quasar | f5625c4c1da453f6fbcce1723fb5e0f96e5bea9e3c05fa30ed5387e2688c4a5c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Synapse Loader.exe
Size

3.1MB
MD5

8cff9bae2bc1b05b8b4dd4ab5946c8b7
SHA1

93369919961d4f4cbaa65e7728ead8fd9d4dea93
SHA256

ae1b306c87730bbf7b1cd56f687903f396f8295d7d128c9897ebb5fb0ad14933
SHA512

73a9969b7dcda426b09a2a8566ed8c466e30752a161eade7e331743946d4cbcff589e3ec79d72f4b3ebb3e0e4a6665de29b87b409e7b4944d170518c0186a85e
SSDEEP

49152:avct62XlaSFNWPjljiFa2RoUYIkxxNESETk/itLoGdyOsTHHB72eh2NT:avg62XlaSFNWPjljiFXRoUYISxal5

Score

10^/10

quasar svhost spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

svhost

vnt-39824.portmap.host:39824

Mutex

a8e213b3-b8da-419b-8e37-bca8a65bb11c

Attributes

encryption_key
20999754454467FF7C9649079A3ADDFF8252D170
install_name
svhost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svhost
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4108-1-0x0000000000BD0000-0x0000000000EF4000-memory.dmp	family_quasar
behavioral2/files/0x000b000000023b93-5.dat	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	svhost.exe

Executes dropped EXE 1 IoCs

pid	Process
1096	svhost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\SubDir\svhost.exe	Synapse Loader.exe
File created	C:\Program Files\SubDir\svhost.exe	Synapse Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	svhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2976	schtasks.exe
4392	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2072	vlc.exe
3248	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2072	vlc.exe
3248	vlc.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	Synapse Loader.exe
Token: SeDebugPrivilege	1096	svhost.exe
Token: 33	3568	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3568	AUDIODG.EXE
Token: 33	2072	vlc.exe
Token: SeIncBasePriorityPrivilege	2072	vlc.exe
Token: 33	3248	vlc.exe
Token: SeIncBasePriorityPrivilege	3248	vlc.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1096	svhost.exe
1096	svhost.exe
1096	svhost.exe
1096	svhost.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1096	svhost.exe
1096	svhost.exe
1096	svhost.exe
1096	svhost.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1096	svhost.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe
3248	vlc.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 2976	4108	Synapse Loader.exe	83
PID 4108 wrote to memory of 2976	4108	Synapse Loader.exe	83
PID 4108 wrote to memory of 1096	4108	Synapse Loader.exe	85
PID 4108 wrote to memory of 1096	4108	Synapse Loader.exe	85
PID 1096 wrote to memory of 4392	1096	svhost.exe	86
PID 1096 wrote to memory of 4392	1096	svhost.exe	86
PID 1096 wrote to memory of 2072	1096	svhost.exe	106
PID 1096 wrote to memory of 2072	1096	svhost.exe	106
PID 1096 wrote to memory of 3248	1096	svhost.exe	110
PID 1096 wrote to memory of 3248	1096	svhost.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Synapse Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Synapse Loader.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Program Files\SubDir\svhost.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2976
- C:\Program Files\SubDir\svhost.exe
  "C:\Program Files\SubDir\svhost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Program Files\SubDir\svhost.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4392
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\VID-20240924-WA0004 (1).mp4"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2072
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\VID-20240924-WA0004 (1).mp4"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3248

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x53c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\SubDir\svhost.exe

Filesize
3.1MB

MD5
8cff9bae2bc1b05b8b4dd4ab5946c8b7

SHA1
93369919961d4f4cbaa65e7728ead8fd9d4dea93

SHA256
ae1b306c87730bbf7b1cd56f687903f396f8295d7d128c9897ebb5fb0ad14933

SHA512
73a9969b7dcda426b09a2a8566ed8c466e30752a161eade7e331743946d4cbcff589e3ec79d72f4b3ebb3e0e4a6665de29b87b409e7b4944d170518c0186a85e

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\ml.xspf

Filesize
304B

MD5
781602441469750c3219c8c38b515ed4

SHA1
e885acd1cbd0b897ebcedbb145bef1c330f80595

SHA256
81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

SHA512
2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
532B

MD5
88a2d7ca7e8628d38682ab18abfcd62d

SHA1
692de262f4ce2682e1a0987e4459004458473e20

SHA256
f00ba9d5b4f879d0289d5a49d944bff163b857bc647937b3667b1c1badd56c4f

SHA512
9459748ef0a388c6d98521a4a73f1a68340d334aab533afe6f3ade495241defd3a1dd286f619fb067a3fdaeed0f997eff19ffd9b1c12f75ff48d48d157a6441e

Download Submit
C:\VID-20240924-WA0004 (1).mp4

Filesize
12.8MB

MD5
93e54f13d22c3455ddb03c36aaaacd0b

SHA1
ddeeeb61d6f3c717c721c029716f8c3960aed3d3

SHA256
8c18e6fd60fa659570ddb09113f4ccc4b2b70923ee09eb2f9df1ecd57f41ce68

SHA512
057bea3dc3444711c99ddc63610fce3c4e526263f45c95bce957a68eb477f2a9d8a259cd6f8553bd8337d1779379ccaeb0a2666269a348faa264a841c24a7b3e

Download Submit
memory/1096-17-0x00007FFD2F560000-0x00007FFD30021000-memory.dmp

Filesize
10.8MB

Download
memory/1096-9-0x00007FFD2F560000-0x00007FFD30021000-memory.dmp

Filesize
10.8MB

Download
memory/1096-10-0x00007FFD2F560000-0x00007FFD30021000-memory.dmp

Filesize
10.8MB

Download
memory/1096-11-0x000000001C2F0000-0x000000001C340000-memory.dmp

Filesize
320KB

Download
memory/1096-12-0x000000001C400000-0x000000001C4B2000-memory.dmp

Filesize
712KB

Download
memory/1096-15-0x000000001C380000-0x000000001C392000-memory.dmp

Filesize
72KB

Download
memory/1096-16-0x000000001CF00000-0x000000001CF3C000-memory.dmp

Filesize
240KB

Download
memory/2072-39-0x00007FFD2A080000-0x00007FFD2A28B000-memory.dmp

Filesize
2.0MB

Download
memory/2072-41-0x00007FFD42340000-0x00007FFD42381000-memory.dmp

Filesize
260KB

Download
memory/2072-29-0x00007FF73D570000-0x00007FF73D668000-memory.dmp

Filesize
992KB

Download
memory/2072-30-0x00007FFD424D0000-0x00007FFD42504000-memory.dmp

Filesize
208KB

Download
memory/2072-38-0x00007FFD423C0000-0x00007FFD423D1000-memory.dmp

Filesize
68KB

Download
memory/2072-31-0x00007FFD2AE70000-0x00007FFD2B126000-memory.dmp

Filesize
2.7MB

Download
memory/2072-37-0x00007FFD423E0000-0x00007FFD423FD000-memory.dmp

Filesize
116KB

Download
memory/2072-85-0x00007FFD2AE70000-0x00007FFD2B126000-memory.dmp

Filesize
2.7MB

Download
memory/2072-36-0x00007FFD42400000-0x00007FFD42411000-memory.dmp

Filesize
68KB

Download
memory/2072-35-0x00007FFD42420000-0x00007FFD42437000-memory.dmp

Filesize
92KB

Download
memory/2072-34-0x00007FFD42440000-0x00007FFD42451000-memory.dmp

Filesize
68KB

Download
memory/2072-33-0x00007FFD42460000-0x00007FFD42477000-memory.dmp

Filesize
92KB

Download
memory/2072-32-0x00007FFD481D0000-0x00007FFD481E8000-memory.dmp

Filesize
96KB

Download
memory/2072-46-0x00007FFD3E6A0000-0x00007FFD3E6B1000-memory.dmp

Filesize
68KB

Download
memory/2072-45-0x00007FFD3E6C0000-0x00007FFD3E6D1000-memory.dmp

Filesize
68KB

Download
memory/2072-44-0x00007FFD42210000-0x00007FFD42221000-memory.dmp

Filesize
68KB

Download
memory/2072-43-0x00007FFD42320000-0x00007FFD42338000-memory.dmp

Filesize
96KB

Download
memory/2072-42-0x00007FFD3E6E0000-0x00007FFD3E701000-memory.dmp

Filesize
132KB

Download
memory/2072-40-0x00007FFD23770000-0x00007FFD24820000-memory.dmp

Filesize
16.7MB

Download
memory/2072-76-0x00007FFD23770000-0x00007FFD24820000-memory.dmp

Filesize
16.7MB

Download
memory/2072-49-0x00007FFD2AE70000-0x00007FFD2B126000-memory.dmp

Filesize
2.7MB

Download
memory/2072-58-0x00007FFD23770000-0x00007FFD24820000-memory.dmp

Filesize
16.7MB

Download
memory/2072-67-0x00007FFD2AE70000-0x00007FFD2B126000-memory.dmp

Filesize
2.7MB

Download
memory/4108-8-0x00007FFD2F560000-0x00007FFD30021000-memory.dmp

Filesize
10.8MB

Download
memory/4108-0-0x00007FFD2F563000-0x00007FFD2F565000-memory.dmp

Filesize
8KB

Download
memory/4108-2-0x00007FFD2F560000-0x00007FFD30021000-memory.dmp

Filesize
10.8MB

Download
memory/4108-1-0x0000000000BD0000-0x0000000000EF4000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads