quasar | 368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7

General

Target

368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe
Size

523KB
MD5

c53e04849d17588148c7a7b9c27835e0
SHA1

5fc49d643a10c4d4659e139915503dcd849c6707
SHA256

368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7
SHA512

2ba2b2d2b91aa8abdce55143d8185be96cd95d8341e3c8bdc5e16c2a40a7991fd1eb53e1efbbb558de72aeb468e802cc01ba07bcc7627d58dda641d4ec305a1e
SSDEEP

12288:Yh1Lk70TnvjcKcVob1y3O/Yj5QmRP8Fb5Ovm0BK2zScujuMv:Ek70TrcKkoE3O/YtZV8Fcv5BKwCuMv

Score

10^/10

quasar discovery spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar
Executes dropped EXE 1 IoCs

Processes:

dcuph.exe

pid process

2840 dcuph.exe
Loads dropped DLL 1 IoCs

Processes:

368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe

pid process

2196 368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com

pid	process
2840	dcuph.exe

pid	process
2196	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe

flow	ioc
2	ip-api.com

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exeschtasks.exedcuph.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcuph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2584 schtasks.exe
340 schtasks.exe

pid	process
2584	schtasks.exe
340	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exedcuph.exe

description	pid	process
Token: SeDebugPrivilege	2196	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe
Token: SeDebugPrivilege	2840	dcuph.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dcuph.exe

pid process

2840 dcuph.exe

pid	process
2840	dcuph.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exedcuph.exe

description	pid	process	target process
PID 2196 wrote to memory of 2584	2196	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe	schtasks.exe
PID 2196 wrote to memory of 2584	2196	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe	schtasks.exe
PID 2196 wrote to memory of 2584	2196	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe	schtasks.exe
PID 2196 wrote to memory of 2584	2196	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe	schtasks.exe
PID 2196 wrote to memory of 2840	2196	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe	dcuph.exe
PID 2196 wrote to memory of 2840	2196	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe	dcuph.exe
PID 2196 wrote to memory of 2840	2196	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe	dcuph.exe
PID 2196 wrote to memory of 2840	2196	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe	dcuph.exe
PID 2840 wrote to memory of 340	2840	dcuph.exe	schtasks.exe
PID 2840 wrote to memory of 340	2840	dcuph.exe	schtasks.exe
PID 2840 wrote to memory of 340	2840	dcuph.exe	schtasks.exe
PID 2840 wrote to memory of 340	2840	dcuph.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe
"C:\Users\Admin\AppData\Local\Temp\368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "dcuph" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2584
- C:\Users\Admin\AppData\Roaming\sysnfkn\dcuph.exe
  "C:\Users\Admin\AppData\Roaming\sysnfkn\dcuph.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "dcuph" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\sysnfkn\dcuph.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\sysnfkn\dcuph.exe

Filesize
523KB

MD5
c53e04849d17588148c7a7b9c27835e0

SHA1
5fc49d643a10c4d4659e139915503dcd849c6707

SHA256
368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7

SHA512
2ba2b2d2b91aa8abdce55143d8185be96cd95d8341e3c8bdc5e16c2a40a7991fd1eb53e1efbbb558de72aeb468e802cc01ba07bcc7627d58dda641d4ec305a1e

Download Submit
memory/2196-18-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2196-1-0x0000000004A30000-0x0000000004AFA000-memory.dmp

Filesize
808KB

Download
memory/2196-2-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2196-3-0x0000000004890000-0x0000000004958000-memory.dmp

Filesize
800KB

Download
memory/2196-4-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2196-5-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2196-6-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2196-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

Filesize
4KB

Download
memory/2840-13-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-17-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-14-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-16-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-15-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-21-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-22-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads