quasar | e2e708e09031d7fa512f31ca4d6b10d0e48df7aff2a5b889477e792c6847a90c

Analysis

max time kernel
434s
max time network
1158s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AuroraALPHABUILD.0-6 - Copy.exe
Size

97.0MB
MD5

2b36c87327d49e2509816b80b90deb84
SHA1

9bd6b6edd4be18c825ea0c22210b7751849afcf3
SHA256

e809d65888127e63049885ba4fb12bcfba0ae6726e13197eb38975b73cd6019c
SHA512

f8ed673f8b67e0233ca6d390a244e7dfce1771e70979f231e140e060d8c124de69db77e487fb54baacadca19dd0a51be9a3eff8b1f4dfb36359c1435ab93eee2
SSDEEP

6144:0MNHXf500MU8zfjEm0beDmcCl/QOqNgJyCqv7cc:Rd505jwmZmcgSNgJyrv7cc

Score

10^/10

quasar gimp1 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

gimp1

193.42.33.210:4444

gimpdns.ddns.net:4444

Mutex

QSR_MUTEX_XwuUSTCgYhmnf6vJ1L

Attributes

encryption_key
lRzFKjYQKUKzh6RyUYYQ
install_name
svchost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svchost
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral19/memory/4088-1-0x0000000000010000-0x000000000006E000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation svchost.exe
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

1272 svchost.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	svchost.exe

pid	process
1272	svchost.exe

flow	ioc
15	ip-api.com

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

schtasks.exesvchost.exeschtasks.exeschtasks.execmd.exechcp.comPING.EXEAuroraALPHABUILD.0-6 - Copy.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AuroraALPHABUILD.0-6 - Copy.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

4404 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4404 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2280 schtasks.exe
4408 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AuroraALPHABUILD.0-6 - Copy.exesvchost.exe

description pid process

Token: SeDebugPrivilege 4088 AuroraALPHABUILD.0-6 - Copy.exe
Token: SeDebugPrivilege 1272 svchost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid process

1272 svchost.exe

pid	process
4404	PING.EXE

pid	process
4404	PING.EXE

pid	process
2280	schtasks.exe
4408	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	4088	AuroraALPHABUILD.0-6 - Copy.exe
Token: SeDebugPrivilege	1272	svchost.exe

pid	process
1272	svchost.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

AuroraALPHABUILD.0-6 - Copy.exesvchost.execmd.exe

description	pid	process	target process
PID 4088 wrote to memory of 2280	4088	AuroraALPHABUILD.0-6 - Copy.exe	schtasks.exe
PID 4088 wrote to memory of 2280	4088	AuroraALPHABUILD.0-6 - Copy.exe	schtasks.exe
PID 4088 wrote to memory of 2280	4088	AuroraALPHABUILD.0-6 - Copy.exe	schtasks.exe
PID 4088 wrote to memory of 1272	4088	AuroraALPHABUILD.0-6 - Copy.exe	svchost.exe
PID 4088 wrote to memory of 1272	4088	AuroraALPHABUILD.0-6 - Copy.exe	svchost.exe
PID 4088 wrote to memory of 1272	4088	AuroraALPHABUILD.0-6 - Copy.exe	svchost.exe
PID 1272 wrote to memory of 4408	1272	svchost.exe	schtasks.exe
PID 1272 wrote to memory of 4408	1272	svchost.exe	schtasks.exe
PID 1272 wrote to memory of 4408	1272	svchost.exe	schtasks.exe
PID 1272 wrote to memory of 2216	1272	svchost.exe	schtasks.exe
PID 1272 wrote to memory of 2216	1272	svchost.exe	schtasks.exe
PID 1272 wrote to memory of 2216	1272	svchost.exe	schtasks.exe
PID 1272 wrote to memory of 4336	1272	svchost.exe	cmd.exe
PID 1272 wrote to memory of 4336	1272	svchost.exe	cmd.exe
PID 1272 wrote to memory of 4336	1272	svchost.exe	cmd.exe
PID 4336 wrote to memory of 4884	4336	cmd.exe	chcp.com
PID 4336 wrote to memory of 4884	4336	cmd.exe	chcp.com
PID 4336 wrote to memory of 4884	4336	cmd.exe	chcp.com
PID 4336 wrote to memory of 4404	4336	cmd.exe	PING.EXE
PID 4336 wrote to memory of 4404	4336	cmd.exe	PING.EXE
PID 4336 wrote to memory of 4404	4336	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\AuroraALPHABUILD.0-6 - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\AuroraALPHABUILD.0-6 - Copy.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\AuroraALPHABUILD.0-6 - Copy.exe" /rl HIGHEST /f
2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4408

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /delete /tn "svchost" /f
3⤵
- System Location Discovery: System Language Discovery
PID:2216

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hXljTSRFqWBR.bat" "
3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4336

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
- System Location Discovery: System Language Discovery
PID:4884

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hXljTSRFqWBR.bat

Filesize
263B

MD5
4b99289b7e3faaba27483f6aeb42e98a

SHA1
f8edb9432bf915230806c8f3697fc1a5dbdc004e

SHA256
04ee77c282bd7d759d773d765050d5d2dea9e18d9cfa26bd67de006fcc2e023c

SHA512
183497c9d82c38890b21dfbcc1962416e198ddc1e4948757559196557f68ab88b369fe5f1dc32a732530ace24f1fe2a572fb9e0074945ccdc856d82b12157e1e

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\09-13-~1

Filesize
224B

MD5
20a6bd4207a2e1ccb9854999cb799c46

SHA1
15c1c57a339534701efb3e2287a8a31706203883

SHA256
5572995a9ff1a44efc6bcd5e849bb3cd5db19a167efc554eb12501607ebdd4da

SHA512
9019c9d527ec64a6023f523d0a0b7ff9490fd69496e6667ef83fdad51bec301f742df6534542f7c873a4fde19b269f4e2dd900703432ce23c402d9370aa7dde8

Download Submit
memory/1272-14-0x0000000074770000-0x0000000074F20000-memory.dmp

Filesize
7.7MB

Download
memory/1272-24-0x0000000074770000-0x0000000074F20000-memory.dmp

Filesize
7.7MB

Download
memory/1272-18-0x0000000074770000-0x0000000074F20000-memory.dmp

Filesize
7.7MB

Download
memory/1272-17-0x0000000007360000-0x000000000736A000-memory.dmp

Filesize
40KB

Download
memory/4088-3-0x0000000004B30000-0x0000000004BC2000-memory.dmp

Filesize
584KB

Download
memory/4088-7-0x0000000005CD0000-0x0000000005D0C000-memory.dmp

Filesize
240KB

Download
memory/4088-15-0x0000000074770000-0x0000000074F20000-memory.dmp

Filesize
7.7MB

Download
memory/4088-6-0x0000000005790000-0x00000000057A2000-memory.dmp

Filesize
72KB

Download
memory/4088-5-0x0000000004A60000-0x0000000004AC6000-memory.dmp

Filesize
408KB

Download
memory/4088-4-0x0000000074770000-0x0000000074F20000-memory.dmp

Filesize
7.7MB

Download
memory/4088-0-0x000000007477E000-0x000000007477F000-memory.dmp

Filesize
4KB

Download
memory/4088-2-0x00000000050E0000-0x0000000005684000-memory.dmp

Filesize
5.6MB

Download
memory/4088-1-0x0000000000010000-0x000000000006E000-memory.dmp

Filesize
376KB

Download