quasar | 956866f40e28cef19324cb165382d5cd5aee0b67c0cb9dd4a39f5bddc6ac56c4

Analysis

max time kernel
296s
max time network
299s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uni/Uni - Copy (10) - Copy.exe
Size

409KB
MD5

b70fdac25a99501e3cae11f1b775249e
SHA1

3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
SHA256

51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
SHA512

43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
SSDEEP

12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

Score

10^/10

quasar seroxen spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

panel-slave.gl.at.ply.gg:57059

panel-slave.gl.at.ply.gg:27892

Mutex

$Sxr-rpL8EItHN3pqIQQVy2

Attributes

encryption_key
Lme7VBS3l58VwLM69PNM
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SeroXen
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

Processes:

resource	yara_rule
behavioral5/memory/2596-1-0x00000000003E0000-0x000000000044C000-memory.dmp	family_quasar
\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
behavioral5/memory/2968-12-0x0000000000130000-0x000000000019C000-memory.dmp	family_quasar
behavioral5/memory/2124-29-0x00000000010D0000-0x000000000113C000-memory.dmp	family_quasar
behavioral5/memory/1740-41-0x00000000010D0000-0x000000000113C000-memory.dmp	family_quasar
behavioral5/memory/2552-53-0x0000000001360000-0x00000000013CC000-memory.dmp	family_quasar

Executes dropped EXE 4 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exe

pid process

2968 Client.exe
2124 Client.exe
1740 Client.exe
2552 Client.exe
Loads dropped DLL 4 IoCs

Processes:

Uni - Copy (10) - Copy.execmd.execmd.execmd.exe

pid process

2596 Uni - Copy (10) - Copy.exe
2312 cmd.exe
1884 cmd.exe
2696 cmd.exe
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
17 api.ipify.org
23 api.ipify.org
27 ip-api.com
29 api.ipify.org
6 api.ipify.org
8 ip-api.com
11 api.ipify.org
15 ip-api.com
21 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeSCHTASKS.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2564 schtasks.exe
2176 SCHTASKS.exe
2984 schtasks.exe
1776 schtasks.exe
1428 schtasks.exe
1032 schtasks.exe
Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

2264 PING.EXE
1348 PING.EXE
2236 PING.EXE
2796 PING.EXE

pid	process
2968	Client.exe
2124	Client.exe
1740	Client.exe
2552	Client.exe

pid	process
2596	Uni - Copy (10) - Copy.exe
2312	cmd.exe
1884	cmd.exe
2696	cmd.exe

flow	ioc
2	ip-api.com
17	api.ipify.org
23	api.ipify.org
27	ip-api.com
29	api.ipify.org
6	api.ipify.org
8	ip-api.com
11	api.ipify.org
15	ip-api.com
21	ip-api.com

pid	process
2564	schtasks.exe
2176	SCHTASKS.exe
2984	schtasks.exe
1776	schtasks.exe
1428	schtasks.exe
1032	schtasks.exe

pid	process
2264	PING.EXE
1348	PING.EXE
2236	PING.EXE
2796	PING.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Uni - Copy (10) - Copy.exeClient.exeClient.exeClient.exeClient.exe

description	pid	process
Token: SeDebugPrivilege	2596	Uni - Copy (10) - Copy.exe
Token: SeDebugPrivilege	2968	Client.exe
Token: SeDebugPrivilege	2124	Client.exe
Token: SeDebugPrivilege	1740	Client.exe
Token: SeDebugPrivilege	2552	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Uni - Copy (10) - Copy.exeClient.execmd.exeClient.execmd.exeClient.exe

description	pid	process	target process
PID 2596 wrote to memory of 2564	2596	Uni - Copy (10) - Copy.exe	schtasks.exe
PID 2596 wrote to memory of 2564	2596	Uni - Copy (10) - Copy.exe	schtasks.exe
PID 2596 wrote to memory of 2564	2596	Uni - Copy (10) - Copy.exe	schtasks.exe
PID 2596 wrote to memory of 2564	2596	Uni - Copy (10) - Copy.exe	schtasks.exe
PID 2596 wrote to memory of 2968	2596	Uni - Copy (10) - Copy.exe	Client.exe
PID 2596 wrote to memory of 2968	2596	Uni - Copy (10) - Copy.exe	Client.exe
PID 2596 wrote to memory of 2968	2596	Uni - Copy (10) - Copy.exe	Client.exe
PID 2596 wrote to memory of 2968	2596	Uni - Copy (10) - Copy.exe	Client.exe
PID 2596 wrote to memory of 2968	2596	Uni - Copy (10) - Copy.exe	Client.exe
PID 2596 wrote to memory of 2968	2596	Uni - Copy (10) - Copy.exe	Client.exe
PID 2596 wrote to memory of 2968	2596	Uni - Copy (10) - Copy.exe	Client.exe
PID 2596 wrote to memory of 2176	2596	Uni - Copy (10) - Copy.exe	SCHTASKS.exe
PID 2596 wrote to memory of 2176	2596	Uni - Copy (10) - Copy.exe	SCHTASKS.exe
PID 2596 wrote to memory of 2176	2596	Uni - Copy (10) - Copy.exe	SCHTASKS.exe
PID 2596 wrote to memory of 2176	2596	Uni - Copy (10) - Copy.exe	SCHTASKS.exe
PID 2968 wrote to memory of 2984	2968	Client.exe	schtasks.exe
PID 2968 wrote to memory of 2984	2968	Client.exe	schtasks.exe
PID 2968 wrote to memory of 2984	2968	Client.exe	schtasks.exe
PID 2968 wrote to memory of 2984	2968	Client.exe	schtasks.exe
PID 2968 wrote to memory of 2312	2968	Client.exe	cmd.exe
PID 2968 wrote to memory of 2312	2968	Client.exe	cmd.exe
PID 2968 wrote to memory of 2312	2968	Client.exe	cmd.exe
PID 2968 wrote to memory of 2312	2968	Client.exe	cmd.exe
PID 2312 wrote to memory of 660	2312	cmd.exe	chcp.com
PID 2312 wrote to memory of 660	2312	cmd.exe	chcp.com
PID 2312 wrote to memory of 660	2312	cmd.exe	chcp.com
PID 2312 wrote to memory of 660	2312	cmd.exe	chcp.com
PID 2312 wrote to memory of 2264	2312	cmd.exe	PING.EXE
PID 2312 wrote to memory of 2264	2312	cmd.exe	PING.EXE
PID 2312 wrote to memory of 2264	2312	cmd.exe	PING.EXE
PID 2312 wrote to memory of 2264	2312	cmd.exe	PING.EXE
PID 2312 wrote to memory of 2124	2312	cmd.exe	Client.exe
PID 2312 wrote to memory of 2124	2312	cmd.exe	Client.exe
PID 2312 wrote to memory of 2124	2312	cmd.exe	Client.exe
PID 2312 wrote to memory of 2124	2312	cmd.exe	Client.exe
PID 2312 wrote to memory of 2124	2312	cmd.exe	Client.exe
PID 2312 wrote to memory of 2124	2312	cmd.exe	Client.exe
PID 2312 wrote to memory of 2124	2312	cmd.exe	Client.exe
PID 2124 wrote to memory of 1776	2124	Client.exe	schtasks.exe
PID 2124 wrote to memory of 1776	2124	Client.exe	schtasks.exe
PID 2124 wrote to memory of 1776	2124	Client.exe	schtasks.exe
PID 2124 wrote to memory of 1776	2124	Client.exe	schtasks.exe
PID 2124 wrote to memory of 1884	2124	Client.exe	cmd.exe
PID 2124 wrote to memory of 1884	2124	Client.exe	cmd.exe
PID 2124 wrote to memory of 1884	2124	Client.exe	cmd.exe
PID 2124 wrote to memory of 1884	2124	Client.exe	cmd.exe
PID 1884 wrote to memory of 684	1884	cmd.exe	chcp.com
PID 1884 wrote to memory of 684	1884	cmd.exe	chcp.com
PID 1884 wrote to memory of 684	1884	cmd.exe	chcp.com
PID 1884 wrote to memory of 684	1884	cmd.exe	chcp.com
PID 1884 wrote to memory of 1348	1884	cmd.exe	PING.EXE
PID 1884 wrote to memory of 1348	1884	cmd.exe	PING.EXE
PID 1884 wrote to memory of 1348	1884	cmd.exe	PING.EXE
PID 1884 wrote to memory of 1348	1884	cmd.exe	PING.EXE
PID 1884 wrote to memory of 1740	1884	cmd.exe	Client.exe
PID 1884 wrote to memory of 1740	1884	cmd.exe	Client.exe
PID 1884 wrote to memory of 1740	1884	cmd.exe	Client.exe
PID 1884 wrote to memory of 1740	1884	cmd.exe	Client.exe
PID 1884 wrote to memory of 1740	1884	cmd.exe	Client.exe
PID 1884 wrote to memory of 1740	1884	cmd.exe	Client.exe
PID 1884 wrote to memory of 1740	1884	cmd.exe	Client.exe
PID 1740 wrote to memory of 1428	1740	Client.exe	schtasks.exe
PID 1740 wrote to memory of 1428	1740	Client.exe	schtasks.exe
PID 1740 wrote to memory of 1428	1740	Client.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2564

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2984

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\lAbHXfnYWsdk.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2312

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:660

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:2264

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1776

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\BzuWSwnYT3bx.bat" "
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\chcp.com
chcp 65001
6⤵
PID:684

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:1348

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
7⤵
- Creates scheduled task(s)
PID:1428

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\21Nk98jxbuxT.bat" "
7⤵
- Loads dropped DLL
PID:2696

C:\Windows\SysWOW64\chcp.com
chcp 65001
8⤵
PID:2632

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:2236

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
9⤵
- Creates scheduled task(s)
PID:1032

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\ewMc4VcVOWmt.bat" "
9⤵
PID:2408

C:\Windows\SysWOW64\chcp.com
chcp 65001
10⤵
PID:808

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
10⤵
- Runs ping.exe
PID:2796

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Uni - Copy (10) - Copy.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy.exe'" /sc onlogon /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:2176

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\21Nk98jxbuxT.bat
Filesize
207B

MD5
fafe9f4e19f9ca6ac7d069bf5e7f7c43

SHA1
e5509c78dc9730def371dc41ab7f326b6513d53a

SHA256
1752c7dc1a00d772bf3a218249b8c359c49c4bec43ec3b81b5293d37e1710522

SHA512
37f06908ffd3b7aa12f15d4d81da4f128ba61ec121dd255d02613eae6ae24c16c089e33b615d871c1ef9638e0067459f2f2f10f4017a380e5f03b426870f14a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\BzuWSwnYT3bx.bat
Filesize
207B

MD5
d03d4df13ef004c7dea80f7b500d2730

SHA1
df3c15d6471f9454e0f3bdb9fc7d882760821b45

SHA256
30ef6a408585b31a0f3d4e7f49b8a5cb047f039fef6131a17bcb47744697f1ed

SHA512
e60e0e71361695e31e5bdc4e84eec15540c25cfcc4048bdd0fa230c5f28a2216f52e38cf75d0d0b2762c61c540de3d53dcc988aabdec4064950fe2ff3dd419e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ewMc4VcVOWmt.bat
Filesize
207B

MD5
78da848d298ab17f8a0fe38554e282c1

SHA1
80a998fba81f8271425165364f59c4f3fe9a68d6

SHA256
549fe0521be9bd60974d7fafc2ea8c3edfe8eeeca1684961aa01e508a35e2dde

SHA512
5e7b9a2d2ba6ffa48268bc7a0957233be9cd2b83fd85244a6331a7b6461a836e794ba77617faff5822b9699b6f4429d8d137513e806d7ee5b1de028fc3ce9047

Download Submit
C:\Users\Admin\AppData\Local\Temp\lAbHXfnYWsdk.bat
Filesize
207B

MD5
d54347591da8913b485a3618f8c2fb5c

SHA1
328c80544107a70ee30796dfbc0548bc895addb9

SHA256
0236691709d47da4680c4afb5ece1c45c8e0c2a94b4d0a44cecf3225146cb1ba

SHA512
5f688f8bf46dfa910e83f7dedecec0803472713feb8a04edc494dbb7c25f9ef4a25e0dc4fa8a814577ace7bfa289950e25a1db0fd1b6a406a7c3de503e3f1dea

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
409KB

MD5
b70fdac25a99501e3cae11f1b775249e

SHA1
3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

SHA256
51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

SHA512
43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

Download Submit
memory/1740-41-0x00000000010D0000-0x000000000113C000-memory.dmp

Filesize
432KB

Download
memory/2124-29-0x00000000010D0000-0x000000000113C000-memory.dmp

Filesize
432KB

Download
memory/2552-53-0x0000000001360000-0x00000000013CC000-memory.dmp

Filesize
432KB

Download
memory/2596-3-0x000000007440E000-0x000000007440F000-memory.dmp

Filesize
4KB

Download
memory/2596-15-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2596-0-0x000000007440E000-0x000000007440F000-memory.dmp

Filesize
4KB

Download
memory/2596-4-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2596-2-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2596-1-0x00000000003E0000-0x000000000044C000-memory.dmp

Filesize
432KB

Download
memory/2968-14-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2968-26-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2968-16-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2968-13-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2968-12-0x0000000000130000-0x000000000019C000-memory.dmp

Filesize
432KB

Download