quasar | 368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7

General

Target

368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe
Size

523KB
MD5

c53e04849d17588148c7a7b9c27835e0
SHA1

5fc49d643a10c4d4659e139915503dcd849c6707
SHA256

368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7
SHA512

2ba2b2d2b91aa8abdce55143d8185be96cd95d8341e3c8bdc5e16c2a40a7991fd1eb53e1efbbb558de72aeb468e802cc01ba07bcc7627d58dda641d4ec305a1e
SSDEEP

12288:Yh1Lk70TnvjcKcVob1y3O/Yj5QmRP8Fb5Ovm0BK2zScujuMv:Ek70TrcKkoE3O/YtZV8Fcv5BKwCuMv

Score

10^/10

quasar discovery spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar
Executes dropped EXE 1 IoCs

Processes:

dcuph.exe

pid process

3112 dcuph.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 ip-api.com

pid	process
3112	dcuph.exe

flow	ioc
10	ip-api.com

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exeschtasks.exedcuph.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcuph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

1276 schtasks.exe
3744 schtasks.exe

pid	process
1276	schtasks.exe
3744	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exedcuph.exe

description	pid	process
Token: SeDebugPrivilege	1540	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe
Token: SeDebugPrivilege	3112	dcuph.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dcuph.exe

pid process

3112 dcuph.exe

pid	process
3112	dcuph.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exedcuph.exe

description	pid	process	target process
PID 1540 wrote to memory of 1276	1540	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe	schtasks.exe
PID 1540 wrote to memory of 1276	1540	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe	schtasks.exe
PID 1540 wrote to memory of 1276	1540	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe	schtasks.exe
PID 1540 wrote to memory of 3112	1540	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe	dcuph.exe
PID 1540 wrote to memory of 3112	1540	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe	dcuph.exe
PID 1540 wrote to memory of 3112	1540	368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe	dcuph.exe
PID 3112 wrote to memory of 3744	3112	dcuph.exe	schtasks.exe
PID 3112 wrote to memory of 3744	3112	dcuph.exe	schtasks.exe
PID 3112 wrote to memory of 3744	3112	dcuph.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe
"C:\Users\Admin\AppData\Local\Temp\368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "dcuph" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7N.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1276
- C:\Users\Admin\AppData\Roaming\sysnfkn\dcuph.exe
  "C:\Users\Admin\AppData\Roaming\sysnfkn\dcuph.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "dcuph" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\sysnfkn\dcuph.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\sysnfkn\dcuph.exe

Filesize
523KB

MD5
c53e04849d17588148c7a7b9c27835e0

SHA1
5fc49d643a10c4d4659e139915503dcd849c6707

SHA256
368bf7e3b9b8ce5604d41c09be987a8d88d28c63058d65656ef777efe8a108a7

SHA512
2ba2b2d2b91aa8abdce55143d8185be96cd95d8341e3c8bdc5e16c2a40a7991fd1eb53e1efbbb558de72aeb468e802cc01ba07bcc7627d58dda641d4ec305a1e

Download Submit
memory/1540-10-0x0000000005D90000-0x0000000005DA2000-memory.dmp

Filesize
72KB

Download
memory/1540-17-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/1540-3-0x0000000004ED0000-0x0000000005474000-memory.dmp

Filesize
5.6MB

Download
memory/1540-4-0x00000000026C0000-0x0000000002788000-memory.dmp

Filesize
800KB

Download
memory/1540-5-0x00000000027A0000-0x0000000002832000-memory.dmp

Filesize
584KB

Download
memory/1540-6-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/1540-7-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/1540-11-0x00000000061C0000-0x00000000061FC000-memory.dmp

Filesize
240KB

Download
memory/1540-9-0x0000000005580000-0x00000000055E6000-memory.dmp

Filesize
408KB

Download
memory/1540-0-0x0000000074CCE000-0x0000000074CCF000-memory.dmp

Filesize
4KB

Download
memory/1540-8-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/1540-1-0x0000000004DA0000-0x0000000004E6A000-memory.dmp

Filesize
808KB

Download
memory/1540-2-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3112-18-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3112-19-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3112-20-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3112-21-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3112-22-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/3112-25-0x0000000006430000-0x000000000643A000-memory.dmp

Filesize
40KB

Download
memory/3112-26-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads