quasar | 64f51e7b139ab5cf5829321a7ea0e7cc8aad04f1ec1d872345ee029e679dd2af

General

Target

be87988d10070a2a95aa02f5cdab0aab.exe
Size

1.5MB
MD5

be87988d10070a2a95aa02f5cdab0aab
SHA1

b62fe5009101940ed28cc1167b2baeb418938cc6
SHA256

64f51e7b139ab5cf5829321a7ea0e7cc8aad04f1ec1d872345ee029e679dd2af
SHA512

ecadcc7e03b973d79265ddbe7165ed205ef18494924645b5c995bfba45aebc1196790d8831d856142b00841128ad3e7bc63a52290b57d50db6d4fd0960298018
SSDEEP

49152:UbA30vMJT4D/NPNOUY389Nv7Meox7eQeblMR:UbqTwRkUYIvloxCQulMR

Score

10^/10

quasar trumpus discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

TrumpUS

C2

namz.read-books.org:1337

Mutex

06f1c124-2f86-4205-a4b8-825abb0ee5d0

Attributes

encryption_key
EE5F2943516BF23B75353DDAA9266AAFF982D3E6
install_name
WindowsUpdate.exe
log_directory
Logs
reconnect_delay
3000
startup_key
DqdCQdqc
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000800000002340d-13.dat	family_quasar
behavioral2/memory/4148-21-0x0000000000F00000-0x0000000001224000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	be87988d10070a2a95aa02f5cdab0aab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	Client-built2.sfx.exe

Executes dropped EXE 3 IoCs

pid	Process
4840	Client-built2.sfx.exe
4148	Client-built.exe
1376	WindowsUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be87988d10070a2a95aa02f5cdab0aab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client-built2.sfx.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	be87988d10070a2a95aa02f5cdab0aab.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1640	schtasks.exe
1208	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	Client-built.exe
Token: SeDebugPrivilege	1376	WindowsUpdate.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1376	WindowsUpdate.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 3320	4548	be87988d10070a2a95aa02f5cdab0aab.exe	85
PID 4548 wrote to memory of 3320	4548	be87988d10070a2a95aa02f5cdab0aab.exe	85
PID 4548 wrote to memory of 3320	4548	be87988d10070a2a95aa02f5cdab0aab.exe	85
PID 3320 wrote to memory of 4840	3320	WScript.exe	87
PID 3320 wrote to memory of 4840	3320	WScript.exe	87
PID 3320 wrote to memory of 4840	3320	WScript.exe	87
PID 4840 wrote to memory of 4148	4840	Client-built2.sfx.exe	88
PID 4840 wrote to memory of 4148	4840	Client-built2.sfx.exe	88
PID 4148 wrote to memory of 1640	4148	Client-built.exe	90
PID 4148 wrote to memory of 1640	4148	Client-built.exe	90
PID 4148 wrote to memory of 1376	4148	Client-built.exe	92
PID 4148 wrote to memory of 1376	4148	Client-built.exe	92
PID 1376 wrote to memory of 1208	1376	WindowsUpdate.exe	93
PID 1376 wrote to memory of 1208	1376	WindowsUpdate.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\be87988d10070a2a95aa02f5cdab0aab.exe
"C:\Users\Admin\AppData\Local\Temp\be87988d10070a2a95aa02f5cdab0aab.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\start.vbs"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Users\Admin\AppData\Roaming\Client-built2.sfx.exe
    "C:\Users\Admin\AppData\Roaming\Client-built2.sfx.exe" -p1337guy$$$
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Users\Admin\AppData\Roaming\Client-built.exe
      "C:\Users\Admin\AppData\Roaming\Client-built.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4148
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "DqdCQdqc" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1640
    - - C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1376
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "DqdCQdqc" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Client-built.exe

Filesize
3.1MB

MD5
63d4d473f7eefb64274601a1564f348c

SHA1
1178086b2041b0110dc15b2955c81f96d0e504be

SHA256
51be0be756a2a590efde88e27908dfe128a85f5b3b321b379016d02f6e194e48

SHA512
ac9086ac8e0fe771c4696f536cea77f925e190b13151ade806f8eabb0e63c0dbf6e174a7cafd065c6c6e02355d1e0c208e1342aee686a72b9e904b1ef94e3b24

Download Submit
C:\Users\Admin\AppData\Roaming\Client-built2.sfx.exe

Filesize
1.3MB

MD5
34ce1530d7c6221627ba23c7aca03435

SHA1
fdf5df26664554bbeec2b9b40d9b9b6c4dc355db

SHA256
f961026fd90ab67d1db933b03eb4cf87e4c9f57b39c2001e81fb87193124be37

SHA512
13172b88c909ab1e0f5c938056f0b138cbaed24985b9c92d3a919ec3028d4440253f2872f3b96559b4cff6d10cfae101ef08da94254f223714165e2cb22aa229

Download Submit
C:\Users\Admin\AppData\Roaming\start.vbs

Filesize
776B

MD5
9c9c5ace80e216ae113c55a317414edd

SHA1
60055c589956645b64b824c9114145adc75fef1e

SHA256
fd1b2b6c0bab3487bdaec3fdc72775823f0d0240f336a8ba07e9550d8b06d8a5

SHA512
fec010d313b3cdec7d09e397bebe529a9000e2968e7ddb7e21b743a5f8e272e50fb2060d81f6ceaeb9a944811f04c1839cccf5d2741d37f56c2501744109f6b0

Download Submit
memory/1376-28-0x000000001B910000-0x000000001B960000-memory.dmp

Filesize
320KB

Download
memory/1376-29-0x000000001BA20000-0x000000001BAD2000-memory.dmp

Filesize
712KB

Download
memory/1376-30-0x000000001B980000-0x000000001B992000-memory.dmp

Filesize
72KB

Download
memory/1376-31-0x000000001B9E0000-0x000000001BA1C000-memory.dmp

Filesize
240KB

Download
memory/4148-21-0x0000000000F00000-0x0000000001224000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads