quasar | e2e708e09031d7fa512f31ca4d6b10d0e48df7aff2a5b889477e792c6847a90c

Analysis

max time kernel
402s
max time network
888s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13-09-2024 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AuroraALPHABUILD.0-6 - Copy.exe
Size

97.0MB
MD5

2b36c87327d49e2509816b80b90deb84
SHA1

9bd6b6edd4be18c825ea0c22210b7751849afcf3
SHA256

e809d65888127e63049885ba4fb12bcfba0ae6726e13197eb38975b73cd6019c
SHA512

f8ed673f8b67e0233ca6d390a244e7dfce1771e70979f231e140e060d8c124de69db77e487fb54baacadca19dd0a51be9a3eff8b1f4dfb36359c1435ab93eee2
SSDEEP

6144:0MNHXf500MU8zfjEm0beDmcCl/QOqNgJyCqv7cc:Rd505jwmZmcgSNgJyrv7cc

Score

10^/10

quasar gimp1 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

gimp1

193.42.33.210:4444

gimpdns.ddns.net:4444

Mutex

QSR_MUTEX_XwuUSTCgYhmnf6vJ1L

Attributes

encryption_key
lRzFKjYQKUKzh6RyUYYQ
install_name
svchost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svchost
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral18/memory/1416-1-0x0000000000AB0000-0x0000000000B0E000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

4392 svchost.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4392	svchost.exe

flow	ioc
1	ip-api.com

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

schtasks.exeschtasks.execmd.exechcp.comPING.EXEAuroraALPHABUILD.0-6 - Copy.exeschtasks.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AuroraALPHABUILD.0-6 - Copy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

3548 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3548 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2828 schtasks.exe
192 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AuroraALPHABUILD.0-6 - Copy.exesvchost.exe

description pid process

Token: SeDebugPrivilege 1416 AuroraALPHABUILD.0-6 - Copy.exe
Token: SeDebugPrivilege 4392 svchost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid process

4392 svchost.exe

pid	process
3548	PING.EXE

pid	process
3548	PING.EXE

pid	process
2828	schtasks.exe
192	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1416	AuroraALPHABUILD.0-6 - Copy.exe
Token: SeDebugPrivilege	4392	svchost.exe

pid	process
4392	svchost.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

AuroraALPHABUILD.0-6 - Copy.exesvchost.execmd.exe

description	pid	process	target process
PID 1416 wrote to memory of 192	1416	AuroraALPHABUILD.0-6 - Copy.exe	schtasks.exe
PID 1416 wrote to memory of 192	1416	AuroraALPHABUILD.0-6 - Copy.exe	schtasks.exe
PID 1416 wrote to memory of 192	1416	AuroraALPHABUILD.0-6 - Copy.exe	schtasks.exe
PID 1416 wrote to memory of 4392	1416	AuroraALPHABUILD.0-6 - Copy.exe	svchost.exe
PID 1416 wrote to memory of 4392	1416	AuroraALPHABUILD.0-6 - Copy.exe	svchost.exe
PID 1416 wrote to memory of 4392	1416	AuroraALPHABUILD.0-6 - Copy.exe	svchost.exe
PID 4392 wrote to memory of 2828	4392	svchost.exe	schtasks.exe
PID 4392 wrote to memory of 2828	4392	svchost.exe	schtasks.exe
PID 4392 wrote to memory of 2828	4392	svchost.exe	schtasks.exe
PID 4392 wrote to memory of 2052	4392	svchost.exe	schtasks.exe
PID 4392 wrote to memory of 2052	4392	svchost.exe	schtasks.exe
PID 4392 wrote to memory of 2052	4392	svchost.exe	schtasks.exe
PID 4392 wrote to memory of 3056	4392	svchost.exe	cmd.exe
PID 4392 wrote to memory of 3056	4392	svchost.exe	cmd.exe
PID 4392 wrote to memory of 3056	4392	svchost.exe	cmd.exe
PID 3056 wrote to memory of 2380	3056	cmd.exe	chcp.com
PID 3056 wrote to memory of 2380	3056	cmd.exe	chcp.com
PID 3056 wrote to memory of 2380	3056	cmd.exe	chcp.com
PID 3056 wrote to memory of 3548	3056	cmd.exe	PING.EXE
PID 3056 wrote to memory of 3548	3056	cmd.exe	PING.EXE
PID 3056 wrote to memory of 3548	3056	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\AuroraALPHABUILD.0-6 - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\AuroraALPHABUILD.0-6 - Copy.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\AuroraALPHABUILD.0-6 - Copy.exe" /rl HIGHEST /f
2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:192

C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /delete /tn "svchost" /f
3⤵
- System Location Discovery: System Language Discovery
PID:2052

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AzzcglTst3Lk.bat" "
3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
- System Location Discovery: System Language Discovery
PID:2380

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AzzcglTst3Lk.bat

Filesize
263B

MD5
c9af1a21dbb89f5ffa0e1f85dd640777

SHA1
1602da8938c3990be5a5db1ac1fd3e47875e3a13

SHA256
791e981f11ca607af99c0aa63246a7c26782f4ebfb10344e0f17812933963e2d

SHA512
04f0e6d890b2713422e8857eb992e052050fb8198d5a68a4b103ca97574b4872c305b81907fb28f6d248f24d95c0bad233fa79176a5e6da35a91dfbe93ce9a17

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\09-13-~1

Filesize
224B

MD5
d0cd9a5bec989109efc059a7e477149c

SHA1
b70076fe02e0bcb9d41f500e8560bb4cbacd7143

SHA256
eb4b6512bd40b8f2b1fed7544fc280549b3064506c99ee62018a17271f3de061

SHA512
46dc2ccd5dd3ecdd950b7620ba66367a26f37e94063d59df60b2c0007c3172ce3b1f760799095dd7df15fce8328f808634468145cfed7469c52f47ca449b8f80

Download Submit
memory/1416-1-0x0000000000AB0000-0x0000000000B0E000-memory.dmp

Filesize
376KB

Download
memory/1416-2-0x0000000005910000-0x0000000005E0E000-memory.dmp

Filesize
5.0MB

Download
memory/1416-3-0x0000000005410000-0x00000000054A2000-memory.dmp

Filesize
584KB

Download
memory/1416-4-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/1416-5-0x0000000005380000-0x00000000053E6000-memory.dmp

Filesize
408KB

Download
memory/1416-6-0x00000000058D0000-0x00000000058E2000-memory.dmp

Filesize
72KB

Download
memory/1416-7-0x00000000063C0000-0x00000000063FE000-memory.dmp

Filesize
248KB

Download
memory/1416-0-0x0000000073F7E000-0x0000000073F7F000-memory.dmp

Filesize
4KB

Download
memory/1416-15-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/4392-14-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/4392-19-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/4392-18-0x0000000007040000-0x000000000704A000-memory.dmp

Filesize
40KB

Download
memory/4392-25-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/4392-16-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download