quasar | 06c4c62665a3434d66fae0cbaebdb2a5f6905bba8ccc333205059ea13e99b135

General

Target

Client-built.exe
Size

3.2MB
MD5

986dc7301d3af14a13e54ee6b3963451
SHA1

4b110fb4248b17b92aa3b3010bc31bb0bd4d1b10
SHA256

06c4c62665a3434d66fae0cbaebdb2a5f6905bba8ccc333205059ea13e99b135
SHA512

60f454f655c69d047f901eb4abfe8667e98176ba4c51bc4ab9389c714a610d0c7c2b1d2fe80ed7e4db86e4230e2e5de8efc899647788bb5e3a101e762d6281d2
SSDEEP

49152:mv+lL26AaNeWgPhlmVqvMQ7XSK7K63Lar/LoGdlTHHB72eh2NTS:mvuL26AaNeWgPhlmVqkQ7XSKT3Ub

Score

10^/10

quasar t254 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

t254

C2

t2558628-45777.portmap.host:45777

Mutex

932c65d6-da03-4072-adb9-2376e00c0a8e

Attributes

encryption_key
236980CA68F0687D520534421E23683400294B98
install_name
Client.exe
log_directory
Windows_Logs
reconnect_delay
3000
startup_key
Windows defender startup client
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3052-1-0x00000000011F0000-0x000000000152E000-memory.dmp	family_quasar
behavioral1/files/0x0009000000016ce0-6.dat	family_quasar
behavioral1/memory/2388-8-0x0000000001280000-0x00000000015BE000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid	Process
2388	Client.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exe

pid	Process
2760	schtasks.exe
2072	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Client-built.exeClient.exe

description	pid	Process
Token: SeDebugPrivilege	3052	Client-built.exe
Token: SeDebugPrivilege	2388	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid	Process
2388	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Client-built.exeClient.exe

description	pid	Process	procid_target
PID 3052 wrote to memory of 2072	3052	Client-built.exe	30
PID 3052 wrote to memory of 2072	3052	Client-built.exe	30
PID 3052 wrote to memory of 2072	3052	Client-built.exe	30
PID 3052 wrote to memory of 2388	3052	Client-built.exe	32
PID 3052 wrote to memory of 2388	3052	Client-built.exe	32
PID 3052 wrote to memory of 2388	3052	Client-built.exe	32
PID 2388 wrote to memory of 2760	2388	Client.exe	33
PID 2388 wrote to memory of 2760	2388	Client.exe	33
PID 2388 wrote to memory of 2760	2388	Client.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Windows defender startup client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2072
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Windows defender startup client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.2MB

MD5
986dc7301d3af14a13e54ee6b3963451

SHA1
4b110fb4248b17b92aa3b3010bc31bb0bd4d1b10

SHA256
06c4c62665a3434d66fae0cbaebdb2a5f6905bba8ccc333205059ea13e99b135

SHA512
60f454f655c69d047f901eb4abfe8667e98176ba4c51bc4ab9389c714a610d0c7c2b1d2fe80ed7e4db86e4230e2e5de8efc899647788bb5e3a101e762d6281d2

Download Submit
memory/2388-8-0x0000000001280000-0x00000000015BE000-memory.dmp

Filesize
3.2MB

Download
memory/2388-9-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download
memory/2388-10-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download
memory/2388-12-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download
memory/3052-0-0x000007FEF5EF3000-0x000007FEF5EF4000-memory.dmp

Filesize
4KB

Download
memory/3052-1-0x00000000011F0000-0x000000000152E000-memory.dmp

Filesize
3.2MB

Download
memory/3052-2-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download
memory/3052-11-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads