quasar | 1a4689bd6cc37dac5abf6a68afda78aa46cf114aadb276b21299d1f566e4ef58

Analysis

max time kernel
297s
max time network
307s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uni/Uni - Copy (10) - Copy - Copy - Copy - Copy.exe
Size

409KB
MD5

b70fdac25a99501e3cae11f1b775249e
SHA1

3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
SHA256

51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
SHA512

43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
SSDEEP

12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

Score

10^/10

quasar seroxen spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

panel-slave.gl.at.ply.gg:57059

panel-slave.gl.at.ply.gg:27892

Mutex

$Sxr-rpL8EItHN3pqIQQVy2

Attributes

encryption_key
Lme7VBS3l58VwLM69PNM
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SeroXen
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1960-1-0x0000000000990000-0x00000000009FC000-memory.dmp	family_quasar
\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
behavioral1/memory/2188-13-0x0000000000D80000-0x0000000000DEC000-memory.dmp	family_quasar
behavioral1/memory/1560-29-0x0000000000D80000-0x0000000000DEC000-memory.dmp	family_quasar

Executes dropped EXE 4 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exe

pid process

2188 Client.exe
1560 Client.exe
3004 Client.exe
3036 Client.exe
Loads dropped DLL 4 IoCs

Processes:

Uni - Copy (10) - Copy - Copy - Copy - Copy.execmd.execmd.execmd.exe

pid process

1960 Uni - Copy (10) - Copy - Copy - Copy - Copy.exe
2824 cmd.exe
1204 cmd.exe
1904 cmd.exe
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com
11 api.ipify.org
15 ip-api.com
21 ip-api.com
2 ip-api.com
6 api.ipify.org
27 ip-api.com
29 api.ipify.org
17 api.ipify.org
23 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

SCHTASKS.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

1660 SCHTASKS.exe
636 schtasks.exe
1084 schtasks.exe
340 schtasks.exe
2768 schtasks.exe
2964 schtasks.exe
Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

908 PING.EXE
1520 PING.EXE
2612 PING.EXE
1912 PING.EXE

pid	process
2188	Client.exe
1560	Client.exe
3004	Client.exe
3036	Client.exe

pid	process
1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe
2824	cmd.exe
1204	cmd.exe
1904	cmd.exe

flow	ioc
8	ip-api.com
11	api.ipify.org
15	ip-api.com
21	ip-api.com
2	ip-api.com
6	api.ipify.org
27	ip-api.com
29	api.ipify.org
17	api.ipify.org
23	api.ipify.org

pid	process
1660	SCHTASKS.exe
636	schtasks.exe
1084	schtasks.exe
340	schtasks.exe
2768	schtasks.exe
2964	schtasks.exe

pid	process
908	PING.EXE
1520	PING.EXE
2612	PING.EXE
1912	PING.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Uni - Copy (10) - Copy - Copy - Copy - Copy.exeClient.exeClient.exeClient.exeClient.exe

description	pid	process
Token: SeDebugPrivilege	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe
Token: SeDebugPrivilege	2188	Client.exe
Token: SeDebugPrivilege	1560	Client.exe
Token: SeDebugPrivilege	3004	Client.exe
Token: SeDebugPrivilege	3036	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Uni - Copy (10) - Copy - Copy - Copy - Copy.exeClient.execmd.exeClient.execmd.exeClient.exe

description	pid	process	target process
PID 1960 wrote to memory of 2964	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe	schtasks.exe
PID 1960 wrote to memory of 2964	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe	schtasks.exe
PID 1960 wrote to memory of 2964	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe	schtasks.exe
PID 1960 wrote to memory of 2964	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe	schtasks.exe
PID 1960 wrote to memory of 2188	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe	Client.exe
PID 1960 wrote to memory of 2188	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe	Client.exe
PID 1960 wrote to memory of 2188	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe	Client.exe
PID 1960 wrote to memory of 2188	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe	Client.exe
PID 1960 wrote to memory of 2188	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe	Client.exe
PID 1960 wrote to memory of 2188	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe	Client.exe
PID 1960 wrote to memory of 2188	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe	Client.exe
PID 1960 wrote to memory of 1660	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 1960 wrote to memory of 1660	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 1960 wrote to memory of 1660	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 1960 wrote to memory of 1660	1960	Uni - Copy (10) - Copy - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 2188 wrote to memory of 636	2188	Client.exe	schtasks.exe
PID 2188 wrote to memory of 636	2188	Client.exe	schtasks.exe
PID 2188 wrote to memory of 636	2188	Client.exe	schtasks.exe
PID 2188 wrote to memory of 636	2188	Client.exe	schtasks.exe
PID 2188 wrote to memory of 2824	2188	Client.exe	cmd.exe
PID 2188 wrote to memory of 2824	2188	Client.exe	cmd.exe
PID 2188 wrote to memory of 2824	2188	Client.exe	cmd.exe
PID 2188 wrote to memory of 2824	2188	Client.exe	cmd.exe
PID 2824 wrote to memory of 2296	2824	cmd.exe	chcp.com
PID 2824 wrote to memory of 2296	2824	cmd.exe	chcp.com
PID 2824 wrote to memory of 2296	2824	cmd.exe	chcp.com
PID 2824 wrote to memory of 2296	2824	cmd.exe	chcp.com
PID 2824 wrote to memory of 1912	2824	cmd.exe	PING.EXE
PID 2824 wrote to memory of 1912	2824	cmd.exe	PING.EXE
PID 2824 wrote to memory of 1912	2824	cmd.exe	PING.EXE
PID 2824 wrote to memory of 1912	2824	cmd.exe	PING.EXE
PID 2824 wrote to memory of 1560	2824	cmd.exe	Client.exe
PID 2824 wrote to memory of 1560	2824	cmd.exe	Client.exe
PID 2824 wrote to memory of 1560	2824	cmd.exe	Client.exe
PID 2824 wrote to memory of 1560	2824	cmd.exe	Client.exe
PID 2824 wrote to memory of 1560	2824	cmd.exe	Client.exe
PID 2824 wrote to memory of 1560	2824	cmd.exe	Client.exe
PID 2824 wrote to memory of 1560	2824	cmd.exe	Client.exe
PID 1560 wrote to memory of 1084	1560	Client.exe	schtasks.exe
PID 1560 wrote to memory of 1084	1560	Client.exe	schtasks.exe
PID 1560 wrote to memory of 1084	1560	Client.exe	schtasks.exe
PID 1560 wrote to memory of 1084	1560	Client.exe	schtasks.exe
PID 1560 wrote to memory of 1204	1560	Client.exe	cmd.exe
PID 1560 wrote to memory of 1204	1560	Client.exe	cmd.exe
PID 1560 wrote to memory of 1204	1560	Client.exe	cmd.exe
PID 1560 wrote to memory of 1204	1560	Client.exe	cmd.exe
PID 1204 wrote to memory of 328	1204	cmd.exe	chcp.com
PID 1204 wrote to memory of 328	1204	cmd.exe	chcp.com
PID 1204 wrote to memory of 328	1204	cmd.exe	chcp.com
PID 1204 wrote to memory of 328	1204	cmd.exe	chcp.com
PID 1204 wrote to memory of 908	1204	cmd.exe	PING.EXE
PID 1204 wrote to memory of 908	1204	cmd.exe	PING.EXE
PID 1204 wrote to memory of 908	1204	cmd.exe	PING.EXE
PID 1204 wrote to memory of 908	1204	cmd.exe	PING.EXE
PID 1204 wrote to memory of 3004	1204	cmd.exe	Client.exe
PID 1204 wrote to memory of 3004	1204	cmd.exe	Client.exe
PID 1204 wrote to memory of 3004	1204	cmd.exe	Client.exe
PID 1204 wrote to memory of 3004	1204	cmd.exe	Client.exe
PID 1204 wrote to memory of 3004	1204	cmd.exe	Client.exe
PID 1204 wrote to memory of 3004	1204	cmd.exe	Client.exe
PID 1204 wrote to memory of 3004	1204	cmd.exe	Client.exe
PID 3004 wrote to memory of 340	3004	Client.exe	schtasks.exe
PID 3004 wrote to memory of 340	3004	Client.exe	schtasks.exe
PID 3004 wrote to memory of 340	3004	Client.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy - Copy - Copy - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy - Copy - Copy - Copy.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy - Copy - Copy - Copy.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2964

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:636

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\1v4RbBfQT5Oe.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:2296

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:1912

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1084

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\So7CPf0BqA2R.bat" "
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\chcp.com
chcp 65001
6⤵
PID:328

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:908

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
7⤵
- Creates scheduled task(s)
PID:340

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\DoxxWNcywPz9.bat" "
7⤵
- Loads dropped DLL
PID:1904

C:\Windows\SysWOW64\chcp.com
chcp 65001
8⤵
PID:1508

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:1520

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
9⤵
- Creates scheduled task(s)
PID:2768

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\RXbaSYjP3A8A.bat" "
9⤵
PID:2948

C:\Windows\SysWOW64\chcp.com
chcp 65001
10⤵
PID:2152

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
10⤵
- Runs ping.exe
PID:2612

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Uni - Copy (10) - Copy - Copy - Copy - Copy.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy - Copy - Copy - Copy.exe'" /sc onlogon /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:1660

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1v4RbBfQT5Oe.bat
Filesize
207B

MD5
db24efd58b9853703a91011ed246b6a3

SHA1
71da8f8bcfeff49707b45a1f88a4bc1cb12fe812

SHA256
ad55c1bc89182fddff78d9186db257bc541ab74b6802908b866ee83ed74cc5d8

SHA512
13bc425ac7e7c5734eecebdee8f3fa5b7595f3455facf2adbeb17201bc8260d1b8e24389f58edb01b51b13dfa3cf8337d445b016654957237e0269f7ad0b527c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DoxxWNcywPz9.bat
Filesize
207B

MD5
4f6b583276a13cd067e6986cea85d6d0

SHA1
86207f43867efcd2be57dc58a40c80979ff2b082

SHA256
9421c127132df0f3cf176ff3e16ec57991d5d7c6458b0778fdab1cdcbdb6c4e8

SHA512
591916fa4d377a8445173fde7d6bf7dee1a57fb88c9bfccd7482d479acbc75143e30edec7a9381f58db592baeef2ad0955fa8a44601983487262ffa526a789f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RXbaSYjP3A8A.bat
Filesize
207B

MD5
78d4c2a464eca7dd54a1db6a17abff1d

SHA1
4197b7cf298f1f13d027dfb116d25fa8a97906ed

SHA256
a6812f4e2b25f1f106220c9ddd52bab20ea9f81b196c76cababc6228700534eb

SHA512
38396bef3e8859061c088fbab1f572e51dbd7d1606c4d12059e1c883107bc4ad44cb49ea1503ac5683ddf1065613a9c5c1ff14be3759a038c20d0b1006414592

Download Submit
C:\Users\Admin\AppData\Local\Temp\So7CPf0BqA2R.bat
Filesize
207B

MD5
60d823b3c008cedb9fae7396cbdccf41

SHA1
0fcb9f6feef72baf3b69a6f33c983078c60725ff

SHA256
417e2619a92509fff1e35a18626627887728a5c4ceb5e4be0e9befd358ca6b13

SHA512
f0998e988dfcbf9c1b82e8a84ed2b642fb802fb67abe8ac036a9aed2d61eab5569c53b5f465d284ff891416b1465ccd271411513b133248d37ef07f5cfeed656

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
409KB

MD5
b70fdac25a99501e3cae11f1b775249e

SHA1
3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

SHA256
51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

SHA512
43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

Download Submit
memory/1560-29-0x0000000000D80000-0x0000000000DEC000-memory.dmp

Filesize
432KB

Download
memory/1960-1-0x0000000000990000-0x00000000009FC000-memory.dmp

Filesize
432KB

Download
memory/1960-2-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/1960-3-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/1960-4-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/1960-0-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/1960-15-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/2188-14-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/2188-25-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/2188-16-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/2188-13-0x0000000000D80000-0x0000000000DEC000-memory.dmp

Filesize
432KB

Download
memory/2188-12-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download