quasar | 956866f40e28cef19324cb165382d5cd5aee0b67c0cb9dd4a39f5bddc6ac56c4

Analysis

max time kernel
296s
max time network
300s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uni/Uni - Copy (15) - Copy - Copy - Copy.exe
Size

409KB
MD5

b70fdac25a99501e3cae11f1b775249e
SHA1

3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
SHA256

51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
SHA512

43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
SSDEEP

12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

Score

10^/10

quasar seroxen spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

panel-slave.gl.at.ply.gg:57059

panel-slave.gl.at.ply.gg:27892

Mutex

$Sxr-rpL8EItHN3pqIQQVy2

Attributes

encryption_key
Lme7VBS3l58VwLM69PNM
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SeroXen
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

Processes:

resource	yara_rule
behavioral31/memory/1464-1-0x0000000000B70000-0x0000000000BDC000-memory.dmp	family_quasar
\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
behavioral31/memory/2164-12-0x0000000000D80000-0x0000000000DEC000-memory.dmp	family_quasar
behavioral31/memory/2172-29-0x0000000000100000-0x000000000016C000-memory.dmp	family_quasar
behavioral31/memory/2080-41-0x0000000000C70000-0x0000000000CDC000-memory.dmp	family_quasar
behavioral31/memory/2692-53-0x0000000000120000-0x000000000018C000-memory.dmp	family_quasar

Executes dropped EXE 4 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exe

pid process

2164 Client.exe
2172 Client.exe
2080 Client.exe
2692 Client.exe
Loads dropped DLL 4 IoCs

Processes:

Uni - Copy (15) - Copy - Copy - Copy.execmd.execmd.execmd.exe

pid process

1464 Uni - Copy (15) - Copy - Copy - Copy.exe
1604 cmd.exe
2268 cmd.exe
2860 cmd.exe
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

29 api.ipify.org
2 ip-api.com
6 api.ipify.org
8 ip-api.com
15 ip-api.com
17 api.ipify.org
27 ip-api.com
11 api.ipify.org
21 ip-api.com
23 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeSCHTASKS.exeschtasks.exeschtasks.exe

pid process

1568 schtasks.exe
316 schtasks.exe
2640 schtasks.exe
1948 SCHTASKS.exe
348 schtasks.exe
2916 schtasks.exe
Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

1192 PING.EXE
2064 PING.EXE
2984 PING.EXE
1168 PING.EXE

pid	process
2164	Client.exe
2172	Client.exe
2080	Client.exe
2692	Client.exe

pid	process
1464	Uni - Copy (15) - Copy - Copy - Copy.exe
1604	cmd.exe
2268	cmd.exe
2860	cmd.exe

flow	ioc
29	api.ipify.org
2	ip-api.com
6	api.ipify.org
8	ip-api.com
15	ip-api.com
17	api.ipify.org
27	ip-api.com
11	api.ipify.org
21	ip-api.com
23	api.ipify.org

pid	process
1568	schtasks.exe
316	schtasks.exe
2640	schtasks.exe
1948	SCHTASKS.exe
348	schtasks.exe
2916	schtasks.exe

pid	process
1192	PING.EXE
2064	PING.EXE
2984	PING.EXE
1168	PING.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Uni - Copy (15) - Copy - Copy - Copy.exeClient.exeClient.exeClient.exeClient.exe

description	pid	process
Token: SeDebugPrivilege	1464	Uni - Copy (15) - Copy - Copy - Copy.exe
Token: SeDebugPrivilege	2164	Client.exe
Token: SeDebugPrivilege	2172	Client.exe
Token: SeDebugPrivilege	2080	Client.exe
Token: SeDebugPrivilege	2692	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Uni - Copy (15) - Copy - Copy - Copy.exeClient.execmd.exeClient.execmd.exeClient.exe

description	pid	process	target process
PID 1464 wrote to memory of 2640	1464	Uni - Copy (15) - Copy - Copy - Copy.exe	schtasks.exe
PID 1464 wrote to memory of 2640	1464	Uni - Copy (15) - Copy - Copy - Copy.exe	schtasks.exe
PID 1464 wrote to memory of 2640	1464	Uni - Copy (15) - Copy - Copy - Copy.exe	schtasks.exe
PID 1464 wrote to memory of 2640	1464	Uni - Copy (15) - Copy - Copy - Copy.exe	schtasks.exe
PID 1464 wrote to memory of 2164	1464	Uni - Copy (15) - Copy - Copy - Copy.exe	Client.exe
PID 1464 wrote to memory of 2164	1464	Uni - Copy (15) - Copy - Copy - Copy.exe	Client.exe
PID 1464 wrote to memory of 2164	1464	Uni - Copy (15) - Copy - Copy - Copy.exe	Client.exe
PID 1464 wrote to memory of 2164	1464	Uni - Copy (15) - Copy - Copy - Copy.exe	Client.exe
PID 1464 wrote to memory of 2164	1464	Uni - Copy (15) - Copy - Copy - Copy.exe	Client.exe
PID 1464 wrote to memory of 2164	1464	Uni - Copy (15) - Copy - Copy - Copy.exe	Client.exe
PID 1464 wrote to memory of 2164	1464	Uni - Copy (15) - Copy - Copy - Copy.exe	Client.exe
PID 1464 wrote to memory of 1948	1464	Uni - Copy (15) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 1464 wrote to memory of 1948	1464	Uni - Copy (15) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 1464 wrote to memory of 1948	1464	Uni - Copy (15) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 1464 wrote to memory of 1948	1464	Uni - Copy (15) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 2164 wrote to memory of 348	2164	Client.exe	schtasks.exe
PID 2164 wrote to memory of 348	2164	Client.exe	schtasks.exe
PID 2164 wrote to memory of 348	2164	Client.exe	schtasks.exe
PID 2164 wrote to memory of 348	2164	Client.exe	schtasks.exe
PID 2164 wrote to memory of 1604	2164	Client.exe	cmd.exe
PID 2164 wrote to memory of 1604	2164	Client.exe	cmd.exe
PID 2164 wrote to memory of 1604	2164	Client.exe	cmd.exe
PID 2164 wrote to memory of 1604	2164	Client.exe	cmd.exe
PID 1604 wrote to memory of 1672	1604	cmd.exe	chcp.com
PID 1604 wrote to memory of 1672	1604	cmd.exe	chcp.com
PID 1604 wrote to memory of 1672	1604	cmd.exe	chcp.com
PID 1604 wrote to memory of 1672	1604	cmd.exe	chcp.com
PID 1604 wrote to memory of 1192	1604	cmd.exe	PING.EXE
PID 1604 wrote to memory of 1192	1604	cmd.exe	PING.EXE
PID 1604 wrote to memory of 1192	1604	cmd.exe	PING.EXE
PID 1604 wrote to memory of 1192	1604	cmd.exe	PING.EXE
PID 1604 wrote to memory of 2172	1604	cmd.exe	Client.exe
PID 1604 wrote to memory of 2172	1604	cmd.exe	Client.exe
PID 1604 wrote to memory of 2172	1604	cmd.exe	Client.exe
PID 1604 wrote to memory of 2172	1604	cmd.exe	Client.exe
PID 1604 wrote to memory of 2172	1604	cmd.exe	Client.exe
PID 1604 wrote to memory of 2172	1604	cmd.exe	Client.exe
PID 1604 wrote to memory of 2172	1604	cmd.exe	Client.exe
PID 2172 wrote to memory of 2916	2172	Client.exe	schtasks.exe
PID 2172 wrote to memory of 2916	2172	Client.exe	schtasks.exe
PID 2172 wrote to memory of 2916	2172	Client.exe	schtasks.exe
PID 2172 wrote to memory of 2916	2172	Client.exe	schtasks.exe
PID 2172 wrote to memory of 2268	2172	Client.exe	cmd.exe
PID 2172 wrote to memory of 2268	2172	Client.exe	cmd.exe
PID 2172 wrote to memory of 2268	2172	Client.exe	cmd.exe
PID 2172 wrote to memory of 2268	2172	Client.exe	cmd.exe
PID 2268 wrote to memory of 1508	2268	cmd.exe	chcp.com
PID 2268 wrote to memory of 1508	2268	cmd.exe	chcp.com
PID 2268 wrote to memory of 1508	2268	cmd.exe	chcp.com
PID 2268 wrote to memory of 1508	2268	cmd.exe	chcp.com
PID 2268 wrote to memory of 2064	2268	cmd.exe	PING.EXE
PID 2268 wrote to memory of 2064	2268	cmd.exe	PING.EXE
PID 2268 wrote to memory of 2064	2268	cmd.exe	PING.EXE
PID 2268 wrote to memory of 2064	2268	cmd.exe	PING.EXE
PID 2268 wrote to memory of 2080	2268	cmd.exe	Client.exe
PID 2268 wrote to memory of 2080	2268	cmd.exe	Client.exe
PID 2268 wrote to memory of 2080	2268	cmd.exe	Client.exe
PID 2268 wrote to memory of 2080	2268	cmd.exe	Client.exe
PID 2268 wrote to memory of 2080	2268	cmd.exe	Client.exe
PID 2268 wrote to memory of 2080	2268	cmd.exe	Client.exe
PID 2268 wrote to memory of 2080	2268	cmd.exe	Client.exe
PID 2080 wrote to memory of 1568	2080	Client.exe	schtasks.exe
PID 2080 wrote to memory of 1568	2080	Client.exe	schtasks.exe
PID 2080 wrote to memory of 1568	2080	Client.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (15) - Copy - Copy - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (15) - Copy - Copy - Copy.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (15) - Copy - Copy - Copy.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2640

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:348

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\8BWfZR7KO5KE.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:1672

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:1192

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:2916

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\DNO19vI4mGBW.bat" "
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\SysWOW64\chcp.com
chcp 65001
6⤵
PID:1508

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:2064

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
7⤵
- Creates scheduled task(s)
PID:1568

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\BzZIIHMdYmnR.bat" "
7⤵
- Loads dropped DLL
PID:2860

C:\Windows\SysWOW64\chcp.com
chcp 65001
8⤵
PID:1812

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:2984

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
9⤵
- Creates scheduled task(s)
PID:316

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\RDMkzf4AMVoM.bat" "
9⤵
PID:348

C:\Windows\SysWOW64\chcp.com
chcp 65001
10⤵
PID:608

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
10⤵
- Runs ping.exe
PID:1168

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Uni - Copy (15) - Copy - Copy - Copy.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (15) - Copy - Copy - Copy.exe'" /sc onlogon /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:1948

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8BWfZR7KO5KE.bat
Filesize
207B

MD5
56470d6a6ee78ae6fbeb6de24d219480

SHA1
1c23c028a2b95a9928b950833112eea9466f1143

SHA256
c3d242be6f6a0b4c83219b60b564102bbf330570aaf4f1e12cf7001920aa447a

SHA512
a2c7f354aa1f60804c11043ec62d1e25e6209d7ad3d65e32b645de464797ebf59a563a16b13021f6f3cc6293eb162d239658f868efd9d6d17773d6006dec078d

Download Submit
C:\Users\Admin\AppData\Local\Temp\BzZIIHMdYmnR.bat
Filesize
207B

MD5
571e08c4773f95068daa5bed92a8b128

SHA1
87e3a2472b9f027776a952a93640448167bcaeba

SHA256
afd9a8f882b76426c2a9a3161a34208ba7a3ecf33b974df63fe8390eb23bf489

SHA512
4b0ed697661f8f1b995d80216c9c648867d988b030f1a20e0fcbb2ada5d72fc0207091bf906e8c233b1399330209443b564c389d5926eac52219497c09c8b9b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\DNO19vI4mGBW.bat
Filesize
207B

MD5
87fa842b487ef824db2110421e00656d

SHA1
2d0a5731f5df2435035335525725e0ac47776a41

SHA256
d79e1ad43f71646f98d7b20f44548e948233eb4c7bec14ece815bbeac3396af0

SHA512
11845d358148755291be173df084cfe1b59ec30e09cc60b740c187012763041b9c3b2c8b6a08e60ba754a5cb8ca20eb86ea744bf3ac35d69cc1f27f53da097a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RDMkzf4AMVoM.bat
Filesize
207B

MD5
b15e0856cc19accfeba7362a0ec189ea

SHA1
3324697b9f2ae4a2fb9d5b4a5f2cc5cc9b58ed82

SHA256
c0f4cf0970bb6796e564c75ed70967cac93cfb89f6526217c89c4aa320a89d4c

SHA512
7201f157614af31b484227e0af616ea69259bdcff5151bd0b6690d827b82c74c0a773dfbcea99f55a69565531bcb11c096db305166f0335394330827871d2a9d

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
409KB

MD5
b70fdac25a99501e3cae11f1b775249e

SHA1
3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

SHA256
51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

SHA512
43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

Download Submit
memory/1464-1-0x0000000000B70000-0x0000000000BDC000-memory.dmp

Filesize
432KB

Download
memory/1464-2-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/1464-3-0x000000007414E000-0x000000007414F000-memory.dmp

Filesize
4KB

Download
memory/1464-4-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/1464-0-0x000000007414E000-0x000000007414F000-memory.dmp

Filesize
4KB

Download
memory/1464-15-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/2080-41-0x0000000000C70000-0x0000000000CDC000-memory.dmp

Filesize
432KB

Download
memory/2164-14-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/2164-25-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/2164-16-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/2164-13-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/2164-12-0x0000000000D80000-0x0000000000DEC000-memory.dmp

Filesize
432KB

Download
memory/2172-29-0x0000000000100000-0x000000000016C000-memory.dmp

Filesize
432KB

Download
memory/2692-53-0x0000000000120000-0x000000000018C000-memory.dmp

Filesize
432KB

Download