quasar | 06c4c62665a3434d66fae0cbaebdb2a5f6905bba8ccc333205059ea13e99b135

Analysis

max time kernel
6s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
03-11-2024 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.2MB
MD5

986dc7301d3af14a13e54ee6b3963451
SHA1

4b110fb4248b17b92aa3b3010bc31bb0bd4d1b10
SHA256

06c4c62665a3434d66fae0cbaebdb2a5f6905bba8ccc333205059ea13e99b135
SHA512

60f454f655c69d047f901eb4abfe8667e98176ba4c51bc4ab9389c714a610d0c7c2b1d2fe80ed7e4db86e4230e2e5de8efc899647788bb5e3a101e762d6281d2
SSDEEP

49152:mv+lL26AaNeWgPhlmVqvMQ7XSK7K63Lar/LoGdlTHHB72eh2NTS:mvuL26AaNeWgPhlmVqkQ7XSKT3Ub

Score

10^/10

quasar t254 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

t254

t2558628-45777.portmap.host:45777

Mutex

932c65d6-da03-4072-adb9-2376e00c0a8e

Attributes

encryption_key
236980CA68F0687D520534421E23683400294B98
install_name
Client.exe
log_directory
Windows_Logs
reconnect_delay
3000
startup_key
Windows defender startup client
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/516-1-0x0000000000850000-0x0000000000B8E000-memory.dmp	family_quasar
behavioral1/files/0x000b000000016c1a-6.dat	family_quasar
behavioral1/memory/1976-8-0x0000000000A80000-0x0000000000DBE000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid	Process
1976	Client.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exe

pid	Process
2548	schtasks.exe
2476	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Client-built.exeClient.exe

description	pid	Process
Token: SeDebugPrivilege	516	Client-built.exe
Token: SeDebugPrivilege	1976	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Client-built.exeClient.exe

description	pid	Process	procid_target
PID 516 wrote to memory of 2548	516	Client-built.exe	31
PID 516 wrote to memory of 2548	516	Client-built.exe	31
PID 516 wrote to memory of 2548	516	Client-built.exe	31
PID 516 wrote to memory of 1976	516	Client-built.exe	33
PID 516 wrote to memory of 1976	516	Client-built.exe	33
PID 516 wrote to memory of 1976	516	Client-built.exe	33
PID 1976 wrote to memory of 2476	1976	Client.exe	34
PID 1976 wrote to memory of 2476	1976	Client.exe	34
PID 1976 wrote to memory of 2476	1976	Client.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Windows defender startup client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2548
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Windows defender startup client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.2MB

MD5
986dc7301d3af14a13e54ee6b3963451

SHA1
4b110fb4248b17b92aa3b3010bc31bb0bd4d1b10

SHA256
06c4c62665a3434d66fae0cbaebdb2a5f6905bba8ccc333205059ea13e99b135

SHA512
60f454f655c69d047f901eb4abfe8667e98176ba4c51bc4ab9389c714a610d0c7c2b1d2fe80ed7e4db86e4230e2e5de8efc899647788bb5e3a101e762d6281d2

Download Submit
memory/516-0-0x000007FEF60D3000-0x000007FEF60D4000-memory.dmp

Filesize
4KB

Download
memory/516-1-0x0000000000850000-0x0000000000B8E000-memory.dmp

Filesize
3.2MB

Download
memory/516-2-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download
memory/516-9-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download
memory/1976-8-0x0000000000A80000-0x0000000000DBE000-memory.dmp

Filesize
3.2MB

Download
memory/1976-10-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download
memory/1976-11-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download
memory/1976-12-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download