quasar | 17242abb236c188858e3e908bde7c005563f15394b3fbc038eb15b9ab1cbeae2

Analysis

max time kernel
128s
max time network
141s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

1847b8b946ac903e78e64910c28d3b11
SHA1

63da434139fb81e5b4fb6934227b41ba4027117c
SHA256

17242abb236c188858e3e908bde7c005563f15394b3fbc038eb15b9ab1cbeae2
SHA512

11e2aa6f82cebafd81960001b7f7fd4ffcf0cb73f6a350f429cda1f918a980498f2697a5842d5f42af8015c7b0c9c19bd793c61c3eed72174a824d549827c824
SSDEEP

49152:XvOlL26AaNeWgPhlmVqvMQ7XSKJa1MzQbtvJG3oGd+BTHHB72eh2NT:Xv+L26AaNeWgPhlmVqkQ7XSKsbbU

Score

10^/10

quasar eyewalled spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Eyewalled

147.185.221.18:18043

147.185.221.18:1358

Mutex

5db6556f-7c80-43cf-b281-328d6344d9a3

Attributes

encryption_key
41EF2CD18F9D26A3BF2E5D47072FCE9779CF25CA
install_name
Client.exe
log_directory
Logs
reconnect_delay
3001
startup_key
Quasar Client Startup
subdirectory
Management

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2448-1-0x0000000001140000-0x0000000001464000-memory.dmp	family_quasar

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3036 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Client-built.exe

description pid process

Token: SeDebugPrivilege 2448 Client-built.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Client-built.exe

pid process

2448 Client-built.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Client-built.exe

pid process

2448 Client-built.exe

pid	process
3036	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2448	Client-built.exe

pid	process
2448	Client-built.exe

pid	process
2448	Client-built.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client-built.exe

description	pid	process	target process
PID 2448 wrote to memory of 3036	2448	Client-built.exe	schtasks.exe
PID 2448 wrote to memory of 3036	2448	Client-built.exe	schtasks.exe
PID 2448 wrote to memory of 3036	2448	Client-built.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2448

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\Management\Client.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:3036

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2448-0-0x000007FEF5B53000-0x000007FEF5B54000-memory.dmp

Filesize
4KB

Download
memory/2448-1-0x0000000001140000-0x0000000001464000-memory.dmp

Filesize
3.1MB

Download
memory/2448-2-0x000007FEF5B50000-0x000007FEF653C000-memory.dmp

Filesize
9.9MB

Download
memory/2448-3-0x000007FEF5B53000-0x000007FEF5B54000-memory.dmp

Filesize
4KB

Download
memory/2448-4-0x000007FEF5B50000-0x000007FEF653C000-memory.dmp

Filesize
9.9MB

Download