quasar | 1a4689bd6cc37dac5abf6a68afda78aa46cf114aadb276b21299d1f566e4ef58

Analysis

max time kernel
297s
max time network
305s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uni/Uni - Copy (10) - Copy - Copy - Copy.exe
Size

409KB
MD5

b70fdac25a99501e3cae11f1b775249e
SHA1

3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
SHA256

51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
SHA512

43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
SSDEEP

12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

Score

10^/10

quasar seroxen spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

panel-slave.gl.at.ply.gg:57059

panel-slave.gl.at.ply.gg:27892

Mutex

$Sxr-rpL8EItHN3pqIQQVy2

Attributes

encryption_key
Lme7VBS3l58VwLM69PNM
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SeroXen
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1724-1-0x0000000000C60000-0x0000000000CCC000-memory.dmp	family_quasar
\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
behavioral3/memory/2136-12-0x0000000000F70000-0x0000000000FDC000-memory.dmp	family_quasar
behavioral3/memory/1420-29-0x00000000013B0000-0x000000000141C000-memory.dmp	family_quasar
behavioral3/memory/3044-41-0x0000000000340000-0x00000000003AC000-memory.dmp	family_quasar
behavioral3/memory/2488-53-0x0000000000890000-0x00000000008FC000-memory.dmp	family_quasar

Executes dropped EXE 4 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exe

pid process

2136 Client.exe
1420 Client.exe
3044 Client.exe
2488 Client.exe
Loads dropped DLL 4 IoCs

Processes:

Uni - Copy (10) - Copy - Copy - Copy.execmd.execmd.execmd.exe

pid process

1724 Uni - Copy (10) - Copy - Copy - Copy.exe
1964 cmd.exe
552 cmd.exe
2312 cmd.exe
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 api.ipify.org
21 ip-api.com
23 api.ipify.org
2 ip-api.com
11 api.ipify.org
15 ip-api.com
29 api.ipify.org
6 api.ipify.org
8 ip-api.com
27 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeSCHTASKS.exeschtasks.exeschtasks.exe

pid process

1504 schtasks.exe
2744 schtasks.exe
2068 schtasks.exe
2356 SCHTASKS.exe
1188 schtasks.exe
1904 schtasks.exe
Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

2148 PING.EXE
1736 PING.EXE
1620 PING.EXE
2832 PING.EXE

pid	process
2136	Client.exe
1420	Client.exe
3044	Client.exe
2488	Client.exe

pid	process
1724	Uni - Copy (10) - Copy - Copy - Copy.exe
1964	cmd.exe
552	cmd.exe
2312	cmd.exe

flow	ioc
17	api.ipify.org
21	ip-api.com
23	api.ipify.org
2	ip-api.com
11	api.ipify.org
15	ip-api.com
29	api.ipify.org
6	api.ipify.org
8	ip-api.com
27	ip-api.com

pid	process
1504	schtasks.exe
2744	schtasks.exe
2068	schtasks.exe
2356	SCHTASKS.exe
1188	schtasks.exe
1904	schtasks.exe

pid	process
2148	PING.EXE
1736	PING.EXE
1620	PING.EXE
2832	PING.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Uni - Copy (10) - Copy - Copy - Copy.exeClient.exeClient.exeClient.exeClient.exe

description	pid	process
Token: SeDebugPrivilege	1724	Uni - Copy (10) - Copy - Copy - Copy.exe
Token: SeDebugPrivilege	2136	Client.exe
Token: SeDebugPrivilege	1420	Client.exe
Token: SeDebugPrivilege	3044	Client.exe
Token: SeDebugPrivilege	2488	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Uni - Copy (10) - Copy - Copy - Copy.exeClient.execmd.exeClient.execmd.exeClient.exe

description	pid	process	target process
PID 1724 wrote to memory of 2068	1724	Uni - Copy (10) - Copy - Copy - Copy.exe	schtasks.exe
PID 1724 wrote to memory of 2068	1724	Uni - Copy (10) - Copy - Copy - Copy.exe	schtasks.exe
PID 1724 wrote to memory of 2068	1724	Uni - Copy (10) - Copy - Copy - Copy.exe	schtasks.exe
PID 1724 wrote to memory of 2068	1724	Uni - Copy (10) - Copy - Copy - Copy.exe	schtasks.exe
PID 1724 wrote to memory of 2136	1724	Uni - Copy (10) - Copy - Copy - Copy.exe	Client.exe
PID 1724 wrote to memory of 2136	1724	Uni - Copy (10) - Copy - Copy - Copy.exe	Client.exe
PID 1724 wrote to memory of 2136	1724	Uni - Copy (10) - Copy - Copy - Copy.exe	Client.exe
PID 1724 wrote to memory of 2136	1724	Uni - Copy (10) - Copy - Copy - Copy.exe	Client.exe
PID 1724 wrote to memory of 2136	1724	Uni - Copy (10) - Copy - Copy - Copy.exe	Client.exe
PID 1724 wrote to memory of 2136	1724	Uni - Copy (10) - Copy - Copy - Copy.exe	Client.exe
PID 1724 wrote to memory of 2136	1724	Uni - Copy (10) - Copy - Copy - Copy.exe	Client.exe
PID 1724 wrote to memory of 2356	1724	Uni - Copy (10) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 1724 wrote to memory of 2356	1724	Uni - Copy (10) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 1724 wrote to memory of 2356	1724	Uni - Copy (10) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 1724 wrote to memory of 2356	1724	Uni - Copy (10) - Copy - Copy - Copy.exe	SCHTASKS.exe
PID 2136 wrote to memory of 1188	2136	Client.exe	schtasks.exe
PID 2136 wrote to memory of 1188	2136	Client.exe	schtasks.exe
PID 2136 wrote to memory of 1188	2136	Client.exe	schtasks.exe
PID 2136 wrote to memory of 1188	2136	Client.exe	schtasks.exe
PID 2136 wrote to memory of 1964	2136	Client.exe	cmd.exe
PID 2136 wrote to memory of 1964	2136	Client.exe	cmd.exe
PID 2136 wrote to memory of 1964	2136	Client.exe	cmd.exe
PID 2136 wrote to memory of 1964	2136	Client.exe	cmd.exe
PID 1964 wrote to memory of 1932	1964	cmd.exe	chcp.com
PID 1964 wrote to memory of 1932	1964	cmd.exe	chcp.com
PID 1964 wrote to memory of 1932	1964	cmd.exe	chcp.com
PID 1964 wrote to memory of 1932	1964	cmd.exe	chcp.com
PID 1964 wrote to memory of 2148	1964	cmd.exe	PING.EXE
PID 1964 wrote to memory of 2148	1964	cmd.exe	PING.EXE
PID 1964 wrote to memory of 2148	1964	cmd.exe	PING.EXE
PID 1964 wrote to memory of 2148	1964	cmd.exe	PING.EXE
PID 1964 wrote to memory of 1420	1964	cmd.exe	Client.exe
PID 1964 wrote to memory of 1420	1964	cmd.exe	Client.exe
PID 1964 wrote to memory of 1420	1964	cmd.exe	Client.exe
PID 1964 wrote to memory of 1420	1964	cmd.exe	Client.exe
PID 1964 wrote to memory of 1420	1964	cmd.exe	Client.exe
PID 1964 wrote to memory of 1420	1964	cmd.exe	Client.exe
PID 1964 wrote to memory of 1420	1964	cmd.exe	Client.exe
PID 1420 wrote to memory of 1904	1420	Client.exe	schtasks.exe
PID 1420 wrote to memory of 1904	1420	Client.exe	schtasks.exe
PID 1420 wrote to memory of 1904	1420	Client.exe	schtasks.exe
PID 1420 wrote to memory of 1904	1420	Client.exe	schtasks.exe
PID 1420 wrote to memory of 552	1420	Client.exe	cmd.exe
PID 1420 wrote to memory of 552	1420	Client.exe	cmd.exe
PID 1420 wrote to memory of 552	1420	Client.exe	cmd.exe
PID 1420 wrote to memory of 552	1420	Client.exe	cmd.exe
PID 552 wrote to memory of 2844	552	cmd.exe	chcp.com
PID 552 wrote to memory of 2844	552	cmd.exe	chcp.com
PID 552 wrote to memory of 2844	552	cmd.exe	chcp.com
PID 552 wrote to memory of 2844	552	cmd.exe	chcp.com
PID 552 wrote to memory of 1736	552	cmd.exe	PING.EXE
PID 552 wrote to memory of 1736	552	cmd.exe	PING.EXE
PID 552 wrote to memory of 1736	552	cmd.exe	PING.EXE
PID 552 wrote to memory of 1736	552	cmd.exe	PING.EXE
PID 552 wrote to memory of 3044	552	cmd.exe	Client.exe
PID 552 wrote to memory of 3044	552	cmd.exe	Client.exe
PID 552 wrote to memory of 3044	552	cmd.exe	Client.exe
PID 552 wrote to memory of 3044	552	cmd.exe	Client.exe
PID 552 wrote to memory of 3044	552	cmd.exe	Client.exe
PID 552 wrote to memory of 3044	552	cmd.exe	Client.exe
PID 552 wrote to memory of 3044	552	cmd.exe	Client.exe
PID 3044 wrote to memory of 1504	3044	Client.exe	schtasks.exe
PID 3044 wrote to memory of 1504	3044	Client.exe	schtasks.exe
PID 3044 wrote to memory of 1504	3044	Client.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy - Copy - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy - Copy - Copy.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy - Copy - Copy.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2068

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1188

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\RmjAHMXzf5he.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:1932

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:2148

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1904

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\naEgPtNf5Syy.bat" "
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\SysWOW64\chcp.com
chcp 65001
6⤵
PID:2844

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:1736

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
7⤵
- Creates scheduled task(s)
PID:1504

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\ANjCXQDLWqGH.bat" "
7⤵
- Loads dropped DLL
PID:2312

C:\Windows\SysWOW64\chcp.com
chcp 65001
8⤵
PID:848

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:1620

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
9⤵
- Creates scheduled task(s)
PID:2744

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\FabX8uO5v17Z.bat" "
9⤵
PID:2760

C:\Windows\SysWOW64\chcp.com
chcp 65001
10⤵
PID:2020

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
10⤵
- Runs ping.exe
PID:2832

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Uni - Copy (10) - Copy - Copy - Copy.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (10) - Copy - Copy - Copy.exe'" /sc onlogon /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:2356

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ANjCXQDLWqGH.bat
Filesize
207B

MD5
3c6e004c8edfd551bbbbea5f1cd114e2

SHA1
c41c8f35ec9eeb652f58aad97645c9b3672769c0

SHA256
d825bc510b6c47717ed7e313e6eeeedbe174aa846735de6e78172b3330dc9222

SHA512
15ab70e77f5a0ca1c55901aa06827edc9cee31918bca8763ba99a0ffbf10e20a7d6f11991a3f8735b49169290e04cc5036ff408d0cc28bf50ac5a17f4f7d1c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\FabX8uO5v17Z.bat
Filesize
207B

MD5
95bc1ca9db7298fe2f2b91ab8af20f20

SHA1
f08c0a624a478ef3ac7d2a6f1dfef7076920be20

SHA256
e9bfdfee5bd10dd39ee17f184262369c8db1a62040e670eaed40da5c275738a8

SHA512
792171272e4ba4f61803cafdadf25d5b8c398303c82aa91998388c2729295fcc7b54eded02e0aee9e354f9aed2e6b1d0490c2a34788b3029e1ab7db50e1798a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RmjAHMXzf5he.bat
Filesize
207B

MD5
bff54bb6f4c3f42a1555c04e2d4e8ce0

SHA1
14fddbfef7d62760e43e9cc76d36bf164e80d8ab

SHA256
056b7fd75497d47c536963d8504884b01c090800c4895620776ce8ba86af3a52

SHA512
df0f738c842188d7d3102f4030065daa7db20755cb84867ac53aaaf261fe61da49ae8e9dc1f945b46795abd7172a6114a23cc6aff71116f585d10d185ad5c9cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\naEgPtNf5Syy.bat
Filesize
207B

MD5
fc58e7b7fdecfd102a5e437bd886edbb

SHA1
a23a6bde7d03285cfeb08b4bf9d55343c894bef7

SHA256
deb13e13e71de4fc9b68bac2baab4ab11a0a0fa191bce818804b79e5ef1eb028

SHA512
39da5716962bda55b39538e40df896b62ba8b99f99c55e7a080f9fb74f3a80c71dbd72edb8046293c20a67714c7a7e395d5189bec0ec5d82f4bfab9ae347432d

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
409KB

MD5
b70fdac25a99501e3cae11f1b775249e

SHA1
3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

SHA256
51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

SHA512
43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

Download Submit
memory/1420-29-0x00000000013B0000-0x000000000141C000-memory.dmp

Filesize
432KB

Download
memory/1724-1-0x0000000000C60000-0x0000000000CCC000-memory.dmp

Filesize
432KB

Download
memory/1724-2-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/1724-3-0x00000000743BE000-0x00000000743BF000-memory.dmp

Filesize
4KB

Download
memory/1724-4-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/1724-0-0x00000000743BE000-0x00000000743BF000-memory.dmp

Filesize
4KB

Download
memory/1724-15-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2136-14-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2136-25-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2136-16-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2136-13-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2136-12-0x0000000000F70000-0x0000000000FDC000-memory.dmp

Filesize
432KB

Download
memory/2488-53-0x0000000000890000-0x00000000008FC000-memory.dmp

Filesize
432KB

Download
memory/3044-41-0x0000000000340000-0x00000000003AC000-memory.dmp

Filesize
432KB

Download