quasar | 86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6

General

Target

86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe
Size

34KB
MD5

9de372f748c4a9dd77ddbfb325c1a31d
SHA1

bef15c9f755dd25031424a63a07ec5ec8199c92e
SHA256

86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6
SHA512

2b7f936be2afd76990a65c5f32bba350ce2b96b9a9c14b14190bf2fa3bced04953787eb12b7f17e600e3a9000328fdfeea851373a21e16919c874964039a83d7
SSDEEP

768:ZCB/mZMXnTgjjSxKSbG6d30tjRi2T5EXbOfq1lk7kbzP:ZIxTgh29d3KRXT5cbOt7knP

Score

10^/10

quasar fontdrvhost defense_evasion execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

fontdrvhost

C2

archerleet.duckdns.org:1862

Mutex

92d56566-deb6-4133-9031-d3e24abe97f9

Attributes

encryption_key
0971EF27DF92928DE49B97AC507E38E80FF68C6E
install_name
fontdrvhost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
fontdrvhost
subdirectory
Driver

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Driver\fontdrvhost.exe	family_quasar
behavioral2/memory/2976-31-0x0000000000510000-0x0000000000834000-memory.dmp	family_quasar

Blocklisted process makes network request 3 IoCs

Processes:

powershell.exe

flow pid process

13 3904 powershell.exe
16 3904 powershell.exe
17 3904 powershell.exe
Downloads MZ/PE file

flow	pid	process
13	3904	powershell.exe
16	3904	powershell.exe
17	3904	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe

Deletes itself 1 IoCs

Processes:

powershell.EXE

pid process

4976 powershell.EXE
Executes dropped EXE 1 IoCs

Processes:

fontdrvhost.exe

pid process

2976 fontdrvhost.exe
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

pid	process
4976	powershell.EXE

pid	process
2976	fontdrvhost.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.EXE

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

3904 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3904	powershell.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

powershell.EXE

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

632 schtasks.exe
4936 schtasks.exe

pid	process
632	schtasks.exe
4936	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exepowershell.exepowershell.EXE

pid	process
2100	86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe
3904	powershell.exe
3904	powershell.exe
4976	powershell.EXE
4976	powershell.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exepowershell.exefontdrvhost.exepowershell.EXE

description	pid	process
Token: SeDebugPrivilege	2100	86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeDebugPrivilege	2976	fontdrvhost.exe
Token: SeDebugPrivilege	4976	powershell.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fontdrvhost.exe

pid process

2976 fontdrvhost.exe

pid	process
2976	fontdrvhost.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exefontdrvhost.exe

description	pid	process	target process
PID 2100 wrote to memory of 3904	2100	86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe	powershell.exe
PID 2100 wrote to memory of 3904	2100	86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe	powershell.exe
PID 2100 wrote to memory of 2976	2100	86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe	fontdrvhost.exe
PID 2100 wrote to memory of 2976	2100	86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe	fontdrvhost.exe
PID 2976 wrote to memory of 4936	2976	fontdrvhost.exe	schtasks.exe
PID 2976 wrote to memory of 4936	2976	fontdrvhost.exe	schtasks.exe
PID 2100 wrote to memory of 632	2100	86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe	schtasks.exe
PID 2100 wrote to memory of 632	2100	86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe	schtasks.exe
PID 2100 wrote to memory of 5068	2100	86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe	schtasks.exe
PID 2100 wrote to memory of 5068	2100	86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe	schtasks.exe
PID 2100 wrote to memory of 4044	2100	86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe	schtasks.exe
PID 2100 wrote to memory of 4044	2100	86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe
"C:\Users\Admin\AppData\Local\Temp\86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3904
- C:\Users\Admin\AppData\Roaming\Driver\fontdrvhost.exe
  "C:\Users\Admin\AppData\Roaming\Driver\fontdrvhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "fontdrvhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Driver\fontdrvhost.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4936
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn DeleteSelf /tr "powershell -Command Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe' -Force" /sc once /st 05:18 /ru System
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:632
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /run /tn DeleteSelf
  2⤵
  PID:5068
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /delete /tn DeleteSelf /f
  2⤵
  PID:4044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -Command Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe" -Force
1⤵
- Deletes itself
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zp52ndcm.y1e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Driver\fontdrvhost.exe

Filesize
3.1MB

MD5
2bb2268a2514ef3785639122f1155970

SHA1
a39fbba26221e9e7854de80b374ebfcb99ad9bf1

SHA256
9b0f3300c2d0ca21337b0825e47d6391c74d10f3e00ccae2b2bf57d3a066c91b

SHA512
7e5e8cdcaf1cd90d8fb2e3f242968f409daefac45b3428a8452d9c184238447477875770b598123bf3c00619faf31eb4581a6d8e023b11b6307c89f310ef661c

Download Submit
memory/2100-1-0x00000000008E0000-0x00000000008EE000-memory.dmp

Filesize
56KB

Download
memory/2100-11-0x00007FFF074B0000-0x00007FFF07779000-memory.dmp

Filesize
2.8MB

Download
memory/2100-12-0x0000000002C90000-0x0000000002CB2000-memory.dmp

Filesize
136KB

Download
memory/2100-13-0x000000001CEF0000-0x000000001D066000-memory.dmp

Filesize
1.5MB

Download
memory/2100-14-0x000000001D280000-0x000000001D48A000-memory.dmp

Filesize
2.0MB

Download
memory/2100-35-0x00007FFF074B0000-0x00007FFF07779000-memory.dmp

Filesize
2.8MB

Download
memory/2100-0-0x00007FFF074B0000-0x00007FFF07779000-memory.dmp

Filesize
2.8MB

Download
memory/2100-26-0x00007FFF074B0000-0x00007FFF07779000-memory.dmp

Filesize
2.8MB

Download
memory/2976-31-0x0000000000510000-0x0000000000834000-memory.dmp

Filesize
3.1MB

Download
memory/2976-32-0x000000001BC00000-0x000000001BC50000-memory.dmp

Filesize
320KB

Download
memory/2976-33-0x000000001BD10000-0x000000001BDC2000-memory.dmp

Filesize
712KB

Download
memory/3904-28-0x00007FFF074B0000-0x00007FFF07779000-memory.dmp

Filesize
2.8MB

Download
memory/3904-16-0x00007FFF074B0000-0x00007FFF07779000-memory.dmp

Filesize
2.8MB

Download
memory/3904-15-0x00007FFF074B0000-0x00007FFF07779000-memory.dmp

Filesize
2.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads