quasar | 654ce4f50fe3eaa0d41122e8702818808f3b8e047ed603dd8b81ca656bd32066

General

Target

ClientX.exe
Size

3.4MB
MD5

12b286770578c1fa0d49fc78f5261bb3
SHA1

93c9e37bcbd6e3e20ed3615f5cd50c0366f4a2fe
SHA256

654ce4f50fe3eaa0d41122e8702818808f3b8e047ed603dd8b81ca656bd32066
SHA512

04fd977eab2fd6ca7cbd90944898e863d1d6a6257b0d55a6fcc267def8e9d62b131b5da69815f5886d0244ebe41189bf9632722b0ea0b3313e2e9a6528b5110d
SSDEEP

49152:TviI22SsaNYfdPBldt698dBcjHHVz+romdwdTHHB72eh2NT:Tvv22SsaNYfdPBldt6+dBcjHHVzQ8

Score

10^/10

quasar clientware spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

ClientWare

C2

o0p2e195m0-34052.portmap.host:34052

Mutex

2cf264af-b922-4553-ab2f-ca9a14803d7c

Attributes

encryption_key
822DDA51D07B74A7A6138DEA6477731894D69371
install_name
System.exe
log_directory
Logs
reconnect_delay
2000
startup_key
WindowsData
subdirectory
Windows

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/1672-1-0x0000000001160000-0x00000000014C6000-memory.dmp	family_quasar
behavioral1/files/0x0009000000015d2a-6.dat	family_quasar
behavioral1/memory/2092-10-0x0000000000F90000-0x00000000012F6000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2092	System.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\Windows\System.exe	ClientX.exe
File opened for modification	C:\Windows\system32\Windows\System.exe	ClientX.exe
File opened for modification	C:\Windows\system32\Windows	ClientX.exe
File opened for modification	C:\Windows\system32\Windows\System.exe	System.exe
File opened for modification	C:\Windows\system32\Windows	System.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3056	schtasks.exe
2788	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1672	ClientX.exe
Token: SeDebugPrivilege	2092	System.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2092	System.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3056	1672	ClientX.exe	30
PID 1672 wrote to memory of 3056	1672	ClientX.exe	30
PID 1672 wrote to memory of 3056	1672	ClientX.exe	30
PID 1672 wrote to memory of 2092	1672	ClientX.exe	32
PID 1672 wrote to memory of 2092	1672	ClientX.exe	32
PID 1672 wrote to memory of 2092	1672	ClientX.exe	32
PID 2092 wrote to memory of 2788	2092	System.exe	33
PID 2092 wrote to memory of 2788	2092	System.exe	33
PID 2092 wrote to memory of 2788	2092	System.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ClientX.exe
"C:\Users\Admin\AppData\Local\Temp\ClientX.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "WindowsData" /sc ONLOGON /tr "C:\Windows\system32\Windows\System.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3056
- C:\Windows\system32\Windows\System.exe
  "C:\Windows\system32\Windows\System.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "WindowsData" /sc ONLOGON /tr "C:\Windows\system32\Windows\System.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\Windows\System.exe

Filesize
3.4MB

MD5
12b286770578c1fa0d49fc78f5261bb3

SHA1
93c9e37bcbd6e3e20ed3615f5cd50c0366f4a2fe

SHA256
654ce4f50fe3eaa0d41122e8702818808f3b8e047ed603dd8b81ca656bd32066

SHA512
04fd977eab2fd6ca7cbd90944898e863d1d6a6257b0d55a6fcc267def8e9d62b131b5da69815f5886d0244ebe41189bf9632722b0ea0b3313e2e9a6528b5110d

Download Submit
memory/1672-0-0x000007FEF5FD3000-0x000007FEF5FD4000-memory.dmp

Filesize
4KB

Download
memory/1672-1-0x0000000001160000-0x00000000014C6000-memory.dmp

Filesize
3.4MB

Download
memory/1672-2-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download
memory/1672-8-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-9-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-10-0x0000000000F90000-0x00000000012F6000-memory.dmp

Filesize
3.4MB

Download
memory/2092-11-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-12-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads