quasar | 37d2321800b1980716f7e33d52d0d299af94e2371a3bdb3bdcaa3ea02dec00bb

Analysis

max time kernel
316s
max time network
398s
platform
windows10-1703_x64
resource
win10-20240404-fr
resource tags

arch:x64arch:x86image:win10-20240404-frlocale:fr-fros:windows10-1703-x64systemwindows
submitted
16/08/2024, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GhostShop.exe
Size 3.3MB
Sample240816-2hrcba1fmg
SHA256 37d2321800b1980716f7e33d52d0d299af94e2371a3bdb3bdcaa3ea02dec00bb
MD5 71836a9d475bc76d205bfe493904653b
SHA1 dbeb1f6a091594d49548f84eb9e8a70c2025d673
SHA512 f5c6178caa640fe646916ebe999e4074697f3c6c72f8277d222b58b6c01727c2d962b13c5dbd4c28d574c5d898f35e32e73b47df0697108ff1c7ade9fb4b6957
SSDEEP 49152:imEnyhcFEEfm1CW2tQlmcX6D6DEEUi2HHNPTHHB72eh2NT:imLhcSEfm1CW2tQlmcX6+Ns
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar skid discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

skid

147.185.221.20:18563
147.185.221.20:9835

Mutex

c40110c3-1738-475c-9ecd-2dfda1c0bc70

Attributes

encryption_key
9E968F05BD874BA1BE086FD1774A027473823F49
install_name
Windows Host Process.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Host Process
subdirectory
Windows

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/804-1-0x00000000009D0000-0x0000000000D28000-memory.dmp	family_quasar
behavioral2/files/0x000800000001ac33-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
3200	Windows Host Process.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\Windows\Windows Host Process.exe	GhostShop.exe
File opened for modification	C:\Windows\system32\Windows\Windows Host Process.exe	GhostShop.exe
File opened for modification	C:\Windows\system32\Windows	GhostShop.exe
File opened for modification	C:\Windows\system32\Windows\Windows Host Process.exe	Windows Host Process.exe
File opened for modification	C:\Windows\system32\Windows	Windows Host Process.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1884	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1884	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4948	schtasks.exe
1560	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	804	GhostShop.exe
Token: SeDebugPrivilege	3200	Windows Host Process.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3200	Windows Host Process.exe
3200	Windows Host Process.exe
3200	Windows Host Process.exe
3200	Windows Host Process.exe
3200	Windows Host Process.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
3200	Windows Host Process.exe
3200	Windows Host Process.exe
3200	Windows Host Process.exe
3200	Windows Host Process.exe
3200	Windows Host Process.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3200	Windows Host Process.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 4948	804	GhostShop.exe	72
PID 804 wrote to memory of 4948	804	GhostShop.exe	72
PID 804 wrote to memory of 3200	804	GhostShop.exe	74
PID 804 wrote to memory of 3200	804	GhostShop.exe	74
PID 3200 wrote to memory of 1560	3200	Windows Host Process.exe	75
PID 3200 wrote to memory of 1560	3200	Windows Host Process.exe	75
PID 3200 wrote to memory of 1016	3200	Windows Host Process.exe	78
PID 3200 wrote to memory of 1016	3200	Windows Host Process.exe	78
PID 3200 wrote to memory of 4372	3200	Windows Host Process.exe	80
PID 3200 wrote to memory of 4372	3200	Windows Host Process.exe	80
PID 4372 wrote to memory of 2064	4372	cmd.exe	82
PID 4372 wrote to memory of 2064	4372	cmd.exe	82
PID 4372 wrote to memory of 1884	4372	cmd.exe	83
PID 4372 wrote to memory of 1884	4372	cmd.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\GhostShop.exe
"C:\Users\Admin\AppData\Local\Temp\GhostShop.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4948
- C:\Windows\system32\Windows\Windows Host Process.exe
  "C:\Windows\system32\Windows\Windows Host Process.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1560
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /delete /tn "Windows Host Process" /f
    3⤵
    PID:1016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\24wMKqQeRzTZ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2064
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24wMKqQeRzTZ.bat

Path C:\Users\Admin\AppData\Local\Temp\24wMKqQeRzTZ.bat
Size 215B
SHA256 8340322cc0a204291a8ff1a470c94c56ed073d8dbdacd478f3b8067dff43cc68
MD5 f8b4a226e3f5ec4c314d643edbae0dee
SHA1 dd335818a24fccdfc712ff7c60118b76fd56bb3e
SHA512 0701f9083f824fc67b0064c2d24763de49d3cf0ec424f536136994ab9cfa6455b0159aaaa49342f502cdf1ba62f2e13211db33da218319051f9b8ce086b33d12
MD5 SHA1 SHA512

Submit Download

Windows Host Process.exe

Path C:\Windows\System32\Windows\Windows Host Process.exe
Size 3.3MB
SHA256 37d2321800b1980716f7e33d52d0d299af94e2371a3bdb3bdcaa3ea02dec00bb
MD5 71836a9d475bc76d205bfe493904653b
SHA1 dbeb1f6a091594d49548f84eb9e8a70c2025d673
SHA512 f5c6178caa640fe646916ebe999e4074697f3c6c72f8277d222b58b6c01727c2d962b13c5dbd4c28d574c5d898f35e32e73b47df0697108ff1c7ade9fb4b6957
SSDEEP 49152:imEnyhcFEEfm1CW2tQlmcX6D6DEEUi2HHNPTHHB72eh2NT:imLhcSEfm1CW2tQlmcX6+Ns
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/804-0-0x00007FFAF00B3000-0x00007FFAF00B4000-memory.dmp

Download

memory/804-1-0x00000000009D0000-0x0000000000D28000-memory.dmp

Download

memory/804-2-0x00007FFAF00B0000-0x00007FFAF0A9C000-memory.dmp

Download

memory/804-9-0x00007FFAF00B0000-0x00007FFAF0A9C000-memory.dmp

Download

memory/3200-13-0x000000001BCF0000-0x000000001BDA2000-memory.dmp

Download

memory/3200-12-0x000000001B3C0000-0x000000001B410000-memory.dmp

Download

memory/3200-11-0x00007FFAF00B0000-0x00007FFAF0A9C000-memory.dmp

Download

memory/3200-16-0x00007FFAF00B0000-0x00007FFAF0A9C000-memory.dmp

Download

memory/3200-17-0x000000001BC50000-0x000000001BC62000-memory.dmp

Download

memory/3200-18-0x000000001BCB0000-0x000000001BCEE000-memory.dmp

Download

memory/3200-19-0x000000001C860000-0x000000001C8AC000-memory.dmp

Download

memory/3200-20-0x00007FFAF00B0000-0x00007FFAF0A9C000-memory.dmp

Download

memory/3200-21-0x000000001CCC0000-0x000000001CDC2000-memory.dmp

Download

memory/3200-26-0x00007FFAF00B0000-0x00007FFAF0A9C000-memory.dmp

Download

memory/3200-10-0x00007FFAF00B0000-0x00007FFAF0A9C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads