quasar | 6933064db7ff556b54f29cb8be4e9c8bf05be46efcb60795949f437b84d7d763

Analysis

max time kernel
153s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uni.bat
Size 5.1MB
Sample240625-ehmb2asfkl
SHA256 6933064db7ff556b54f29cb8be4e9c8bf05be46efcb60795949f437b84d7d763
MD5 fda503073bb918383839d4fb1b14604a
SHA1 db1efd8c3ad468728489748a65d5ab813ebbf659
SHA512 f450b1ae21dacdbfe31978b0b4188c3393c89f78567829dd0a4ac39214b10402d593d79bf3ce76fa42ab3d032debab24b1d4aa835126eff69fa674d24855c473
SSDEEP 24576:4JcksZhAsxLu9bEUt4Qa1CFQa5Z4tp5ljbjvGr2BBgfretKRxMp+hrQB0eJM2a88:WpbESV0MFJn90hK0PgH/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar shibagt genesis spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

ShibaGt Genesis

aimbotfr-31586.portmap.host:31586

Mutex

0416d110-fc14-431b-bc09-289901c057d0

Attributes

encryption_key
781803C0F5ECC853245A5DCAFC26FDA8D32FBB12
install_name
starthost.exe
log_directory
Logs
reconnect_delay
3
startup_key
start
subdirectory
Microsofty

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000000070f-62216.dat	family_quasar
behavioral2/memory/2480-62219-0x0000000000F20000-0x0000000001244000-memory.dmp	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
2480	x.exe
2252	starthost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Microsofty\starthost.exe	x.exe
File opened for modification	C:\Program Files\Microsofty\starthost.exe	x.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2288	schtasks.exe
4672	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	x.exe
Token: SeDebugPrivilege	2252	starthost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	starthost.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2252	starthost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4508	4960	cmd.exe	102
PID 4960 wrote to memory of 4508	4960	cmd.exe	102
PID 4960 wrote to memory of 3680	4960	cmd.exe	103
PID 4960 wrote to memory of 3680	4960	cmd.exe	103
PID 4960 wrote to memory of 2480	4960	cmd.exe	104
PID 4960 wrote to memory of 2480	4960	cmd.exe	104
PID 2480 wrote to memory of 2288	2480	x.exe	105
PID 2480 wrote to memory of 2288	2480	x.exe	105
PID 2480 wrote to memory of 2252	2480	x.exe	107
PID 2480 wrote to memory of 2252	2480	x.exe	107
PID 2252 wrote to memory of 4672	2252	starthost.exe	108
PID 2252 wrote to memory of 4672	2252	starthost.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\uni.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\system32\findstr.exe
  findstr /e "'v" "C:\Users\Admin\AppData\Local\Temp\uni.bat"
  2⤵
  PID:4508
- C:\Windows\system32\cscript.exe
  cscript //nologo C:\Users\Admin\AppData\Local\Temp\x.vbs
  2⤵
  PID:3680
- C:\Users\Admin\AppData\Local\Temp\x.exe
  C:\Users\Admin\AppData\Local\Temp\x.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "start" /sc ONLOGON /tr "C:\Program Files\Microsofty\starthost.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2288
- - C:\Program Files\Microsofty\starthost.exe
    "C:\Program Files\Microsofty\starthost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "start" /sc ONLOGON /tr "C:\Program Files\Microsofty\starthost.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4KB
SHA256 ea53f7e72adfba1deb08059c06b7ab1a1f4547a154a0d3c74fdc3a9d5f1d2870
MD5 44ff5d18be31712de1575e4714e3c641
SHA1 824318b9ae2ee5f4fc77dd8a2b8a54f794462de8
SHA512 bf8955d83360185d05cf1a67ef9d42c04ed2782992c6726d081f54093a0d6864004b0304c0e90a22778cf0b9c37ad84a5ae4630374d322e514ac895c8f641e96
SSDEEP 96:R9jzzhSoMq6pprE23qnxmw8TWQZjhRQRSau1fM10IDUWH42:P3zdMqAx3qxmw8TWqhFauhM10no1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4.3MB
SHA256 1c38475987ddb81947d224ba14dabecbb8a3031e1ac04d49e24b2770ca22af01
MD5 c9454c04f2284221220c92f4c0ca8cae
SHA1 837564a34f796b86e297eba1116221b9e2ddeb3c
SHA512 75a45bad9375fa9d90b6c28505a136abbbcad81ed344db66a5c74698a4bf74a298cdca4adec1feaca85199b8c74148ba2fdfdd652abe1a3436b31f0b6d73bddf
SSDEEP 24576:SpoMk5BEANv2JPGz8Bm58qd2Rbsm5aK4VJhlfrHLqvCZ9YNEGXCNOJdAVixXE5IF:s1PGzehZ88Zx75YgGs
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 3.1MB
SHA256 f26b652a913a36265448082b0ec17342bed8ae0787dc07409cf5c3fb1fb316b3
MD5 59b3f92736ca3c2a7628a575c6116374
SHA1 fb37766e75ebcf57d704dfa4acf8370a95d85fd4
SHA512 86933ff7ebfc13667029e8e2a14ef6f3fbba927e109788613e16c77da64ccb9a725e94d2ce3c329c882d33cd801fa030aee640f66411b52946941521300061a1
SSDEEP 49152:6vGI22SsaNYfdPBldt698dBcjH4wQaEfeak/l4BoGdTTHHB72eh2NT:6vL22SsaNYfdPBldt6+dBcjH4wQqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.vbs

Path C:\Users\Admin\AppData\Local\Temp\x.vbs
Size 380B
SHA256 cf8268d158bb819ef158ff6ccbed64d5e379148a0adb1f73a082a01d56d0286b
MD5 ec9a2fb69a379d913a4e0a953cd3b97c
SHA1 a0303ed9f787c042071a1286bba43a5bbdd0679e
SHA512 fef8e24a680991046bd7dacd6079c7e48c3031fe46caae722ea93797ee16c052073ba97959e992ea71ac7ab72fbcedaa5cf4a410657aac4c10ad24de6935e9d6
MD5 SHA1 SHA512

Submit Download

memory/2252-62227-0x000000001C7E0000-0x000000001C830000-memory.dmp

Download

memory/2480-62218-0x00007FFC3C583000-0x00007FFC3C585000-memory.dmp

Download

memory/2480-62219-0x0000000000F20000-0x0000000001244000-memory.dmp

Download

memory/2480-62220-0x00007FFC3C580000-0x00007FFC3D041000-memory.dmp

Download

memory/2480-62226-0x00007FFC3C580000-0x00007FFC3D041000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads