quasar | 8f379aea1158c492af7bd6361b1b0c8e5b4d2c73062968eb3231da123c4160df | Triage

Analysis

max time kernel
115s
max time network
120s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04/11/2024, 06:37

Sharing

Reason

Machine shutdown

Report Analysis Logs

General

Target

Facebook breaker.zip
Size

1.2MB
MD5

60baabf5f07b439be78195450dacff3a
SHA1

4c21ad0c866035b9cd720c904c07d6d5a9f47a8c
SHA256

8f379aea1158c492af7bd6361b1b0c8e5b4d2c73062968eb3231da123c4160df
SHA512

bf4d9b38a0575b7fe0200e3145cabd934abf3abd7192f32080c248b847787de724bae8f02ca6df207f75d4557270f8487e87bcc6100016ac27c5bfa61e498fe1
SSDEEP

24576:sPhAekqOX+cSocIXNgg3DZ0dgBBFegQHfmrcFebKpDH8pZJfXm5gQEd:0h+qOOc+IXPDZnFeQrcUKpDcXm5kd

Score

10^/10

quasar víctima spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Víctima

C2

crismulticuenta-30512.portmap.host:30512

Mutex

d7480f6f-e85f-4b68-8813-8279e2e6cb96

Attributes

encryption_key
8497DDBEB7064872EF356A0D1A58DE488578E1E0
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Updater
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral4/files/0x001900000002aace-2.dat	family_quasar
behavioral4/memory/3232-5-0x0000000000780000-0x0000000000AA6000-memory.dmp	family_quasar

Executes dropped EXE 7 IoCs

pid	Process
3232	Facebook breaker.exe
2216	Facebook breaker.exe
2256	Facebook breaker.exe
3868	Client.exe
3612	Client.exe
3204	Facebook breaker.exe
4672	Facebook breaker.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "186"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3792	schtasks.exe
2084	schtasks.exe
3940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2256	Facebook breaker.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	1908	7zFM.exe
Token: 35	1908	7zFM.exe
Token: SeSecurityPrivilege	1908	7zFM.exe
Token: SeDebugPrivilege	3232	Facebook breaker.exe
Token: SeDebugPrivilege	2216	Facebook breaker.exe
Token: SeDebugPrivilege	2256	Facebook breaker.exe
Token: SeDebugPrivilege	3612	Client.exe
Token: SeDebugPrivilege	3204	Facebook breaker.exe
Token: SeDebugPrivilege	4672	Facebook breaker.exe
Token: SeShutdownPrivilege	4856	shutdown.exe
Token: SeRemoteShutdownPrivilege	4856	shutdown.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1908	7zFM.exe
1908	7zFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3140	LogonUI.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 3792	3232	Facebook breaker.exe	88
PID 3232 wrote to memory of 3792	3232	Facebook breaker.exe	88
PID 2216 wrote to memory of 2084	2216	Facebook breaker.exe	89
PID 2216 wrote to memory of 2084	2216	Facebook breaker.exe	89
PID 3232 wrote to memory of 3868	3232	Facebook breaker.exe	92
PID 3232 wrote to memory of 3868	3232	Facebook breaker.exe	92
PID 2216 wrote to memory of 3612	2216	Facebook breaker.exe	93
PID 2216 wrote to memory of 3612	2216	Facebook breaker.exe	93
PID 3612 wrote to memory of 3940	3612	Client.exe	94
PID 3612 wrote to memory of 3940	3612	Client.exe	94
PID 3612 wrote to memory of 4856	3612	Client.exe	99
PID 3612 wrote to memory of 4856	3612	Client.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Facebook breaker.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1908

C:\Users\Admin\Desktop\Facebook breaker.exe
"C:\Users\Admin\Desktop\Facebook breaker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3792
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  PID:3868

C:\Users\Admin\Desktop\Facebook breaker.exe
"C:\Users\Admin\Desktop\Facebook breaker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2084
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3940
- - C:\Windows\System32\shutdown.exe
    "C:\Windows\System32\shutdown.exe" /s /t 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4856

C:\Users\Admin\Desktop\Facebook breaker.exe
"C:\Users\Admin\Desktop\Facebook breaker.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Users\Admin\Desktop\Facebook breaker.exe
"C:\Users\Admin\Desktop\Facebook breaker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Users\Admin\Desktop\Facebook breaker.exe
"C:\Users\Admin\Desktop\Facebook breaker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a1b055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Credentials in Registry

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Facebook breaker.exe.log

Filesize
1KB

MD5
b4e91d2e5f40d5e2586a86cf3bb4df24

SHA1
31920b3a41aa4400d4a0230a7622848789b38672

SHA256
5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

SHA512
968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

Download Submit
C:\Users\Admin\Desktop\Facebook breaker.exe

Filesize
3.1MB

MD5
54015452b4c7ca1af1e48c57d8169ae8

SHA1
31fd25eb9d5142f0cd3c281ce0617c9843ee6088

SHA256
d65476ae21d3f06713febd1ec371f89832248bee5d8fd0717f515df2d4aad2bb

SHA512
6ad3294c6eb7b12ca3538b85835ca36c9bf523b474db26268900ccee866e32067e2b2b2a872b4360c457b759de562572503c7f9ffdbb4ee836994154ec01ff55

Download Submit
memory/2216-11-0x00007FF8EB6F0000-0x00007FF8EC1B2000-memory.dmp

Filesize
10.8MB

Download
memory/2216-18-0x00007FF8EB6F0000-0x00007FF8EC1B2000-memory.dmp

Filesize
10.8MB

Download
memory/3232-4-0x00007FF8EB6F3000-0x00007FF8EB6F5000-memory.dmp

Filesize
8KB

Download
memory/3232-5-0x0000000000780000-0x0000000000AA6000-memory.dmp

Filesize
3.1MB

Download
memory/3232-12-0x00007FF8EB6F0000-0x00007FF8EC1B2000-memory.dmp

Filesize
10.8MB

Download
memory/3232-19-0x00007FF8EB6F0000-0x00007FF8EC1B2000-memory.dmp

Filesize
10.8MB

Download
memory/3612-23-0x000000001BD70000-0x000000001BDC0000-memory.dmp

Filesize
320KB

Download
memory/3612-24-0x000000001C4A0000-0x000000001C552000-memory.dmp

Filesize
712KB

Download
memory/3612-27-0x000000001C400000-0x000000001C412000-memory.dmp

Filesize
72KB

Download
memory/3612-28-0x000000001C460000-0x000000001C49C000-memory.dmp

Filesize
240KB

Download