quasar | e2e708e09031d7fa512f31ca4d6b10d0e48df7aff2a5b889477e792c6847a90c

Analysis

max time kernel
435s
max time network
1162s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AuroraALPHABUILD.0-6 - Copy (4).exe
Size

231.7MB
MD5

3cda647a8948f3ac4df14abf6f1d62c1
SHA1

f4da28914a3938e7de76546bcf911f539672459a
SHA256

c905d2c1b9df641f12daab74948cef579aa92b6f07c36f97ed70146b615411c1
SHA512

77c0cd078ab2d2765237c3cc68a4872a81db653f1ad6a42122b786b27c7d48842577a65e88ad61e549e13b5be0df51e25b5f026089a19833e9da71f8c30c0cdd
SSDEEP

6144:0MNHXf500MU8zfjEm0beDmcCl/QOqNgJyCqv7cc:Rd505jwmZmcgSNgJyrv7cc

Score

10^/10

quasar gimp1 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

gimp1

193.42.33.210:4444

gimpdns.ddns.net:4444

Mutex

QSR_MUTEX_XwuUSTCgYhmnf6vJ1L

Attributes

encryption_key
lRzFKjYQKUKzh6RyUYYQ
install_name
svchost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svchost
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral11/memory/3688-1-0x0000000000B70000-0x0000000000BCE000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation svchost.exe
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2532 svchost.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	svchost.exe

pid	process
2532	svchost.exe

flow	ioc
15	ip-api.com

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

chcp.comPING.EXEAuroraALPHABUILD.0-6 - Copy (4).exeschtasks.exesvchost.exeschtasks.exeschtasks.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AuroraALPHABUILD.0-6 - Copy (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

2212 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2212 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

3372 schtasks.exe
1644 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AuroraALPHABUILD.0-6 - Copy (4).exesvchost.exe

description pid process

Token: SeDebugPrivilege 3688 AuroraALPHABUILD.0-6 - Copy (4).exe
Token: SeDebugPrivilege 2532 svchost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid process

2532 svchost.exe

pid	process
2212	PING.EXE

pid	process
2212	PING.EXE

pid	process
3372	schtasks.exe
1644	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	3688	AuroraALPHABUILD.0-6 - Copy (4).exe
Token: SeDebugPrivilege	2532	svchost.exe

pid	process
2532	svchost.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

AuroraALPHABUILD.0-6 - Copy (4).exesvchost.execmd.exe

description	pid	process	target process
PID 3688 wrote to memory of 3372	3688	AuroraALPHABUILD.0-6 - Copy (4).exe	schtasks.exe
PID 3688 wrote to memory of 3372	3688	AuroraALPHABUILD.0-6 - Copy (4).exe	schtasks.exe
PID 3688 wrote to memory of 3372	3688	AuroraALPHABUILD.0-6 - Copy (4).exe	schtasks.exe
PID 3688 wrote to memory of 2532	3688	AuroraALPHABUILD.0-6 - Copy (4).exe	svchost.exe
PID 3688 wrote to memory of 2532	3688	AuroraALPHABUILD.0-6 - Copy (4).exe	svchost.exe
PID 3688 wrote to memory of 2532	3688	AuroraALPHABUILD.0-6 - Copy (4).exe	svchost.exe
PID 2532 wrote to memory of 1644	2532	svchost.exe	schtasks.exe
PID 2532 wrote to memory of 1644	2532	svchost.exe	schtasks.exe
PID 2532 wrote to memory of 1644	2532	svchost.exe	schtasks.exe
PID 2532 wrote to memory of 4296	2532	svchost.exe	schtasks.exe
PID 2532 wrote to memory of 4296	2532	svchost.exe	schtasks.exe
PID 2532 wrote to memory of 4296	2532	svchost.exe	schtasks.exe
PID 2532 wrote to memory of 948	2532	svchost.exe	cmd.exe
PID 2532 wrote to memory of 948	2532	svchost.exe	cmd.exe
PID 2532 wrote to memory of 948	2532	svchost.exe	cmd.exe
PID 948 wrote to memory of 880	948	cmd.exe	chcp.com
PID 948 wrote to memory of 880	948	cmd.exe	chcp.com
PID 948 wrote to memory of 880	948	cmd.exe	chcp.com
PID 948 wrote to memory of 2212	948	cmd.exe	PING.EXE
PID 948 wrote to memory of 2212	948	cmd.exe	PING.EXE
PID 948 wrote to memory of 2212	948	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\AuroraALPHABUILD.0-6 - Copy (4).exe
"C:\Users\Admin\AppData\Local\Temp\AuroraALPHABUILD.0-6 - Copy (4).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\AuroraALPHABUILD.0-6 - Copy (4).exe" /rl HIGHEST /f
2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3372

C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /delete /tn "svchost" /f
3⤵
- System Location Discovery: System Language Discovery
PID:4296

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OJISAZd0mNEG.bat" "
3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
- System Location Discovery: System Language Discovery
PID:880

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OJISAZd0mNEG.bat

Filesize
263B

MD5
69a5bf8d33af5fd95d8b4ac430ca72a8

SHA1
97f862d65121e3daa8cad8464bfd10b143f6eab5

SHA256
552bc58f942a294a3721a81188d5f9e4e81afb6248e23063b14e8ff15d6e5a74

SHA512
fbeafa448e4e4b66e5675dc6f43219b92b913ae7901fa20978ad813ff1a6195240fc2fffa6e7b0db8c703f84f18411a8445b9779b57d0d56077664b430b8311e

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\09-13-~1

Filesize
224B

MD5
dc56956f79062b55dbd98a765fcc52a1

SHA1
4137419162db4fe1cff33ca0525bc6773e4108a4

SHA256
01bf34c0063ccf1540388ba752db7cc290155d45ef050348111af78e5e5dd486

SHA512
1041ff63165de162ffbfb0e87e2abbd6be4e1bf0ba4df85748614647bf669927e1369d4f49c0db71f7eb8ee65cd7c16eff4e2b12270a8932e8aa6d5fd225e8d0

Download Submit
memory/2532-14-0x0000000074F20000-0x00000000756D0000-memory.dmp

Filesize
7.7MB

Download
memory/2532-24-0x0000000074F20000-0x00000000756D0000-memory.dmp

Filesize
7.7MB

Download
memory/2532-18-0x0000000074F20000-0x00000000756D0000-memory.dmp

Filesize
7.7MB

Download
memory/2532-16-0x0000000006BF0000-0x0000000006BFA000-memory.dmp

Filesize
40KB

Download
memory/3688-3-0x0000000005620000-0x00000000056B2000-memory.dmp

Filesize
584KB

Download
memory/3688-7-0x0000000006820000-0x000000000685C000-memory.dmp

Filesize
240KB

Download
memory/3688-6-0x00000000062E0000-0x00000000062F2000-memory.dmp

Filesize
72KB

Download
memory/3688-5-0x00000000056C0000-0x0000000005726000-memory.dmp

Filesize
408KB

Download
memory/3688-17-0x0000000074F20000-0x00000000756D0000-memory.dmp

Filesize
7.7MB

Download
memory/3688-4-0x0000000074F20000-0x00000000756D0000-memory.dmp

Filesize
7.7MB

Download
memory/3688-0-0x0000000074F2E000-0x0000000074F2F000-memory.dmp

Filesize
4KB

Download
memory/3688-2-0x0000000005A70000-0x0000000006014000-memory.dmp

Filesize
5.6MB

Download
memory/3688-1-0x0000000000B70000-0x0000000000BCE000-memory.dmp

Filesize
376KB

Download