quasar | 1a4689bd6cc37dac5abf6a68afda78aa46cf114aadb276b21299d1f566e4ef58

Analysis

max time kernel
297s
max time network
305s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uni/Uni - Copy (103) - Copy - Copy - Copy.exe
Size

409KB
MD5

b70fdac25a99501e3cae11f1b775249e
SHA1

3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
SHA256

51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
SHA512

43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
SSDEEP

12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

Score

10^/10

quasar seroxen spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

panel-slave.gl.at.ply.gg:57059

panel-slave.gl.at.ply.gg:27892

Mutex

$Sxr-rpL8EItHN3pqIQQVy2

Attributes

encryption_key
Lme7VBS3l58VwLM69PNM
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SeroXen
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

Processes:

resource	yara_rule
behavioral25/memory/2060-1-0x0000000001090000-0x00000000010FC000-memory.dmp	family_quasar
\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
behavioral25/memory/2036-12-0x0000000000030000-0x000000000009C000-memory.dmp	family_quasar
behavioral25/memory/1936-29-0x0000000000800000-0x000000000086C000-memory.dmp	family_quasar
behavioral25/memory/788-41-0x00000000009E0000-0x0000000000A4C000-memory.dmp	family_quasar
behavioral25/memory/2600-53-0x0000000001270000-0x00000000012DC000-memory.dmp	family_quasar

Executes dropped EXE 4 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exe

pid process

2036 Client.exe
1936 Client.exe
788 Client.exe
2600 Client.exe
Loads dropped DLL 4 IoCs

Processes:

Uni - Copy (103) - Copy - Copy - Copy.execmd.execmd.execmd.exe

pid process

2060 Uni - Copy (103) - Copy - Copy - Copy.exe
2240 cmd.exe
316 cmd.exe
1132 cmd.exe
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
8 ip-api.com
11 api.ipify.org
21 ip-api.com
23 api.ipify.org
6 api.ipify.org
15 ip-api.com
17 api.ipify.org
27 ip-api.com
29 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeSCHTASKS.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2952 schtasks.exe
1608 SCHTASKS.exe
1432 schtasks.exe
3068 schtasks.exe
1568 schtasks.exe
2988 schtasks.exe
Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

2872 PING.EXE
1252 PING.EXE
1840 PING.EXE
1260 PING.EXE

pid	process
2036	Client.exe
1936	Client.exe
788	Client.exe
2600	Client.exe

pid	process
2060	Uni - Copy (103) - Copy - Copy - Copy.exe
2240	cmd.exe
316	cmd.exe
1132	cmd.exe

flow	ioc
2	ip-api.com
8	ip-api.com
11	api.ipify.org
21	ip-api.com
23	api.ipify.org
6	api.ipify.org
15	ip-api.com
17	api.ipify.org
27	ip-api.com
29	api.ipify.org

pid	process
2952	schtasks.exe
1608	SCHTASKS.exe
1432	schtasks.exe
3068	schtasks.exe
1568	schtasks.exe
2988	schtasks.exe

pid	process
2872	PING.EXE
1252	PING.EXE
1840	PING.EXE
1260	PING.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Uni - Copy (103) - Copy - Copy - Copy.exeClient.exeClient.exeClient.exeClient.exe

description	pid	process
Token: SeDebugPrivilege	2060	Uni - Copy (103) - Copy - Copy - Copy.exe
Token: SeDebugPrivilege	2036	Client.exe
Token: SeDebugPrivilege	1936	Client.exe
Token: SeDebugPrivilege	788	Client.exe
Token: SeDebugPrivilege	2600	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Uni - Copy (103) - Copy - Copy - Copy.exeClient.execmd.exeClient.execmd.exeClient.exe

description	pid	process	target process
PID 2060 wrote to memory of 2952	2060	Uni - Copy (103) - Copy - Copy - Copy.exe	schtasks.exe
PID 2060 wrote to memory of 2952	2060	Uni - Copy (103) - Copy - Copy - Copy.exe	schtasks.exe
PID 2060 wrote to memory of 2952	2060	Uni - Copy (103) - Copy - Copy - Copy.exe	schtasks.exe
PID 2060 wrote to memory of 2952	2060	Uni - Copy (103) - Copy - Copy - Copy.exe	schtasks.exe
PID 2060 wrote to memory of 2036	2060	Uni - Copy (103) - Copy - Copy - Copy.exe	Client.exe
PID 2060 wrote to memory of 2036	2060	Uni - Copy (103) - Copy - Copy - Copy.exe	Client.exe
PID 2060 wrote to memory of 2036	2060	Uni - Copy (103) - Copy - Copy - Copy.exe	Client.exe
PID 2060 wrote to memory of 2036	2060	Uni - Copy (103) - Copy - Copy - Copy.exe	Client.exe
PID 2060 wrote to memory of 2036	2060	Uni - Copy (103) - Copy - Copy - Copy.exe	Client.exe
PID 2060 wrote to memory of 2036	2060	Uni - Copy (103) - Copy - Copy - Copy.exe	Client.exe
PID 2060 wrote to memory of 2036	2060	Uni - Copy (103) - Copy - Copy - Copy.exe	Client.exe
PID 2060 wrote to memory of 1608	2060	Uni - Copy (103) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 2060 wrote to memory of 1608	2060	Uni - Copy (103) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 2060 wrote to memory of 1608	2060	Uni - Copy (103) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 2060 wrote to memory of 1608	2060	Uni - Copy (103) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 2036 wrote to memory of 1432	2036	Client.exe	schtasks.exe
PID 2036 wrote to memory of 1432	2036	Client.exe	schtasks.exe
PID 2036 wrote to memory of 1432	2036	Client.exe	schtasks.exe
PID 2036 wrote to memory of 1432	2036	Client.exe	schtasks.exe
PID 2036 wrote to memory of 2240	2036	Client.exe	cmd.exe
PID 2036 wrote to memory of 2240	2036	Client.exe	cmd.exe
PID 2036 wrote to memory of 2240	2036	Client.exe	cmd.exe
PID 2036 wrote to memory of 2240	2036	Client.exe	cmd.exe
PID 2240 wrote to memory of 1932	2240	cmd.exe	chcp.com
PID 2240 wrote to memory of 1932	2240	cmd.exe	chcp.com
PID 2240 wrote to memory of 1932	2240	cmd.exe	chcp.com
PID 2240 wrote to memory of 1932	2240	cmd.exe	chcp.com
PID 2240 wrote to memory of 2872	2240	cmd.exe	PING.EXE
PID 2240 wrote to memory of 2872	2240	cmd.exe	PING.EXE
PID 2240 wrote to memory of 2872	2240	cmd.exe	PING.EXE
PID 2240 wrote to memory of 2872	2240	cmd.exe	PING.EXE
PID 2240 wrote to memory of 1936	2240	cmd.exe	Client.exe
PID 2240 wrote to memory of 1936	2240	cmd.exe	Client.exe
PID 2240 wrote to memory of 1936	2240	cmd.exe	Client.exe
PID 2240 wrote to memory of 1936	2240	cmd.exe	Client.exe
PID 2240 wrote to memory of 1936	2240	cmd.exe	Client.exe
PID 2240 wrote to memory of 1936	2240	cmd.exe	Client.exe
PID 2240 wrote to memory of 1936	2240	cmd.exe	Client.exe
PID 1936 wrote to memory of 3068	1936	Client.exe	schtasks.exe
PID 1936 wrote to memory of 3068	1936	Client.exe	schtasks.exe
PID 1936 wrote to memory of 3068	1936	Client.exe	schtasks.exe
PID 1936 wrote to memory of 3068	1936	Client.exe	schtasks.exe
PID 1936 wrote to memory of 316	1936	Client.exe	cmd.exe
PID 1936 wrote to memory of 316	1936	Client.exe	cmd.exe
PID 1936 wrote to memory of 316	1936	Client.exe	cmd.exe
PID 1936 wrote to memory of 316	1936	Client.exe	cmd.exe
PID 316 wrote to memory of 1884	316	cmd.exe	chcp.com
PID 316 wrote to memory of 1884	316	cmd.exe	chcp.com
PID 316 wrote to memory of 1884	316	cmd.exe	chcp.com
PID 316 wrote to memory of 1884	316	cmd.exe	chcp.com
PID 316 wrote to memory of 1252	316	cmd.exe	PING.EXE
PID 316 wrote to memory of 1252	316	cmd.exe	PING.EXE
PID 316 wrote to memory of 1252	316	cmd.exe	PING.EXE
PID 316 wrote to memory of 1252	316	cmd.exe	PING.EXE
PID 316 wrote to memory of 788	316	cmd.exe	Client.exe
PID 316 wrote to memory of 788	316	cmd.exe	Client.exe
PID 316 wrote to memory of 788	316	cmd.exe	Client.exe
PID 316 wrote to memory of 788	316	cmd.exe	Client.exe
PID 316 wrote to memory of 788	316	cmd.exe	Client.exe
PID 316 wrote to memory of 788	316	cmd.exe	Client.exe
PID 316 wrote to memory of 788	316	cmd.exe	Client.exe
PID 788 wrote to memory of 1568	788	Client.exe	schtasks.exe
PID 788 wrote to memory of 1568	788	Client.exe	schtasks.exe
PID 788 wrote to memory of 1568	788	Client.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (103) - Copy - Copy - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (103) - Copy - Copy - Copy.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (103) - Copy - Copy - Copy.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2952

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1432

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\IhsH40olLSYM.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:1932

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:2872

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:3068

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\uAwkq2Vpi7EM.bat" "
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\SysWOW64\chcp.com
chcp 65001
6⤵
PID:1884

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:1252

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
7⤵
- Creates scheduled task(s)
PID:1568

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\iAaElUHvLAty.bat" "
7⤵
- Loads dropped DLL
PID:1132

C:\Windows\SysWOW64\chcp.com
chcp 65001
8⤵
PID:1852

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:1840

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
9⤵
- Creates scheduled task(s)
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\8zuTglHvIMrB.bat" "
9⤵
PID:2616

C:\Windows\SysWOW64\chcp.com
chcp 65001
10⤵
PID:856

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
10⤵
- Runs ping.exe
PID:1260

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Uni - Copy (103) - Copy - Copy - Copy.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (103) - Copy - Copy - Copy.exe'" /sc onlogon /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:1608

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8zuTglHvIMrB.bat
Filesize
207B

MD5
7ee78f4a2ddea9e19f8eb50ace237883

SHA1
c94eab1e4ede4d8b9d286f29a03345c280f00641

SHA256
6d1c84edd5003073a16fc29a4051b9c6417af6674201b29be4c44307976c5269

SHA512
9f29830a80a24985f304f0c49e6e5e780475ca3d221212a1325d3d19d7e028c9467a6f2544ccba66254702de76334a2fb08fb21abbee6179e7067ca0f656287e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IhsH40olLSYM.bat
Filesize
207B

MD5
53f407d16a558393d2e2acd088c1b1ef

SHA1
dc0b8277ade2b34a1a822835cff97bd986ddd421

SHA256
6f0e870cb5f2e30cc47632f00480f9fd958bc8ab81a05c0256b00d394ab5972f

SHA512
c5101000000f9c2feba4256a86b2601f592441c286b0272cb871f5310391dbc34630fc2111acbb37049262771caf5761556e92a87ca135c022302ab852bdbe2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\iAaElUHvLAty.bat
Filesize
207B

MD5
da5b7b89f973b4446021b81cdb527573

SHA1
6ccbde21e73bd303facf91529bc7c7cc9761ce87

SHA256
49809953abe132c177e9cc1457a3efd6a4fcb2474cd4e5de891176ef561e9edb

SHA512
0af8d44aa14d88a24073bdd829a0aea90bac2a400334af3d7ad1ea02994d8ee3ff56625ed1e9701772abfb809bcc87df1d9fbb5fdf9a6336a5d0dce1f2567dab

Download Submit
C:\Users\Admin\AppData\Local\Temp\uAwkq2Vpi7EM.bat
Filesize
207B

MD5
6750e905b70526d7b731bbf0082f3363

SHA1
ca1b8ea51437fbe7f86d93ac3daf1dac4f893f52

SHA256
35ca458f252100d83203b67f2c5cf52f18d4e3d5d93d32032701fdb9039d69bc

SHA512
cac426711907b6decc93bdf86dd304e6d1dbdf7dc1ee3e64bd827a8dbb870a2cab4d08626a93a900bb32a40d0c2acb051b4583559be3804e277501ca5fac19f1

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
409KB

MD5
b70fdac25a99501e3cae11f1b775249e

SHA1
3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

SHA256
51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

SHA512
43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

Download Submit
memory/788-41-0x00000000009E0000-0x0000000000A4C000-memory.dmp

Filesize
432KB

Download
memory/1936-29-0x0000000000800000-0x000000000086C000-memory.dmp

Filesize
432KB

Download
memory/2036-25-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2036-13-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2036-16-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2036-14-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2036-12-0x0000000000030000-0x000000000009C000-memory.dmp

Filesize
432KB

Download
memory/2060-15-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2060-0-0x000000007482E000-0x000000007482F000-memory.dmp

Filesize
4KB

Download
memory/2060-4-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2060-3-0x000000007482E000-0x000000007482F000-memory.dmp

Filesize
4KB

Download
memory/2060-2-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2060-1-0x0000000001090000-0x00000000010FC000-memory.dmp

Filesize
432KB

Download
memory/2600-53-0x0000000001270000-0x00000000012DC000-memory.dmp

Filesize
432KB

Download