quasar | bde55fc54af61ab48291e3da95de4583ac712a546898cb80d2f1a3b9d61cd943

General

Target

Client-built.exe
Size

3.1MB
MD5

26be42d7c0a7e72352015d36f8359f39
SHA1

ae8d5520128a5851161f53f549b2848c21b380be
SHA256

bde55fc54af61ab48291e3da95de4583ac712a546898cb80d2f1a3b9d61cd943
SHA512

60134b8b212e8bc3dec13fb90748a594cdf275265d2ed55a6719fed96b246a9e4f2b71080ab4effe2aefdc1108f27e53e423718fd8502b54ab3153cca44da54b
SSDEEP

49152:Lv6lL26AaNeWgPhlmVqvMQ7XSKzFhRJ61bR3LoGdCOTHHB72eh2NT:LviL26AaNeWgPhlmVqkQ7XSKzjRJ6HS

Score

10^/10

quasar sigma defense_evasion spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

sigma

C2

192.168.1.35:4782

Mutex

f0e2a556-a493-438f-96ae-a0a36490d4a7

Attributes

encryption_key
2E8E60D973DF9D3760020D9B3785B9D56136B0B0
install_name
xbox-connect settings.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
XWARN

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/2840-1-0x0000000000BB0000-0x0000000000ED4000-memory.dmp	family_quasar
behavioral1/files/0x0008000000015dc3-5.dat	family_quasar
behavioral1/memory/2816-7-0x0000000000F30000-0x0000000001254000-memory.dmp	family_quasar

Executes dropped EXE 4 IoCs

pid	Process
2816	xbox-connect settings.exe
1532	xbox-connect settings.exe
288	xbox-connect settings.exe
2388	xbox-connect settings.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
2104	verclsid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	Client-built.exe
Token: SeDebugPrivilege	2816	xbox-connect settings.exe
Token: SeDebugPrivilege	1532	xbox-connect settings.exe
Token: SeDebugPrivilege	288	xbox-connect settings.exe
Token: SeDebugPrivilege	2388	xbox-connect settings.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2816	xbox-connect settings.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2816	xbox-connect settings.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2816	xbox-connect settings.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2816	2840	Client-built.exe	30
PID 2840 wrote to memory of 2816	2840	Client-built.exe	30
PID 2840 wrote to memory of 2816	2840	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Roaming\XWARN\xbox-connect settings.exe
  "C:\Users\Admin\AppData\Roaming\XWARN\xbox-connect settings.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2816

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2764

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:2104

C:\Users\Admin\AppData\Roaming\XWARN\xbox-connect settings.exe
"C:\Users\Admin\AppData\Roaming\XWARN\xbox-connect settings.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Users\Admin\AppData\Roaming\XWARN\xbox-connect settings.exe
"C:\Users\Admin\AppData\Roaming\XWARN\xbox-connect settings.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:288

C:\Users\Admin\AppData\Roaming\XWARN\xbox-connect settings.exe
"C:\Users\Admin\AppData\Roaming\XWARN\xbox-connect settings.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

1

T1218

Verclsid

1

T1218.012

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\XWARN\xbox-connect settings.exe

Filesize
3.1MB

MD5
26be42d7c0a7e72352015d36f8359f39

SHA1
ae8d5520128a5851161f53f549b2848c21b380be

SHA256
bde55fc54af61ab48291e3da95de4583ac712a546898cb80d2f1a3b9d61cd943

SHA512
60134b8b212e8bc3dec13fb90748a594cdf275265d2ed55a6719fed96b246a9e4f2b71080ab4effe2aefdc1108f27e53e423718fd8502b54ab3153cca44da54b

Download Submit
memory/2816-7-0x0000000000F30000-0x0000000001254000-memory.dmp

Filesize
3.1MB

Download
memory/2816-9-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2816-10-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2816-11-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2840-0-0x000007FEF5793000-0x000007FEF5794000-memory.dmp

Filesize
4KB

Download
memory/2840-1-0x0000000000BB0000-0x0000000000ED4000-memory.dmp

Filesize
3.1MB

Download
memory/2840-2-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2840-8-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing