quasar | f5acec48afbdd2a4850462e4613ce91c983bc3a3498c69a306a4ca12ccd15de0

Analysis

max time kernel
134s
max time network
145s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16-06-2024 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Server.exe
Size

3.1MB
MD5

e45a6c438c6ab1538b44fc43a242a5d3
SHA1

00a85654779955ca989d1f2907ea1831b2511688
SHA256

f5acec48afbdd2a4850462e4613ce91c983bc3a3498c69a306a4ca12ccd15de0
SHA512

806783dfc96b3a97c11675236d31f10c6540668e6149ab158eea680b0f84248b7b25ba4f36b4790250459b87e2b0bc91d551b07a79e236c8a4356df4f3878a6f
SSDEEP

49152:LvelL26AaNeWgPhlmVqvMQ7XSKybCaSmz/ZoGdmTHHB72eh2NT:LvOL26AaNeWgPhlmVqkQ7XSKoCaZ

Score

10^/10

quasar stealer spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Stealer

battery-stripes.gl.at.ply.gg:26129

Mutex

b5481c41-4bb5-4640-a5ee-20f5c734de54

Attributes

encryption_key
FA1E38D5CB08766F486F72A0AB91AE27E1725C2B
install_name
Runtime Broker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Runtime Broker
subdirectory
WD

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1888-1-0x00000000007A0000-0x0000000000AC4000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Runtime Broker.exe

pid process

836 Runtime Broker.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4892 schtasks.exe
3908 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Server.exeRuntime Broker.exe

description pid process

Token: SeDebugPrivilege 1888 Server.exe
Token: SeDebugPrivilege 836 Runtime Broker.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Runtime Broker.exe

pid process

836 Runtime Broker.exe

pid	process
836	Runtime Broker.exe

pid	process
4892	schtasks.exe
3908	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1888	Server.exe
Token: SeDebugPrivilege	836	Runtime Broker.exe

pid	process
836	Runtime Broker.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Server.exeRuntime Broker.exe

description	pid	process	target process
PID 1888 wrote to memory of 4892	1888	Server.exe	schtasks.exe
PID 1888 wrote to memory of 4892	1888	Server.exe	schtasks.exe
PID 1888 wrote to memory of 836	1888	Server.exe	Runtime Broker.exe
PID 1888 wrote to memory of 836	1888	Server.exe	Runtime Broker.exe
PID 836 wrote to memory of 3908	836	Runtime Broker.exe	schtasks.exe
PID 836 wrote to memory of 3908	836	Runtime Broker.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:4892

C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:3908

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WD\Runtime Broker.exe
Filesize
3.1MB

MD5
e45a6c438c6ab1538b44fc43a242a5d3

SHA1
00a85654779955ca989d1f2907ea1831b2511688

SHA256
f5acec48afbdd2a4850462e4613ce91c983bc3a3498c69a306a4ca12ccd15de0

SHA512
806783dfc96b3a97c11675236d31f10c6540668e6149ab158eea680b0f84248b7b25ba4f36b4790250459b87e2b0bc91d551b07a79e236c8a4356df4f3878a6f

Download Submit
memory/836-10-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/836-11-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/836-12-0x000000001BC80000-0x000000001BCD0000-memory.dmp

Filesize
320KB

Download
memory/836-13-0x000000001C420000-0x000000001C4D2000-memory.dmp

Filesize
712KB

Download
memory/836-16-0x000000001BD00000-0x000000001BD12000-memory.dmp

Filesize
72KB

Download
memory/836-17-0x000000001C3A0000-0x000000001C3DE000-memory.dmp

Filesize
248KB

Download
memory/836-18-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/1888-0-0x00007FF91EBF3000-0x00007FF91EBF4000-memory.dmp

Filesize
4KB

Download
memory/1888-1-0x00000000007A0000-0x0000000000AC4000-memory.dmp

Filesize
3.1MB

Download
memory/1888-2-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download
memory/1888-9-0x00007FF91EBF0000-0x00007FF91F5DC000-memory.dmp

Filesize
9.9MB

Download