quasar | 5e6dd4da06fc90ffca3baf93dd667d0a09a6d7a1fc449936c9a3d85e7187cb46

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

beta_v1.0.4.exe
Size

348KB
MD5

f289d19ee6059d4e46e41cfd359ee221
SHA1

9cf505b34b9b9e26d7f5827f57f6eae80fedd480
SHA256

5e6dd4da06fc90ffca3baf93dd667d0a09a6d7a1fc449936c9a3d85e7187cb46
SHA512

6203aaa554068a3d105f71147948a5391142e5cf897461a8c6de7908790dca3902624fff02a4b13e497be8f67f85e9fd5b03844805828ffc1617b12c5fd78652
SSDEEP

6144:77NHXf500MirO57lIItbtUWUebCWauali:Hd50/5b/Oeb6uEi

Score

10^/10

quasar betatest discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

betatest

94.216.15.177:4782

Mutex

QSR_MUTEX_2Yw0HjfVLWnEPRGNYg

Attributes

encryption_key
SCsaUUCljEt68jZA9Hzs
install_name
betatester_6-24.exe
log_directory
Logs
reconnect_delay
3000
startup_key
betatest
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1600-1-0x00000000013A0000-0x00000000013FE000-memory.dmp	family_quasar
behavioral1/files/0x0008000000015d0e-4.dat	family_quasar
behavioral1/memory/2340-10-0x0000000000990000-0x00000000009EE000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

betatester_6-24.exe

pid	Process
2340	betatester_6-24.exe

Loads dropped DLL 1 IoCs

Processes:

beta_v1.0.4.exe

pid	Process
1600	beta_v1.0.4.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
2	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

PING.EXEbeta_v1.0.4.exeschtasks.exebetatester_6-24.exeschtasks.exeschtasks.execmd.exechcp.com

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	beta_v1.0.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	betatester_6-24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

PING.EXE

pid	Process
1960	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
1960	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exe

pid	Process
2360	schtasks.exe
2768	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

beta_v1.0.4.exebetatester_6-24.exe

description	pid	Process
Token: SeDebugPrivilege	1600	beta_v1.0.4.exe
Token: SeDebugPrivilege	2340	betatester_6-24.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

betatester_6-24.exe

pid	Process
2340	betatester_6-24.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

beta_v1.0.4.exebetatester_6-24.execmd.exe

description	pid	Process	procid_target
PID 1600 wrote to memory of 2360	1600	beta_v1.0.4.exe	31
PID 1600 wrote to memory of 2360	1600	beta_v1.0.4.exe	31
PID 1600 wrote to memory of 2360	1600	beta_v1.0.4.exe	31
PID 1600 wrote to memory of 2360	1600	beta_v1.0.4.exe	31
PID 1600 wrote to memory of 2340	1600	beta_v1.0.4.exe	33
PID 1600 wrote to memory of 2340	1600	beta_v1.0.4.exe	33
PID 1600 wrote to memory of 2340	1600	beta_v1.0.4.exe	33
PID 1600 wrote to memory of 2340	1600	beta_v1.0.4.exe	33
PID 2340 wrote to memory of 2768	2340	betatester_6-24.exe	34
PID 2340 wrote to memory of 2768	2340	betatester_6-24.exe	34
PID 2340 wrote to memory of 2768	2340	betatester_6-24.exe	34
PID 2340 wrote to memory of 2768	2340	betatester_6-24.exe	34
PID 2340 wrote to memory of 2688	2340	betatester_6-24.exe	37
PID 2340 wrote to memory of 2688	2340	betatester_6-24.exe	37
PID 2340 wrote to memory of 2688	2340	betatester_6-24.exe	37
PID 2340 wrote to memory of 2688	2340	betatester_6-24.exe	37
PID 2340 wrote to memory of 2132	2340	betatester_6-24.exe	39
PID 2340 wrote to memory of 2132	2340	betatester_6-24.exe	39
PID 2340 wrote to memory of 2132	2340	betatester_6-24.exe	39
PID 2340 wrote to memory of 2132	2340	betatester_6-24.exe	39
PID 2132 wrote to memory of 1568	2132	cmd.exe	41
PID 2132 wrote to memory of 1568	2132	cmd.exe	41
PID 2132 wrote to memory of 1568	2132	cmd.exe	41
PID 2132 wrote to memory of 1568	2132	cmd.exe	41
PID 2132 wrote to memory of 1960	2132	cmd.exe	42
PID 2132 wrote to memory of 1960	2132	cmd.exe	42
PID 2132 wrote to memory of 1960	2132	cmd.exe	42
PID 2132 wrote to memory of 1960	2132	cmd.exe	42

C:\Users\Admin\AppData\Local\Temp\beta_v1.0.4.exe
"C:\Users\Admin\AppData\Local\Temp\beta_v1.0.4.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "betatest" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\beta_v1.0.4.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2360
- C:\Users\Admin\AppData\Roaming\SubDir\betatester_6-24.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\betatester_6-24.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "betatest" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\betatester_6-24.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2768
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /delete /tn "betatest" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2688
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\0C3pQcKDwv59.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:1568
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0C3pQcKDwv59.bat

Filesize
271B

MD5
9eae6a9a559930a9dc75c24e950af250

SHA1
f306396d13bcd2706067dd35f0f7cf562ac553f1

SHA256
0de838c74aeb61fc0da80fb7e20636a41a85f70d0c9408ce613dc4a793d55691

SHA512
cc1360132533a74ae84b831eebe41ad6927ae40267fc09b2d2336fa4ae0b3a135cbe5c50a8205784ed9dfd9ecee1cc23bfa5e4f1096df2cbb9fc8e5f5e49ccb9

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\11-25-~1

Filesize
224B

MD5
9355f2f0df88956e9c8ed0c619dedc9f

SHA1
21c545efa8866a79384cc067b496b5351f8bab51

SHA256
e4894b97926edb513549301c148ceecd56acdb937ca7433eee22371dec95db30

SHA512
339ebe95284d3b108a578ba486e23a195a136ddb94b6c578e52d22348d6c81e02bb688bd6fe1837b29b36b4a0a98856de9a394476136a7eec71c60c42da1213e

Download Submit
\Users\Admin\AppData\Roaming\SubDir\betatester_6-24.exe

Filesize
348KB

MD5
f289d19ee6059d4e46e41cfd359ee221

SHA1
9cf505b34b9b9e26d7f5827f57f6eae80fedd480

SHA256
5e6dd4da06fc90ffca3baf93dd667d0a09a6d7a1fc449936c9a3d85e7187cb46

SHA512
6203aaa554068a3d105f71147948a5391142e5cf897461a8c6de7908790dca3902624fff02a4b13e497be8f67f85e9fd5b03844805828ffc1617b12c5fd78652

Download Submit
memory/1600-1-0x00000000013A0000-0x00000000013FE000-memory.dmp

Filesize
376KB

Download
memory/1600-2-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/1600-11-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/1600-0-0x0000000074DEE000-0x0000000074DEF000-memory.dmp

Filesize
4KB

Download
memory/2340-10-0x0000000000990000-0x00000000009EE000-memory.dmp

Filesize
376KB

Download
memory/2340-14-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-15-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-12-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-25-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-9-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download