quasar | 7a85eb78ce7c9487c6d2aa0ffcb569687accf73377cc1e6ce8123a15345cd7aa

General

Target

Client-built.exe
Size

3.4MB
MD5

58587e08cc617fb97526bfbac57b62e8
SHA1

bd38f26aa6541b07a510d0a064b5c7235c9c8a5b
SHA256

7a85eb78ce7c9487c6d2aa0ffcb569687accf73377cc1e6ce8123a15345cd7aa
SHA512

b0ecdbe15b1fd4d2e190c285c14d1e454e9192105698f0d89952999a13b2b238128326eaf243e29c13c8d1c1e8372c7b6d735c92374921e2740fdd91d91da525
SSDEEP

49152:k6LFXL5Z8hlPKxXava0n+g5I2j1THHB72eh2NT1Yq:k6p5Z8hlPKxXava0+KOY

Score

10^/10

quasar ran spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

RAN

C2

147.185.221.22:10340

Mutex

541c4371-7091-40eb-8fd1-2973b63dd560

Attributes

encryption_key
45428D99D260D9C913112BDB878C52EA244CE0DB
install_name
Windows Host Process.exe
log_directory
Windows-Logs
reconnect_delay
3000
startup_key
Windows Host Process
subdirectory
Windows

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/1740-1-0x0000000000170000-0x00000000004D6000-memory.dmp	family_quasar
behavioral2/files/0x000700000002342d-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
5052	Windows Host Process.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Windows	Client-built.exe
File opened for modification	C:\Windows\system32\Windows\Windows Host Process.exe	Windows Host Process.exe
File opened for modification	C:\Windows\system32\Windows	Windows Host Process.exe
File created	C:\Windows\system32\Windows\Windows Host Process.exe	Client-built.exe
File opened for modification	C:\Windows\system32\Windows\Windows Host Process.exe	Client-built.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3588	schtasks.exe
4132	schtasks.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	Client-built.exe
Token: SeDebugPrivilege	5052	Windows Host Process.exe
Token: SeCreateGlobalPrivilege	1080	dwm.exe
Token: SeChangeNotifyPrivilege	1080	dwm.exe
Token: 33	1080	dwm.exe
Token: SeIncBasePriorityPrivilege	1080	dwm.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5052	Windows Host Process.exe
5052	Windows Host Process.exe
5052	Windows Host Process.exe
5052	Windows Host Process.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
5052	Windows Host Process.exe
5052	Windows Host Process.exe
5052	Windows Host Process.exe
5052	Windows Host Process.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5052	Windows Host Process.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 3588	1740	Client-built.exe	87
PID 1740 wrote to memory of 3588	1740	Client-built.exe	87
PID 1740 wrote to memory of 5052	1740	Client-built.exe	89
PID 1740 wrote to memory of 5052	1740	Client-built.exe	89
PID 5052 wrote to memory of 4132	5052	Windows Host Process.exe	90
PID 5052 wrote to memory of 4132	5052	Windows Host Process.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3588
- C:\Windows\system32\Windows\Windows Host Process.exe
  "C:\Windows\system32\Windows\Windows Host Process.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4132

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1080

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5048

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4788

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\Windows\Windows Host Process.exe

Filesize
3.4MB

MD5
58587e08cc617fb97526bfbac57b62e8

SHA1
bd38f26aa6541b07a510d0a064b5c7235c9c8a5b

SHA256
7a85eb78ce7c9487c6d2aa0ffcb569687accf73377cc1e6ce8123a15345cd7aa

SHA512
b0ecdbe15b1fd4d2e190c285c14d1e454e9192105698f0d89952999a13b2b238128326eaf243e29c13c8d1c1e8372c7b6d735c92374921e2740fdd91d91da525

Download Submit
memory/1740-10-0x00007FFDDF7D0000-0x00007FFDE0291000-memory.dmp

Filesize
10.8MB

Download
memory/1740-1-0x0000000000170000-0x00000000004D6000-memory.dmp

Filesize
3.4MB

Download
memory/1740-2-0x00007FFDDF7D0000-0x00007FFDE0291000-memory.dmp

Filesize
10.8MB

Download
memory/1740-0-0x00007FFDDF7D3000-0x00007FFDDF7D5000-memory.dmp

Filesize
8KB

Download
memory/5052-11-0x00007FFDDF7D0000-0x00007FFDE0291000-memory.dmp

Filesize
10.8MB

Download
memory/5052-9-0x00007FFDDF7D0000-0x00007FFDE0291000-memory.dmp

Filesize
10.8MB

Download
memory/5052-12-0x000000001C2F0000-0x000000001C340000-memory.dmp

Filesize
320KB

Download
memory/5052-13-0x000000001C400000-0x000000001C4B2000-memory.dmp

Filesize
712KB

Download
memory/5052-16-0x000000001C340000-0x000000001C352000-memory.dmp

Filesize
72KB

Download
memory/5052-17-0x000000001C3A0000-0x000000001C3DC000-memory.dmp

Filesize
240KB

Download
memory/5052-18-0x00007FFDDF7D0000-0x00007FFDE0291000-memory.dmp

Filesize
10.8MB

Download
memory/5052-19-0x00007FFDDF7D0000-0x00007FFDE0291000-memory.dmp

Filesize
10.8MB

Download
memory/5052-21-0x00007FFDDF7D0000-0x00007FFDE0291000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads