quasar | 7fc8b932158ef8ced6bebf0c254f96cd6cd4cd1a0fd3a90e54652768c477aaf7

General

Target

7fc8b932158ef8ced6bebf0c254f96cd6cd4cd1a0fd3a90e54652768c477aaf7.exe
Size

3.1MB
MD5

8cadd9d05b28bdf0f3caeed0ce516d9c
SHA1

b6b04039117acc2ffaef424eeaf6d99b4086487f
SHA256

7fc8b932158ef8ced6bebf0c254f96cd6cd4cd1a0fd3a90e54652768c477aaf7
SHA512

2e1c01240ac20ac2a374926893fa4796d4f4daa8f479c1c55ad62791ca0cb32cc8baf192d849abefc9c1a88d69045f4aeb563105d5d54fcac049b3b8f2ba7fee
SSDEEP

49152:zvghBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkaj3QaEfeak/l4XoGdPTHHB72eh2NT:zvSt2d5aKCuVPzlEmVQ0wvwfj3QSY

Score

10^/10

quasar manager spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Manager

C2

serveo.net:11453

Mutex

a851cc5b-e50f-4270-9929-06c6323cdb3d

Attributes

encryption_key
5A3C537E5FB2739D5B2468FC37915D58EF4AC5EA
install_name
Runtime broker.exe
log_directory
Microsoftsessential
reconnect_delay
3000
startup_key
Runtime broker
subdirectory
Microsoft_Essentials

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/2376-1-0x0000000000B50000-0x0000000000E74000-memory.dmp	family_quasar
behavioral1/files/0x000c000000016458-6.dat	family_quasar
behavioral1/memory/1216-9-0x00000000001D0000-0x00000000004F4000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
1216	Runtime broker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2240	schtasks.exe
2520	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	7fc8b932158ef8ced6bebf0c254f96cd6cd4cd1a0fd3a90e54652768c477aaf7.exe
Token: SeDebugPrivilege	1216	Runtime broker.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2240	2376	7fc8b932158ef8ced6bebf0c254f96cd6cd4cd1a0fd3a90e54652768c477aaf7.exe	29
PID 2376 wrote to memory of 2240	2376	7fc8b932158ef8ced6bebf0c254f96cd6cd4cd1a0fd3a90e54652768c477aaf7.exe	29
PID 2376 wrote to memory of 2240	2376	7fc8b932158ef8ced6bebf0c254f96cd6cd4cd1a0fd3a90e54652768c477aaf7.exe	29
PID 2376 wrote to memory of 1216	2376	7fc8b932158ef8ced6bebf0c254f96cd6cd4cd1a0fd3a90e54652768c477aaf7.exe	31
PID 2376 wrote to memory of 1216	2376	7fc8b932158ef8ced6bebf0c254f96cd6cd4cd1a0fd3a90e54652768c477aaf7.exe	31
PID 2376 wrote to memory of 1216	2376	7fc8b932158ef8ced6bebf0c254f96cd6cd4cd1a0fd3a90e54652768c477aaf7.exe	31
PID 1216 wrote to memory of 2520	1216	Runtime broker.exe	32
PID 1216 wrote to memory of 2520	1216	Runtime broker.exe	32
PID 1216 wrote to memory of 2520	1216	Runtime broker.exe	32

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7fc8b932158ef8ced6bebf0c254f96cd6cd4cd1a0fd3a90e54652768c477aaf7.exe
"C:\Users\Admin\AppData\Local\Temp\7fc8b932158ef8ced6bebf0c254f96cd6cd4cd1a0fd3a90e54652768c477aaf7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Runtime broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft_Essentials\Runtime broker.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2240
- C:\Users\Admin\AppData\Roaming\Microsoft_Essentials\Runtime broker.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft_Essentials\Runtime broker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Runtime broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft_Essentials\Runtime broker.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft_Essentials\Runtime broker.exe

Filesize
3.1MB

MD5
8cadd9d05b28bdf0f3caeed0ce516d9c

SHA1
b6b04039117acc2ffaef424eeaf6d99b4086487f

SHA256
7fc8b932158ef8ced6bebf0c254f96cd6cd4cd1a0fd3a90e54652768c477aaf7

SHA512
2e1c01240ac20ac2a374926893fa4796d4f4daa8f479c1c55ad62791ca0cb32cc8baf192d849abefc9c1a88d69045f4aeb563105d5d54fcac049b3b8f2ba7fee

Download Submit
memory/1216-10-0x000007FEF5A90000-0x000007FEF647C000-memory.dmp

Filesize
9.9MB

Download
memory/1216-11-0x000007FEF5A90000-0x000007FEF647C000-memory.dmp

Filesize
9.9MB

Download
memory/1216-9-0x00000000001D0000-0x00000000004F4000-memory.dmp

Filesize
3.1MB

Download
memory/1216-12-0x000007FEF5A90000-0x000007FEF647C000-memory.dmp

Filesize
9.9MB

Download
memory/2376-0-0x000007FEF5A93000-0x000007FEF5A94000-memory.dmp

Filesize
4KB

Download
memory/2376-1-0x0000000000B50000-0x0000000000E74000-memory.dmp

Filesize
3.1MB

Download
memory/2376-2-0x000007FEF5A90000-0x000007FEF647C000-memory.dmp

Filesize
9.9MB

Download
memory/2376-8-0x000007FEF5A90000-0x000007FEF647C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads