quasar | ff88b45131b4f2551b04690ae045b6f984280a31cfc4009d5f99b32bef69a651

General

Target

Client-built.exe
Size

3.4MB
MD5

a1c467f879dbc93181bdb764295f2833
SHA1

5b2f368bea56c9934cbd5299e12cc0813db24b6d
SHA256

ff88b45131b4f2551b04690ae045b6f984280a31cfc4009d5f99b32bef69a651
SHA512

9aeeb28d3a3394f77306fa96eecb025adb3ec0250b47751b685c6e6a2fcf92cbc472a34ef3da176e8a9c92029ca4102c3da58bad12d7cd725f899225a4fe8fe0
SSDEEP

49152:cmEnyhcFEEfm1CW2tQlmcX6eu2efRTHHB72eh2NTfDW:cmLhcSEfm1CW2tQlmcX6/4

Score

10^/10

quasar skid spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

skid

C2

147.185.221.20:18563

147.185.221.20:9835

Mutex

8c5e43cd-634d-4936-adda-ab19ce84f977

Attributes

encryption_key
9E968F05BD874BA1BE086FD1774A027473823F49
install_name
Windows Host Process.exe
log_directory
WindowsLogs
reconnect_delay
3000
startup_key
Windows Host Process
subdirectory
Windows

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/2424-1-0x00000000005A0000-0x0000000000900000-memory.dmp	family_quasar
behavioral2/files/0x00070000000233e1-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
3544	Windows Host Process.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Windows	Windows Host Process.exe
File created	C:\Windows\system32\Windows\Windows Host Process.exe	Client-built.exe
File opened for modification	C:\Windows\system32\Windows\Windows Host Process.exe	Client-built.exe
File opened for modification	C:\Windows\system32\Windows	Client-built.exe
File opened for modification	C:\Windows\system32\Windows\Windows Host Process.exe	Windows Host Process.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2720	schtasks.exe
5080	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	Client-built.exe
Token: SeDebugPrivilege	3544	Windows Host Process.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3544	Windows Host Process.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3544	Windows Host Process.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3544	Windows Host Process.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2720	2424	Client-built.exe	89
PID 2424 wrote to memory of 2720	2424	Client-built.exe	89
PID 2424 wrote to memory of 3544	2424	Client-built.exe	91
PID 2424 wrote to memory of 3544	2424	Client-built.exe	91
PID 3544 wrote to memory of 5080	3544	Windows Host Process.exe	93
PID 3544 wrote to memory of 5080	3544	Windows Host Process.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2720
- C:\Windows\system32\Windows\Windows Host Process.exe
  "C:\Windows\system32\Windows\Windows Host Process.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\Windows\Windows Host Process.exe

Filesize
3.4MB

MD5
a1c467f879dbc93181bdb764295f2833

SHA1
5b2f368bea56c9934cbd5299e12cc0813db24b6d

SHA256
ff88b45131b4f2551b04690ae045b6f984280a31cfc4009d5f99b32bef69a651

SHA512
9aeeb28d3a3394f77306fa96eecb025adb3ec0250b47751b685c6e6a2fcf92cbc472a34ef3da176e8a9c92029ca4102c3da58bad12d7cd725f899225a4fe8fe0

Download Submit
memory/2424-0-0x00007FFAEF173000-0x00007FFAEF175000-memory.dmp

Filesize
8KB

Download
memory/2424-1-0x00000000005A0000-0x0000000000900000-memory.dmp

Filesize
3.4MB

Download
memory/2424-2-0x00007FFAEF170000-0x00007FFAEFC31000-memory.dmp

Filesize
10.8MB

Download
memory/2424-10-0x00007FFAEF170000-0x00007FFAEFC31000-memory.dmp

Filesize
10.8MB

Download
memory/3544-9-0x00007FFAEF170000-0x00007FFAEFC31000-memory.dmp

Filesize
10.8MB

Download
memory/3544-11-0x00007FFAEF170000-0x00007FFAEFC31000-memory.dmp

Filesize
10.8MB

Download
memory/3544-12-0x000000001B770000-0x000000001B7C0000-memory.dmp

Filesize
320KB

Download
memory/3544-13-0x000000001C290000-0x000000001C342000-memory.dmp

Filesize
712KB

Download
memory/3544-14-0x00007FFAEF170000-0x00007FFAEFC31000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads