 wrote to memory of 2320	928	cmd.exe	PING.EXE
PID 928 wrote to memory of 2320	928	cmd.exe	PING.EXE
PID 928 wrote to memory of 2320	928	cmd.exe	PING.EXE
PID 928 wrote to memory of 2320	928	cmd.exe	PING.EXE
PID 928 wrote to memory of 1452	928	cmd.exe	Client.exe
PID 928 wrote to memory of 1452	928	cmd.exe	Client.exe
PID 928 wrote to memory of 1452	928	cmd.exe	Client.exe
PID 928 wrote to memory of 1452	928	cmd.exe	Client.exe
PID 928 wrote to memory of 1452	928	cmd.exe	Client.exe
PID 928 wrote to memory of 1452	928	cmd.exe	Client.exe
PID 928 wrote to memory of 1452	928	cmd.exe	Client.exe
PID 1452 wrote to memory of 2544	1452	Client.exe	schtasks.exe
PID 1452 wrote to memory of 2544	1452	Client.exe	schtasks.exe
PID 1452 wrote to memory of 2544	1452	Client.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (12) - Copy - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (12) - Copy - Copy.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:108

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (12) - Copy - Copy.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2892

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2100

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\74cDYAeB5dSk.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:2412

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:1936

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\t8CTZ4bjcl52.bat" "
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:928

C:\Windows\SysWOW64\chcp.com
chcp 65001
6⤵
PID:736

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:2320

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
7⤵
- Creates scheduled task(s)
PID:2544

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\CvtFurH6WKfS.bat" "
7⤵
- Loads dropped DLL
PID:2732

C:\Windows\SysWOW64\chcp.com
chcp 65001
8⤵
PID:2516

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:2988

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
9⤵
- Creates scheduled task(s)
PID:2392

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\mLjI31YZczax.bat" "
9⤵
PID:1328

C:\Windows\SysWOW64\chcp.com
chcp 65001
10⤵
PID:2040

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
10⤵
- Runs ping.exe
PID:2780

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Uni - Copy (12) - Copy - Copy.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (12) - Copy - Copy.exe'" /sc onlogon /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:1624

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\74cDYAeB5dSk.bat
Filesize
207B

MD5
8e224ba1d43f65d40f4372c0b66078f0

SHA1
b0d6d87be60505ddfa0e1367a75eff975d44eaaf

SHA256
81daba5d9982d7054fd1f6c5fc372baef57b27dc58d34860299f11774ffbe74d

SHA512
deeccea9deaa1a6d03ddd24732236d6741caa4eee63efbdf039c1060626ee99979440acffa9a14c779e5f560c7871eb9f821a4e5989d38ea38b5a892854578b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CvtFurH6WKfS.bat
Filesize
207B

MD5
4dd5e64d09c6e76e4067db83f56ca86c

SHA1
7ddfd15f52564a4a7bff62e8a07f700a0cf79649

SHA256
051d704b172e438277eba4fb3568b61d6e2ec0a1224bc28e0a1ed95ad30a5775

SHA512
16ed73e1d8c1382733f1ec83c5314817f8e972ca669820545d2b3e1b0a4f85a057670e055fc10f8afff7fcaae1eb30e65d67ebed860ad9bda85bba2c667dd14d

Download Submit
C:\Users\Admin\AppData\Local\Temp\mLjI31YZczax.bat
Filesize
207B

MD5
2be9e42319d703ac8ddf3b70f64f6abe

SHA1
eb9b3c9ef052b0c5dfcefe27d2a4bbfb9bad7b5f

SHA256
70bcc8c9c1d48ab2a51bdf4e095e29eaac7799a10a61b4572b1e842b4264e4d1

SHA512
b3a6babf41bec0d46ac2141b92d5041e2a9fe83148a561827fb63c8f65058b74fa50491057c48f64ce4c81552fd59febc57577a3379375248269e3e076390342

Download Submit
C:\Users\Admin\AppData\Local\Temp\t8CTZ4bjcl52.bat
Filesize
207B

MD5
8684f15775bf60c2f7b50a6c1c8884e0

SHA1
290a2b23edacb492d9e4aeb41b7deefa4a176d4e

SHA256
81e79aebfbd7120088f9d071471ef47176655f14b82aafda1700b41da5179230

SHA512
6b8ba1d21019e63676f61c3a28a99ff0ee52814d6ebe64d5cc08b0a1dd585520c42ef240b797bd10e0667daf71a4118a7d2aaf65bd2147f89c5ba0d62e98dc3a

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
409KB

MD5
b70fdac25a99501e3cae11f1b775249e

SHA1
3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

SHA256
51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

SHA512
43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

Download Submit
memory/108-14-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/108-0-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

Filesize
4KB

Download
memory/108-4-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/108-3-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

Filesize
4KB

Download
memory/108-2-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/108-1-0x00000000010B0000-0x000000000111C000-memory.dmp

Filesize
432KB

Download
memory/672-28-0x0000000001260000-0x00000000012CC000-memory.dmp

Filesize
432KB

Download
memory/1452-40-0x0000000001260000-0x00000000012CC000-memory.dmp

Filesize
432KB

Download
memory/2452-52-0x0000000001260000-0x00000000012CC000-memory.dmp

Filesize
432KB

Download
memory/2904-12-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2904-13-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2904-15-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download
memory/2904-25-0x0000000074CA0000-0x000000007538E000-memory.dmp

Filesize
6.9MB

Download