quasar | 8f379aea1158c492af7bd6361b1b0c8e5b4d2c73062968eb3231da123c4160df | Triage

Analysis

max time kernel
807s
max time network
812s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/11/2024, 06:37

Sharing

Report Analysis Logs

General

Target

Facebook breaker.zip
Size

1.2MB
MD5

60baabf5f07b439be78195450dacff3a
SHA1

4c21ad0c866035b9cd720c904c07d6d5a9f47a8c
SHA256

8f379aea1158c492af7bd6361b1b0c8e5b4d2c73062968eb3231da123c4160df
SHA512

bf4d9b38a0575b7fe0200e3145cabd934abf3abd7192f32080c248b847787de724bae8f02ca6df207f75d4557270f8487e87bcc6100016ac27c5bfa61e498fe1
SSDEEP

24576:sPhAekqOX+cSocIXNgg3DZ0dgBBFegQHfmrcFebKpDH8pZJfXm5gQEd:0h+qOOc+IXPDZnFeQrcUKpDcXm5kd

Score

10^/10

quasar víctima spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Víctima

C2

crismulticuenta-30512.portmap.host:30512

Mutex

d7480f6f-e85f-4b68-8813-8279e2e6cb96

Attributes

encryption_key
8497DDBEB7064872EF356A0D1A58DE488578E1E0
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Updater
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 5 IoCs

resource	yara_rule
behavioral1/files/0x0007000000018731-3.dat	family_quasar
behavioral1/memory/2956-4-0x00000000001E0000-0x0000000000506000-memory.dmp	family_quasar
behavioral1/memory/2772-9-0x00000000000D0000-0x00000000003F6000-memory.dmp	family_quasar
behavioral1/memory/2212-11-0x0000000000E30000-0x0000000001156000-memory.dmp	family_quasar
behavioral1/memory/636-18-0x0000000000200000-0x0000000000526000-memory.dmp	family_quasar

Executes dropped EXE 6 IoCs

pid	Process
2956	Facebook breaker.exe
2772	Client.exe
2212	Facebook breaker.exe
2216	Facebook breaker.exe
2728	Facebook breaker.exe
636	Facebook breaker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2668	schtasks.exe
2688	schtasks.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	2092	7zFM.exe
Token: 35	2092	7zFM.exe
Token: SeSecurityPrivilege	2092	7zFM.exe
Token: SeDebugPrivilege	2956	Facebook breaker.exe
Token: SeDebugPrivilege	2772	Client.exe
Token: SeDebugPrivilege	2212	Facebook breaker.exe
Token: SeDebugPrivilege	2216	Facebook breaker.exe
Token: SeDebugPrivilege	2728	Facebook breaker.exe
Token: SeDebugPrivilege	636	Facebook breaker.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2092	7zFM.exe
2092	7zFM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2668	2956	Facebook breaker.exe	33
PID 2956 wrote to memory of 2668	2956	Facebook breaker.exe	33
PID 2956 wrote to memory of 2668	2956	Facebook breaker.exe	33
PID 2956 wrote to memory of 2772	2956	Facebook breaker.exe	35
PID 2956 wrote to memory of 2772	2956	Facebook breaker.exe	35
PID 2956 wrote to memory of 2772	2956	Facebook breaker.exe	35
PID 2772 wrote to memory of 2688	2772	Client.exe	36
PID 2772 wrote to memory of 2688	2772	Client.exe	36
PID 2772 wrote to memory of 2688	2772	Client.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Facebook breaker.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2092

C:\Users\Admin\Desktop\Facebook breaker.exe
"C:\Users\Admin\Desktop\Facebook breaker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Windows Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2668
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Windows Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2688

C:\Users\Admin\Desktop\Facebook breaker.exe
"C:\Users\Admin\Desktop\Facebook breaker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Users\Admin\Desktop\Facebook breaker.exe
"C:\Users\Admin\Desktop\Facebook breaker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2216

C:\Users\Admin\Desktop\Facebook breaker.exe
"C:\Users\Admin\Desktop\Facebook breaker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Users\Admin\Desktop\Facebook breaker.exe
"C:\Users\Admin\Desktop\Facebook breaker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Facebook breaker.exe

Filesize
3.1MB

MD5
54015452b4c7ca1af1e48c57d8169ae8

SHA1
31fd25eb9d5142f0cd3c281ce0617c9843ee6088

SHA256
d65476ae21d3f06713febd1ec371f89832248bee5d8fd0717f515df2d4aad2bb

SHA512
6ad3294c6eb7b12ca3538b85835ca36c9bf523b474db26268900ccee866e32067e2b2b2a872b4360c457b759de562572503c7f9ffdbb4ee836994154ec01ff55

Download Submit
memory/636-18-0x0000000000200000-0x0000000000526000-memory.dmp

Filesize
3.1MB

Download
memory/2212-11-0x0000000000E30000-0x0000000001156000-memory.dmp

Filesize
3.1MB

Download
memory/2772-9-0x00000000000D0000-0x00000000003F6000-memory.dmp

Filesize
3.1MB

Download
memory/2956-4-0x00000000001E0000-0x0000000000506000-memory.dmp

Filesize
3.1MB

Download