quasar | 9b30d56582fe726da08bad8f8178fedefa6194c5417e2f9b1c5881981f56ef74

Analysis

max time kernel
289s
max time network
291s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Uni.exe
Size 409KB
Sample240624-v99veavbkd
SHA256 9b30d56582fe726da08bad8f8178fedefa6194c5417e2f9b1c5881981f56ef74
MD5 9f05a44692ab204380393da7e139c691
SHA1 54ec2cf0d7c5a5a292c50d1f195503c636e13e89
SHA512 e24b365cc7abece9ed4c2160a735a8c3f4a3741ecce1eadc1a8140f197dedf63ab07f544f2f195b34d5f18c38827a94325d9d2158d05e7bc9985cd6b645b5e66
SSDEEP 6144:iMvlpdRJjGq/l5hUUbFc/xoKi21l18Xb5hV7XhWD1lBRZ9P2mUbmm:5pbJjGuPhUUbFc5zirNhE1VZcmVm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar loader client spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

Loader Client

panel-slave.gl.at.ply.gg:57059
panel-slave.gl.at.ply.gg:27892

Mutex

$Sxr-rpL8EItHN3pqIQQVy2

Attributes

encryption_key
KLdQT7Z7AxndzuZQdagT
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SeroXen
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/1644-1-0x0000000000050000-0x00000000000BC000-memory.dmp	family_quasar
behavioral2/files/0x00090000000234bc-11.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2444	Client.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ip-api.com

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3700	schtasks.exe
4684	SCHTASKS.exe
4528	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	Uni.exe
Token: SeDebugPrivilege	2444	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2444	Client.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 3700	1644	Uni.exe	87
PID 1644 wrote to memory of 3700	1644	Uni.exe	87
PID 1644 wrote to memory of 3700	1644	Uni.exe	87
PID 1644 wrote to memory of 2444	1644	Uni.exe	89
PID 1644 wrote to memory of 2444	1644	Uni.exe	89
PID 1644 wrote to memory of 2444	1644	Uni.exe	89
PID 1644 wrote to memory of 4684	1644	Uni.exe	90
PID 1644 wrote to memory of 4684	1644	Uni.exe	90
PID 1644 wrote to memory of 4684	1644	Uni.exe	90
PID 2444 wrote to memory of 4528	2444	Client.exe	92
PID 2444 wrote to memory of 4528	2444	Client.exe	92
PID 2444 wrote to memory of 4528	2444	Client.exe	92

C:\Users\Admin\AppData\Local\Temp\Uni.exe
"C:\Users\Admin\AppData\Local\Temp\Uni.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Uni.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3700
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4528
- C:\Windows\SysWOW64\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "$77Uni.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Uni.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 409KB
SHA256 9b30d56582fe726da08bad8f8178fedefa6194c5417e2f9b1c5881981f56ef74
MD5 9f05a44692ab204380393da7e139c691
SHA1 54ec2cf0d7c5a5a292c50d1f195503c636e13e89
SHA512 e24b365cc7abece9ed4c2160a735a8c3f4a3741ecce1eadc1a8140f197dedf63ab07f544f2f195b34d5f18c38827a94325d9d2158d05e7bc9985cd6b645b5e66
SSDEEP 6144:iMvlpdRJjGq/l5hUUbFc/xoKi21l18Xb5hV7XhWD1lBRZ9P2mUbmm:5pbJjGuPhUUbFc5zirNhE1VZcmVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1644-6-0x0000000005080000-0x0000000005092000-memory.dmp

Download

memory/1644-1-0x0000000000050000-0x00000000000BC000-memory.dmp

Download

memory/1644-3-0x0000000004AF0000-0x0000000004B82000-memory.dmp

Download

memory/1644-4-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/1644-5-0x0000000004B90000-0x0000000004BF6000-memory.dmp

Download

memory/1644-0-0x00000000751EE000-0x00000000751EF000-memory.dmp

Download

memory/1644-7-0x0000000005E70000-0x0000000005EAC000-memory.dmp

Download

memory/1644-2-0x00000000050A0000-0x0000000005644000-memory.dmp

Download

memory/1644-16-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/2444-14-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/2444-13-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/2444-18-0x00000000063F0000-0x00000000063FA000-memory.dmp

Download

memory/2444-19-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/2444-20-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads