quasar | fc767ffc7f989455ce6aa641b29c14510d8de441cb423c211421e41d92febc10

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
30/07/2024, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RedEngine.exe
Size 502KB
Sample240730-c26hxaxeqa
SHA256 67e35ca53e1ee18113207c2edf4b165ae9158cfed151e08bac627327f9c60f21
MD5 7178d81c9afdabb202f31315f7eed7e2
SHA1 527a063588b3e4d3acc04cf211d9b0df33f5ade2
SHA512 80b770bd2d3541400386c4aa446da8840823864a62d73554dd62ea08d5e9596f2b737fa8046eb6fb892690d115eb928022cdb1d24f4f8d9cf2e449adfd0809a5
SSDEEP 6144:9TEgdc0Y5XAGbgiIN2RSBTuYNzBlh/gKeFwQHocEhyb8F9ODx2cTR30:9TEgdfYVbg/uOiFwR12x2cd0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar training spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

TRAINING

185.241.208.185:16145

Mutex

22073971-8d9a-4364-9916-abbb09ac9d8b

Attributes

encryption_key
7A9A8376440E3257DB2B54403642F366A5FBE14A
install_name
Starter Module.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Starter Module
subdirectory
Modules

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral8/memory/4248-1-0x00000000008C0000-0x0000000000944000-memory.dmp	family_quasar
behavioral8/files/0x00070000000234f3-5.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2596	Starter Module.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Modules	Starter Module.exe
File created	C:\Windows\system32\Modules\Starter Module.exe	RedEngine.exe
File opened for modification	C:\Windows\system32\Modules\Starter Module.exe	RedEngine.exe
File opened for modification	C:\Windows\system32\Modules	RedEngine.exe
File opened for modification	C:\Windows\system32\Modules\Starter Module.exe	Starter Module.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2592	schtasks.exe
1976	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	RedEngine.exe
Token: SeDebugPrivilege	2596	Starter Module.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2596	Starter Module.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2596	Starter Module.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2596	Starter Module.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 2592	4248	RedEngine.exe	87
PID 4248 wrote to memory of 2592	4248	RedEngine.exe	87
PID 4248 wrote to memory of 2596	4248	RedEngine.exe	89
PID 4248 wrote to memory of 2596	4248	RedEngine.exe	89
PID 2596 wrote to memory of 1976	2596	Starter Module.exe	90
PID 2596 wrote to memory of 1976	2596	Starter Module.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RedEngine.exe
"C:\Users\Admin\AppData\Local\Temp\RedEngine.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Starter Module" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\RedEngine.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2592
- C:\Windows\system32\Modules\Starter Module.exe
  "C:\Windows\system32\Modules\Starter Module.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Starter Module" /sc ONLOGON /tr "C:\Windows\system32\Modules\Starter Module.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Starter Module.exe

Path C:\Windows\System32\Modules\Starter Module.exe
Size 502KB
SHA256 67e35ca53e1ee18113207c2edf4b165ae9158cfed151e08bac627327f9c60f21
MD5 7178d81c9afdabb202f31315f7eed7e2
SHA1 527a063588b3e4d3acc04cf211d9b0df33f5ade2
SHA512 80b770bd2d3541400386c4aa446da8840823864a62d73554dd62ea08d5e9596f2b737fa8046eb6fb892690d115eb928022cdb1d24f4f8d9cf2e449adfd0809a5
SSDEEP 6144:9TEgdc0Y5XAGbgiIN2RSBTuYNzBlh/gKeFwQHocEhyb8F9ODx2cTR30:9TEgdfYVbg/uOiFwR12x2cd0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2596-7-0x00007FFD37650000-0x00007FFD38111000-memory.dmp

Download

memory/2596-9-0x00007FFD37650000-0x00007FFD38111000-memory.dmp

Download

memory/2596-11-0x000000001BB00000-0x000000001BB50000-memory.dmp

Download

memory/2596-12-0x000000001BC10000-0x000000001BCC2000-memory.dmp

Download

memory/2596-13-0x00007FFD37650000-0x00007FFD38111000-memory.dmp

Download

memory/2596-14-0x00007FFD37650000-0x00007FFD38111000-memory.dmp

Download

memory/4248-0-0x00007FFD37653000-0x00007FFD37655000-memory.dmp

Download

memory/4248-1-0x00000000008C0000-0x0000000000944000-memory.dmp

Download

memory/4248-2-0x00007FFD37650000-0x00007FFD38111000-memory.dmp

Download

memory/4248-10-0x00007FFD37650000-0x00007FFD38111000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads