quasar | ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5

General

Target

4dd83334fef3b9d7e5067482cec38477.exe
Size

1.2MB
MD5

4dd83334fef3b9d7e5067482cec38477
SHA1

ccc0dbee8923d7232471c654451bffa36adffbad
SHA256

ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5
SHA512

84c15c60e87346208c7964db16a80f36f4f6981c5ebedcef072aaa0090c087c0d879841eeabf516a9432be48d6ddb35ee0f9739baa4085d0a60cc118fd6e6aec
SSDEEP

24576:Currek0x+kDlM+BCUlNGfnUvlZTF6DU+acRIwc8CNdlltK:CurSk0xx+opMGlZTT+XxEtK

Score

10^/10

quasar newzzz execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

newzzz

C2

193.124.205.71:5228

Mutex

a4f616c8-d1cd-4f76-ba66-226e115aa50e

Attributes

encryption_key
133BC02FFBBFFB2A15EC33D664C8D9C62CB17983
install_name
Client.exe
log_directory
Cast
reconnect_delay
3000
startup_key
SubDir
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3020-17-0x000000001B9F0000-0x000000001BD14000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
2284	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid	Process
700	powershell.exe
2284	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

4dd83334fef3b9d7e5067482cec38477.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	3020	4dd83334fef3b9d7e5067482cec38477.exe
Token: SeDebugPrivilege	700	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4dd83334fef3b9d7e5067482cec38477.exe

pid	Process
3020	4dd83334fef3b9d7e5067482cec38477.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4dd83334fef3b9d7e5067482cec38477.exe

description	pid	Process	procid_target
PID 3020 wrote to memory of 700	3020	4dd83334fef3b9d7e5067482cec38477.exe	32
PID 3020 wrote to memory of 700	3020	4dd83334fef3b9d7e5067482cec38477.exe	32
PID 3020 wrote to memory of 700	3020	4dd83334fef3b9d7e5067482cec38477.exe	32
PID 3020 wrote to memory of 2284	3020	4dd83334fef3b9d7e5067482cec38477.exe	34
PID 3020 wrote to memory of 2284	3020	4dd83334fef3b9d7e5067482cec38477.exe	34
PID 3020 wrote to memory of 2284	3020	4dd83334fef3b9d7e5067482cec38477.exe	34

C:\Users\Admin\AppData\Local\Temp\4dd83334fef3b9d7e5067482cec38477.exe
"C:\Users\Admin\AppData\Local\Temp\4dd83334fef3b9d7e5067482cec38477.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\4dd83334fef3b9d7e5067482cec38477')
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote startup_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\SCV.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7e9b4019194db06882182770764cde15

SHA1
4e00140114cec2c8b5c71d6b723c86e6e4b5503e

SHA256
441ac5ce41704b26ec31b985d1e793d24f11ba15264b2f7445ae8361bbda16e7

SHA512
0a07324df599c55ce16f73e7751042c377b92f4c8a5e8acc761037017203c455fa9f90f6ae878f994802832c1358a142604e7caa7c5bd8e5019fd4b4923b8e09

Download Submit
memory/700-6-0x0000000001EC0000-0x0000000001F40000-memory.dmp

Filesize
512KB

Download
memory/700-7-0x000000001B4A0000-0x000000001B782000-memory.dmp

Filesize
2.9MB

Download
memory/700-8-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/2284-14-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2284-15-0x00000000029F0000-0x00000000029F8000-memory.dmp

Filesize
32KB

Download
memory/3020-0-0x000007FEF57B3000-0x000007FEF57B4000-memory.dmp

Filesize
4KB

Download
memory/3020-1-0x0000000001010000-0x0000000001142000-memory.dmp

Filesize
1.2MB

Download
memory/3020-17-0x000000001B9F0000-0x000000001BD14000-memory.dmp

Filesize
3.1MB

Download
memory/3020-18-0x000007FEF57B3000-0x000007FEF57B4000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads