quasar | b8494002dc22dd75ad9306fe717cf382cc567d582027d86830be432db3e949e2

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LisectAVT_2403002B_361.exe
Size 788KB
Sample240725-bplsassdnf
SHA256 b8494002dc22dd75ad9306fe717cf382cc567d582027d86830be432db3e949e2
MD5 dccd94b19667d18cd86f96d4ac328c6a
SHA1 950f52417e48b3ec3f1cd5791eccd8cc4ed9fa40
SHA512 21dadb8aff2684b2310f45d88a3b5c689195aa77b3129f175f16c2b395cbe8243cc554c25c8bc764fc7405bec1e58fd7ec178fd69c8590a1ae68a04339186ff4
SSDEEP 12288:h4/03kbYnjHZBuxcm0zSGfb9BNXWv19IhN/w+ueXHGCoarJg/Mipb4ZP9rSkSHJu:g03kaEQDfb/T7r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar discovery spyware trojan

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/440-14-0x0000000000400000-0x0000000000456000-memory.dmp	disable_win_def

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/440-14-0x0000000000400000-0x0000000000456000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	LisectAVT_2403002B_361.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	LisectAVT_2403002B_361.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
43	pastebin.com
44	pastebin.com
65	pastebin.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2264 set thread context of 440	2264	LisectAVT_2403002B_361.exe	98
PID 3400 set thread context of 2360	3400	LisectAVT_2403002B_361.exe	115

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LisectAVT_2403002B_361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LisectAVT_2403002B_361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LisectAVT_2403002B_361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LisectAVT_2403002B_361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LisectAVT_2403002B_361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3744	PING.EXE
4300	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3744	PING.EXE
4300	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2264	LisectAVT_2403002B_361.exe
2264	LisectAVT_2403002B_361.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2264	LisectAVT_2403002B_361.exe
Token: SeDebugPrivilege	440	LisectAVT_2403002B_361.exe
Token: SeDebugPrivilege	2360	LisectAVT_2403002B_361.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 1728	2264	LisectAVT_2403002B_361.exe	97
PID 2264 wrote to memory of 1728	2264	LisectAVT_2403002B_361.exe	97
PID 2264 wrote to memory of 1728	2264	LisectAVT_2403002B_361.exe	97
PID 2264 wrote to memory of 440	2264	LisectAVT_2403002B_361.exe	98
PID 2264 wrote to memory of 440	2264	LisectAVT_2403002B_361.exe	98
PID 2264 wrote to memory of 440	2264	LisectAVT_2403002B_361.exe	98
PID 2264 wrote to memory of 440	2264	LisectAVT_2403002B_361.exe	98
PID 2264 wrote to memory of 440	2264	LisectAVT_2403002B_361.exe	98
PID 2264 wrote to memory of 440	2264	LisectAVT_2403002B_361.exe	98
PID 2264 wrote to memory of 440	2264	LisectAVT_2403002B_361.exe	98
PID 2264 wrote to memory of 440	2264	LisectAVT_2403002B_361.exe	98
PID 440 wrote to memory of 1236	440	LisectAVT_2403002B_361.exe	99
PID 440 wrote to memory of 1236	440	LisectAVT_2403002B_361.exe	99
PID 440 wrote to memory of 1236	440	LisectAVT_2403002B_361.exe	99
PID 1236 wrote to memory of 1308	1236	cmd.exe	101
PID 1236 wrote to memory of 1308	1236	cmd.exe	101
PID 1236 wrote to memory of 1308	1236	cmd.exe	101
PID 1236 wrote to memory of 3744	1236	cmd.exe	102
PID 1236 wrote to memory of 3744	1236	cmd.exe	102
PID 1236 wrote to memory of 3744	1236	cmd.exe	102
PID 1236 wrote to memory of 3400	1236	cmd.exe	103
PID 1236 wrote to memory of 3400	1236	cmd.exe	103
PID 1236 wrote to memory of 3400	1236	cmd.exe	103
PID 3400 wrote to memory of 2360	3400	LisectAVT_2403002B_361.exe	115
PID 3400 wrote to memory of 2360	3400	LisectAVT_2403002B_361.exe	115
PID 3400 wrote to memory of 2360	3400	LisectAVT_2403002B_361.exe	115
PID 3400 wrote to memory of 2360	3400	LisectAVT_2403002B_361.exe	115
PID 3400 wrote to memory of 2360	3400	LisectAVT_2403002B_361.exe	115
PID 3400 wrote to memory of 2360	3400	LisectAVT_2403002B_361.exe	115
PID 3400 wrote to memory of 2360	3400	LisectAVT_2403002B_361.exe	115
PID 3400 wrote to memory of 2360	3400	LisectAVT_2403002B_361.exe	115
PID 2360 wrote to memory of 3456	2360	LisectAVT_2403002B_361.exe	116
PID 2360 wrote to memory of 3456	2360	LisectAVT_2403002B_361.exe	116
PID 2360 wrote to memory of 3456	2360	LisectAVT_2403002B_361.exe	116
PID 3456 wrote to memory of 644	3456	cmd.exe	118
PID 3456 wrote to memory of 644	3456	cmd.exe	118
PID 3456 wrote to memory of 644	3456	cmd.exe	118
PID 3456 wrote to memory of 4300	3456	cmd.exe	119
PID 3456 wrote to memory of 4300	3456	cmd.exe	119
PID 3456 wrote to memory of 4300	3456	cmd.exe	119
PID 3456 wrote to memory of 980	3456	cmd.exe	120
PID 3456 wrote to memory of 980	3456	cmd.exe	120
PID 3456 wrote to memory of 980	3456	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_361.exe
"C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_361.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_361.exe
  "C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_361.exe"
  2⤵
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_361.exe
  "C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_361.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aq7JYI5ca9ae.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:1308
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_361.exe
      "C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_361.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_361.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_361.exe"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2360
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HuF9Js0b3nOF.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:644
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_361.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_361.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LisectAVT_2403002B_361.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002B_361.exe.log
Size 1KB
SHA256 c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
MD5 17573558c4e714f606f997e5157afaac
SHA1 13e16e9415ceef429aaf124139671ebeca09ed23
SHA512 f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
MD5 SHA1 SHA512

Submit Download

HuF9Js0b3nOF.bat

Path C:\Users\Admin\AppData\Local\Temp\HuF9Js0b3nOF.bat
Size 219B
SHA256 a0f1874dfc5c9faece7894a6d0f8570e77b7922f5fc60703706ee01800bfd919
MD5 ad408459d74bd3184b20f0db662820a0
SHA1 0790a27bc8532a52f78e17a2ceb14d44b5906b56
SHA512 9f0fc3a16ee7faa4cd8966139945b150545b73634dbd014e073bcec51737a21fadab8ab655010a26d7d307d83f16b6d1016836b546d7bde87bb762a258ad42d8
MD5 SHA1 SHA512

Submit Download

aq7JYI5ca9ae.bat

Path C:\Users\Admin\AppData\Local\Temp\aq7JYI5ca9ae.bat
Size 219B
SHA256 7219a0ce5d13f816b2b0457fa37e3fdfbe6330a202e5ae79d75b0d73a2acffb4
MD5 f5c205a74967e737139891912aa689ec
SHA1 0c6e5d8ff58073ff0647fdfed4c078177ec2ac6f
SHA512 a82c4441e59555da01574bde47161e08169513bfaa3b0960d17bb595f8e6a03b1908171a4de9288ca256092c97b82b32858ad27956ef1ba14e0a8e44936eabbb
MD5 SHA1 SHA512

Submit Download

settings.xml

Path C:\Users\Admin\AppData\Local\Temp\settings.xml
Size 76B
SHA256 5f8802d87779b7e354ae4d33a78558366cac9053859977dbc1bc74a55b547fd5
MD5 a0f68380a60657884dc5aa4adbf5f131
SHA1 d06932df35dd096cbef1d33e62f997389c9af63f
SHA512 9fbfbfc27cfd4e5a1c3e8fc8210281777826b0438004d8165bf20c8f9526b40e439781456d1090aae3d840e53cab64e28d43d2b8226f8ae7b90cd91955f0a1e5
MD5 SHA1 SHA512

Submit Download

memory/440-14-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/440-24-0x00000000747E0000-0x0000000074F90000-memory.dmp

Download

memory/440-20-0x00000000747E0000-0x0000000074F90000-memory.dmp

Download

memory/440-18-0x00000000747E0000-0x0000000074F90000-memory.dmp

Download

memory/2264-5-0x000000000AB20000-0x000000000ABB2000-memory.dmp

Download

memory/2264-7-0x00000000747E0000-0x0000000074F90000-memory.dmp

Download

memory/2264-10-0x00000000747EE000-0x00000000747EF000-memory.dmp

Download

memory/2264-11-0x00000000747E0000-0x0000000074F90000-memory.dmp

Download

memory/2264-12-0x0000000005F90000-0x0000000006002000-memory.dmp

Download

memory/2264-13-0x0000000006000000-0x0000000006058000-memory.dmp

Download

memory/2264-8-0x0000000005810000-0x0000000005866000-memory.dmp

Download

memory/2264-9-0x00000000056F0000-0x00000000056FA000-memory.dmp

Download

memory/2264-17-0x00000000747E0000-0x0000000074F90000-memory.dmp

Download

memory/2264-6-0x0000000005630000-0x000000000563A000-memory.dmp

Download

memory/2264-0-0x00000000747EE000-0x00000000747EF000-memory.dmp

Download

memory/2264-4-0x000000000B0D0000-0x000000000B674000-memory.dmp

Download

memory/2264-3-0x000000000AA80000-0x000000000AB1C000-memory.dmp

Download

memory/2264-2-0x0000000005570000-0x00000000055E6000-memory.dmp

Download

memory/2264-1-0x0000000000A90000-0x0000000000B5A000-memory.dmp

Download