quasar | a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe
Size

375KB
MD5

55029651ecad5f3be071b6abafb56d90
SHA1

a008e8d91c2725eb16e42c3800ace5492a32416e
SHA256

a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a
SHA512

83dc82b2aa027ebd62aeceb15b6ae1e71a72da16f557833b8439cda6dded817799748a06ef7721931626d06b687a57fc4be56f1e8846d6e9a6708ad757afb903
SSDEEP

6144:YbqQ4i1FFiEKZVSQZzs5jQKbgQ203StbjjSQkzaozVVqHk:CpliPScgCy73StbjjSQkVzV0Hk

Score

10^/10

quasar authenticator discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Authenticator

iamaskibiditoilet-58299.portmap.host:58299

Mutex

QSR_MUTEX_bNzknSVeSVx21JnqhQ

Attributes

encryption_key
wAIAzlOLR0d5V3YI1aCM
install_name
Runtime Broker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Runtime Broker
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/2660-1-0x0000000001280000-0x00000000012E4000-memory.dmp	family_quasar
behavioral1/files/0x002e000000015d36-5.dat	family_quasar
behavioral1/memory/2448-10-0x00000000008E0000-0x0000000000944000-memory.dmp	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
2448	Runtime Broker.exe
1888	Runtime Broker.exe

Loads dropped DLL 6 IoCs

pid	Process
2660	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1424	2448	WerFault.exe	33

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2596	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2596	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2896	schtasks.exe
2828	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe
Token: SeDebugPrivilege	2448	Runtime Broker.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2448	Runtime Broker.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2896	2660	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe	31
PID 2660 wrote to memory of 2896	2660	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe	31
PID 2660 wrote to memory of 2896	2660	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe	31
PID 2660 wrote to memory of 2896	2660	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe	31
PID 2660 wrote to memory of 2448	2660	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe	33
PID 2660 wrote to memory of 2448	2660	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe	33
PID 2660 wrote to memory of 2448	2660	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe	33
PID 2660 wrote to memory of 2448	2660	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe	33
PID 2448 wrote to memory of 2828	2448	Runtime Broker.exe	34
PID 2448 wrote to memory of 2828	2448	Runtime Broker.exe	34
PID 2448 wrote to memory of 2828	2448	Runtime Broker.exe	34
PID 2448 wrote to memory of 2828	2448	Runtime Broker.exe	34
PID 2448 wrote to memory of 716	2448	Runtime Broker.exe	36
PID 2448 wrote to memory of 716	2448	Runtime Broker.exe	36
PID 2448 wrote to memory of 716	2448	Runtime Broker.exe	36
PID 2448 wrote to memory of 716	2448	Runtime Broker.exe	36
PID 2448 wrote to memory of 1424	2448	Runtime Broker.exe	38
PID 2448 wrote to memory of 1424	2448	Runtime Broker.exe	38
PID 2448 wrote to memory of 1424	2448	Runtime Broker.exe	38
PID 2448 wrote to memory of 1424	2448	Runtime Broker.exe	38
PID 716 wrote to memory of 588	716	cmd.exe	39
PID 716 wrote to memory of 588	716	cmd.exe	39
PID 716 wrote to memory of 588	716	cmd.exe	39
PID 716 wrote to memory of 588	716	cmd.exe	39
PID 716 wrote to memory of 2596	716	cmd.exe	40
PID 716 wrote to memory of 2596	716	cmd.exe	40
PID 716 wrote to memory of 2596	716	cmd.exe	40
PID 716 wrote to memory of 2596	716	cmd.exe	40
PID 716 wrote to memory of 1888	716	cmd.exe	41
PID 716 wrote to memory of 1888	716	cmd.exe	41
PID 716 wrote to memory of 1888	716	cmd.exe	41
PID 716 wrote to memory of 1888	716	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe
"C:\Users\Admin\AppData\Local\Temp\a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2896
- C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\3jWHaVesbEW2.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:716
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:588
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2596
  - - C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 1476
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3jWHaVesbEW2.bat

Filesize
215B

MD5
53370208521e8b8bf87d8e5aed020721

SHA1
0e32f6a1346e731b00eebe88f0ad4398123d281b

SHA256
88759a74926431d36d90018b64cefc2509fb28ede08442fd395b542c1f679faa

SHA512
28ebd153e507070c8b0ac2373b51421c3bdf3f2d2ada8e087ec7182c474472313dff223f8ba6cba8885543b3228d20ff2d1b94d0585c5c3e98b6dca233968833

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe

Filesize
375KB

MD5
55029651ecad5f3be071b6abafb56d90

SHA1
a008e8d91c2725eb16e42c3800ace5492a32416e

SHA256
a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a

SHA512
83dc82b2aa027ebd62aeceb15b6ae1e71a72da16f557833b8439cda6dded817799748a06ef7721931626d06b687a57fc4be56f1e8846d6e9a6708ad757afb903

Download Submit
memory/2448-11-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/2448-10-0x00000000008E0000-0x0000000000944000-memory.dmp

Filesize
400KB

Download
memory/2448-13-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/2448-29-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/2660-0-0x000000007471E000-0x000000007471F000-memory.dmp

Filesize
4KB

Download
memory/2660-1-0x0000000001280000-0x00000000012E4000-memory.dmp

Filesize
400KB

Download
memory/2660-2-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/2660-12-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads