quasar | c316b0b818125541a90d7110af8c0908a8d6c73d3b846a27aed647fab6b38e00

General

Target

OneDrive.exe
Size

3.2MB
MD5

7056e050ebbfca6ae325797d51eb2d0a
SHA1

055cd6e4bde3449d72f7061620647ecb73d6b9cd
SHA256

c316b0b818125541a90d7110af8c0908a8d6c73d3b846a27aed647fab6b38e00
SHA512

0c54802ad35f5a00c5db1195df2d566bc18a384f486cc3ca00dc63bb86e3fc5d105192cfe5efe9ed62bdedb441877486ec7aedbd7a6bf59fcda2f772308b150e
SSDEEP

49152:ivlI22SsaNYfdPBldt698dBcjH09L/RBxwcoGdb9THHB72eh2NT:ivu22SsaNYfdPBldt6+dBcjHq/lL

Score

10^/10

quasar test discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Test

C2

147.185.221.22:54755

Mutex

9cabbafb-503b-49f1-ab22-adc756455c10

Attributes

encryption_key
8B93C77AC1C58EA80A3327E9FD26246A79EF3B8E
install_name
Onedrive.exe
log_directory
Logs
reconnect_delay
100
startup_key
Microsoft OneDrive
subdirectory
Onedrive

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/4468-1-0x0000000000C10000-0x0000000000F4C000-memory.dmp	family_quasar
behavioral1/files/0x001a00000002aae5-5.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
864	Onedrive.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2040	PING.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	calc.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2040	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3908	schtasks.exe
756	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4468	OneDrive.exe
Token: SeDebugPrivilege	864	Onedrive.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1008	OpenWith.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 3908	4468	OneDrive.exe	78
PID 4468 wrote to memory of 3908	4468	OneDrive.exe	78
PID 4468 wrote to memory of 864	4468	OneDrive.exe	80
PID 4468 wrote to memory of 864	4468	OneDrive.exe	80
PID 864 wrote to memory of 756	864	Onedrive.exe	81
PID 864 wrote to memory of 756	864	Onedrive.exe	81
PID 864 wrote to memory of 3456	864	Onedrive.exe	84
PID 864 wrote to memory of 3456	864	Onedrive.exe	84
PID 3456 wrote to memory of 4876	3456	cmd.exe	86
PID 3456 wrote to memory of 4876	3456	cmd.exe	86
PID 3456 wrote to memory of 4520	3456	cmd.exe	87
PID 3456 wrote to memory of 4520	3456	cmd.exe	87
PID 864 wrote to memory of 4388	864	Onedrive.exe	89
PID 864 wrote to memory of 4388	864	Onedrive.exe	89
PID 864 wrote to memory of 5044	864	Onedrive.exe	91
PID 864 wrote to memory of 5044	864	Onedrive.exe	91
PID 5044 wrote to memory of 1792	5044	cmd.exe	93
PID 5044 wrote to memory of 1792	5044	cmd.exe	93
PID 5044 wrote to memory of 2040	5044	cmd.exe	94
PID 5044 wrote to memory of 2040	5044	cmd.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
"C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Microsoft OneDrive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3908
- C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe
  "C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Microsoft OneDrive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:756
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /K CHCP 437
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\Windows\system32\chcp.com
      CHCP 437
      4⤵
      PID:4876
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      Modifies registry class
      PID:4520
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /delete /tn "Microsoft OneDrive" /f
    3⤵
    PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eexM0CgjKvEZ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1792
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Onedrive.exe.log

Filesize
1KB

MD5
b4e91d2e5f40d5e2586a86cf3bb4df24

SHA1
31920b3a41aa4400d4a0230a7622848789b38672

SHA256
5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

SHA512
968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

Download Submit
C:\Users\Admin\AppData\Local\Temp\eexM0CgjKvEZ.bat

Filesize
215B

MD5
c8124e65da45ea7e5da1e0f34194a35d

SHA1
143a4c13f101f0c5b77062b83a3347d6044ac5ef

SHA256
a93a39e04ef4f5ba76d21914014a901f92368991d3731282410c839573295f14

SHA512
9c35476351aa065392b336303c71731e92c7801d33083bd49210a88e4b5945d0f591f91d04a3dba14515c00546dd6b62e67eec32117759a9df9733062f11710e

Download Submit
C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe

Filesize
3.2MB

MD5
7056e050ebbfca6ae325797d51eb2d0a

SHA1
055cd6e4bde3449d72f7061620647ecb73d6b9cd

SHA256
c316b0b818125541a90d7110af8c0908a8d6c73d3b846a27aed647fab6b38e00

SHA512
0c54802ad35f5a00c5db1195df2d566bc18a384f486cc3ca00dc63bb86e3fc5d105192cfe5efe9ed62bdedb441877486ec7aedbd7a6bf59fcda2f772308b150e

Download Submit
memory/864-13-0x000000001C220000-0x000000001C2D2000-memory.dmp

Filesize
712KB

Download
memory/864-10-0x00007FFC667A0000-0x00007FFC67262000-memory.dmp

Filesize
10.8MB

Download
memory/864-11-0x00007FFC667A0000-0x00007FFC67262000-memory.dmp

Filesize
10.8MB

Download
memory/864-12-0x000000001BA80000-0x000000001BAD0000-memory.dmp

Filesize
320KB

Download
memory/864-16-0x0000000003190000-0x00000000031A2000-memory.dmp

Filesize
72KB

Download
memory/864-17-0x000000001BB10000-0x000000001BB4C000-memory.dmp

Filesize
240KB

Download
memory/864-18-0x00007FFC667A0000-0x00007FFC67262000-memory.dmp

Filesize
10.8MB

Download
memory/864-22-0x00007FFC667A0000-0x00007FFC67262000-memory.dmp

Filesize
10.8MB

Download
memory/4468-2-0x00007FFC667A0000-0x00007FFC67262000-memory.dmp

Filesize
10.8MB

Download
memory/4468-9-0x00007FFC667A0000-0x00007FFC67262000-memory.dmp

Filesize
10.8MB

Download
memory/4468-0-0x00007FFC667A3000-0x00007FFC667A5000-memory.dmp

Filesize
8KB

Download
memory/4468-1-0x0000000000C10000-0x0000000000F4C000-memory.dmp

Filesize
3.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads