quasar | ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5

General

Target

ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5.exe
Size

1.2MB
MD5

4dd83334fef3b9d7e5067482cec38477
SHA1

ccc0dbee8923d7232471c654451bffa36adffbad
SHA256

ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5
SHA512

84c15c60e87346208c7964db16a80f36f4f6981c5ebedcef072aaa0090c087c0d879841eeabf516a9432be48d6ddb35ee0f9739baa4085d0a60cc118fd6e6aec
SSDEEP

24576:Currek0x+kDlM+BCUlNGfnUvlZTF6DU+acRIwc8CNdlltK:CurSk0xx+opMGlZTT+XxEtK

Score

10^/10

quasar newzzz execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

newzzz

C2

193.124.205.71:5228

Mutex

a4f616c8-d1cd-4f76-ba66-226e115aa50e

Attributes

encryption_key
133BC02FFBBFFB2A15EC33D664C8D9C62CB17983
install_name
Client.exe
log_directory
Cast
reconnect_delay
3000
startup_key
SubDir
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2772-17-0x000000001B860000-0x000000001BB84000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
1896	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid	Process
2156	powershell.exe
1896	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2772	ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5.exe

pid	Process
2772	ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5.exe

description	pid	Process	procid_target
PID 2772 wrote to memory of 2156	2772	ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5.exe	31
PID 2772 wrote to memory of 2156	2772	ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5.exe	31
PID 2772 wrote to memory of 2156	2772	ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5.exe	31
PID 2772 wrote to memory of 1896	2772	ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5.exe	33
PID 2772 wrote to memory of 1896	2772	ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5.exe	33
PID 2772 wrote to memory of 1896	2772	ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5.exe	33

C:\Users\Admin\AppData\Local\Temp\ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5.exe
"C:\Users\Admin\AppData\Local\Temp\ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\ee77b42fb254cef1f950668b0be51d87239d5134f0f92819fd8da1093fc8ced5')
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote startup_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\SCV.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
5f92916b1726cf808a41516863b07524

SHA1
61cccbfff89b7a14450d4f77333866ccbecd3f71

SHA256
3c36ccbdd19677864893a66cbf67c16f18059e601f65297613b0d0ec0bf8dbcd

SHA512
862d252b649985f9a6dae12d0f9b850607792d733bb1ff828768c40e39db6713b6ce95e33c886f46a895ebb884a66894119cc51655f94867a9944322b4a4196e

Download Submit
memory/1896-14-0x000000001B2C0000-0x000000001B5A2000-memory.dmp

Filesize
2.9MB

Download
memory/1896-15-0x0000000002570000-0x0000000002578000-memory.dmp

Filesize
32KB

Download
memory/2156-6-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2156-7-0x000000001B370000-0x000000001B652000-memory.dmp

Filesize
2.9MB

Download
memory/2156-8-0x00000000023A0000-0x00000000023A8000-memory.dmp

Filesize
32KB

Download
memory/2772-0-0x000007FEF5583000-0x000007FEF5584000-memory.dmp

Filesize
4KB

Download
memory/2772-1-0x00000000000C0000-0x00000000001F2000-memory.dmp

Filesize
1.2MB

Download
memory/2772-17-0x000000001B860000-0x000000001BB84000-memory.dmp

Filesize
3.1MB

Download
memory/2772-18-0x000007FEF5583000-0x000007FEF5584000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads