quasar | fc767ffc7f989455ce6aa641b29c14510d8de441cb423c211421e41d92febc10

General

Target
RedEngine.exe
Size 502KB
Sample240730-c26hxaxeqa
SHA256 67e35ca53e1ee18113207c2edf4b165ae9158cfed151e08bac627327f9c60f21
MD5 7178d81c9afdabb202f31315f7eed7e2
SHA1 527a063588b3e4d3acc04cf211d9b0df33f5ade2
SHA512 80b770bd2d3541400386c4aa446da8840823864a62d73554dd62ea08d5e9596f2b737fa8046eb6fb892690d115eb928022cdb1d24f4f8d9cf2e449adfd0809a5
SSDEEP 6144:9TEgdc0Y5XAGbgiIN2RSBTuYNzBlh/gKeFwQHocEhyb8F9ODx2cTR30:9TEgdfYVbg/uOiFwR12x2cd0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar training spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

TRAINING

C2

185.241.208.185:16145

Mutex

22073971-8d9a-4364-9916-abbb09ac9d8b

Attributes

encryption_key
7A9A8376440E3257DB2B54403642F366A5FBE14A
install_name
Starter Module.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Starter Module
subdirectory
Modules

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral7/memory/2948-1-0x0000000000AA0000-0x0000000000B24000-memory.dmp	family_quasar
behavioral7/files/0x00160000000174d0-6.dat	family_quasar
behavioral7/memory/2440-7-0x0000000000AB0000-0x0000000000B34000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2440	Starter Module.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\Modules\Starter Module.exe	RedEngine.exe
File opened for modification	C:\Windows\system32\Modules\Starter Module.exe	RedEngine.exe
File opened for modification	C:\Windows\system32\Modules	RedEngine.exe
File opened for modification	C:\Windows\system32\Modules\Starter Module.exe	Starter Module.exe
File opened for modification	C:\Windows\system32\Modules	Starter Module.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2232	schtasks.exe
2776	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	RedEngine.exe
Token: SeDebugPrivilege	2440	Starter Module.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	Starter Module.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2440	Starter Module.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2440	Starter Module.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2232	2948	RedEngine.exe	29
PID 2948 wrote to memory of 2232	2948	RedEngine.exe	29
PID 2948 wrote to memory of 2232	2948	RedEngine.exe	29
PID 2948 wrote to memory of 2440	2948	RedEngine.exe	31
PID 2948 wrote to memory of 2440	2948	RedEngine.exe	31
PID 2948 wrote to memory of 2440	2948	RedEngine.exe	31
PID 2440 wrote to memory of 2776	2440	Starter Module.exe	32
PID 2440 wrote to memory of 2776	2440	Starter Module.exe	32
PID 2440 wrote to memory of 2776	2440	Starter Module.exe	32

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RedEngine.exe
"C:\Users\Admin\AppData\Local\Temp\RedEngine.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Starter Module" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\RedEngine.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2232
- C:\Windows\system32\Modules\Starter Module.exe
  "C:\Windows\system32\Modules\Starter Module.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Starter Module" /sc ONLOGON /tr "C:\Windows\system32\Modules\Starter Module.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Starter Module.exe

Path C:\Windows\system32\Modules\Starter Module.exe
Size 502KB
SHA256 67e35ca53e1ee18113207c2edf4b165ae9158cfed151e08bac627327f9c60f21
MD5 7178d81c9afdabb202f31315f7eed7e2
SHA1 527a063588b3e4d3acc04cf211d9b0df33f5ade2
SHA512 80b770bd2d3541400386c4aa446da8840823864a62d73554dd62ea08d5e9596f2b737fa8046eb6fb892690d115eb928022cdb1d24f4f8d9cf2e449adfd0809a5
SSDEEP 6144:9TEgdc0Y5XAGbgiIN2RSBTuYNzBlh/gKeFwQHocEhyb8F9ODx2cTR30:9TEgdfYVbg/uOiFwR12x2cd0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2440-7-0x0000000000AB0000-0x0000000000B34000-memory.dmp

Download

memory/2440-8-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

Download

memory/2440-9-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

Download

memory/2440-11-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

Download

memory/2440-12-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

Download

memory/2948-0-0x000007FEF56E3000-0x000007FEF56E4000-memory.dmp

Download

memory/2948-1-0x0000000000AA0000-0x0000000000B24000-memory.dmp

Download

memory/2948-2-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

Download

memory/2948-10-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads