quasar | 7a09042fcabbf4eb8d290df23a00b023fa10aadf329d599d7ff6ed5034621535

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f459a784ada721c739fdd0ffd39f0725.exe
Size

13.3MB
MD5

f459a784ada721c739fdd0ffd39f0725
SHA1

8e9dad10f064f4d7e831176e9082c7fd2ff38c0b
SHA256

7a09042fcabbf4eb8d290df23a00b023fa10aadf329d599d7ff6ed5034621535
SHA512

b481c57a94c1cd0bc3a2edf1aa5b1c1075051231e76298f0f75469722bdd34d28afce9327242b10b133276d5b24858a7691418a42d5e807bc965710d2c820c5a
SSDEEP

49152:Kqsm55NYMPrb/T7vO90dL3BmAFd4A64nsfJlFngTR55I7NLz1:Kq95TUGP

Score

10^/10

quasar com surrogate discovery evasion spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

COM Surrogate

10.8.1.66:8869

Mutex

119b9028-5664-4725-b2c1-1e4eaf743d68

Attributes

encryption_key
B0092D1E1BA8BCBB825AA0760094E03D6D52E169
install_name
3388.exe
log_directory
COMLogs
reconnect_delay
5000
startup_key
COM Surrogate

Signatures

Contains code to disable Windows Defender 4 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/3240-41-0x0000000000320000-0x000000000032C000-memory.dmp	disable_win_def
behavioral2/files/0x0007000000023c7d-40.dat	disable_win_def
behavioral2/files/0x0007000000023c7e-53.dat	disable_win_def
behavioral2/memory/1888-55-0x0000000000270000-0x0000000000278000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	41pxujiu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	41pxujiu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	41pxujiu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	41pxujiu.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023c7c-31.dat	family_quasar
behavioral2/memory/2088-34-0x00000000008C0000-0x0000000000944000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	go-memexec-1888031034.exe

Executes dropped EXE 8 IoCs

pid	Process
2948	go-memexec-1888031034.exe
1252	DISCORD-BUILD.EXE
1456	JAVAFIX.EXE-BUILD.EXE
4052	WINDEFENDDISABLE.EXE-BUILD.EXE
2088	go-memexec-3166282027.exe
3240	go-memexec-2359588215.exe
2364	3388.exe
1888	41pxujiu.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	41pxujiu.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\3388.exe	3388.exe
File created	C:\Windows\system32\3388.exe	go-memexec-3166282027.exe
File opened for modification	C:\Windows\system32\3388.exe	go-memexec-3166282027.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	go-memexec-1888031034.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1628	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2168	schtasks.exe
1660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2088	go-memexec-3166282027.exe
Token: SeDebugPrivilege	3240	go-memexec-2359588215.exe
Token: SeDebugPrivilege	2364	3388.exe
Token: SeDebugPrivilege	1628	taskkill.exe
Token: SeDebugPrivilege	920	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3240	go-memexec-2359588215.exe
3240	go-memexec-2359588215.exe
2364	3388.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 2948	3976	JaffaCakes118_f459a784ada721c739fdd0ffd39f0725.exe	86
PID 3976 wrote to memory of 2948	3976	JaffaCakes118_f459a784ada721c739fdd0ffd39f0725.exe	86
PID 3976 wrote to memory of 2948	3976	JaffaCakes118_f459a784ada721c739fdd0ffd39f0725.exe	86
PID 2948 wrote to memory of 1252	2948	go-memexec-1888031034.exe	87
PID 2948 wrote to memory of 1252	2948	go-memexec-1888031034.exe	87
PID 2948 wrote to memory of 1456	2948	go-memexec-1888031034.exe	89
PID 2948 wrote to memory of 1456	2948	go-memexec-1888031034.exe	89
PID 2948 wrote to memory of 4052	2948	go-memexec-1888031034.exe	90
PID 2948 wrote to memory of 4052	2948	go-memexec-1888031034.exe	90
PID 1456 wrote to memory of 2088	1456	JAVAFIX.EXE-BUILD.EXE	93
PID 1456 wrote to memory of 2088	1456	JAVAFIX.EXE-BUILD.EXE	93
PID 4052 wrote to memory of 3240	4052	WINDEFENDDISABLE.EXE-BUILD.EXE	94
PID 4052 wrote to memory of 3240	4052	WINDEFENDDISABLE.EXE-BUILD.EXE	94
PID 3240 wrote to memory of 4724	3240	go-memexec-2359588215.exe	95
PID 3240 wrote to memory of 4724	3240	go-memexec-2359588215.exe	95
PID 2088 wrote to memory of 2168	2088	go-memexec-3166282027.exe	97
PID 2088 wrote to memory of 2168	2088	go-memexec-3166282027.exe	97
PID 2088 wrote to memory of 2364	2088	go-memexec-3166282027.exe	99
PID 2088 wrote to memory of 2364	2088	go-memexec-3166282027.exe	99
PID 4484 wrote to memory of 1888	4484	cmd.exe	102
PID 4484 wrote to memory of 1888	4484	cmd.exe	102
PID 1888 wrote to memory of 920	1888	41pxujiu.exe	103
PID 1888 wrote to memory of 920	1888	41pxujiu.exe	103
PID 2364 wrote to memory of 1660	2364	3388.exe	108
PID 2364 wrote to memory of 1660	2364	3388.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f459a784ada721c739fdd0ffd39f0725.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f459a784ada721c739fdd0ffd39f0725.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Users\Admin\AppData\Local\Temp\go-memexec-1888031034.exe
  C:\Users\Admin\AppData\Local\Temp\go-memexec-1888031034.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Users\Admin\AppData\Local\Temp\DISCORD-BUILD.EXE
    "C:\Users\Admin\AppData\Local\Temp\DISCORD-BUILD.EXE"
    3⤵
    - Executes dropped EXE
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\JAVAFIX.EXE-BUILD.EXE
    "C:\Users\Admin\AppData\Local\Temp\JAVAFIX.EXE-BUILD.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\go-memexec-3166282027.exe
      C:\Users\Admin\AppData\Local\Temp\go-memexec-3166282027.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2088
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "COM Surrogate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\go-memexec-3166282027.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2168
    - - C:\Windows\system32\3388.exe
        
        "C:\Windows\system32\3388.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2364
      - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "COM Surrogate" /sc ONLOGON /tr "C:\Windows\system32\3388.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1660
- - C:\Users\Admin\AppData\Local\Temp\WINDEFENDDISABLE.EXE-BUILD.EXE
    "C:\Users\Admin\AppData\Local\Temp\WINDEFENDDISABLE.EXE-BUILD.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\go-memexec-2359588215.exe
      C:\Users\Admin\AppData\Local\Temp\go-memexec-2359588215.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3240
    - - \??\c:\windows\system32\cmstp.exe
        
        "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\p0haduwl.inf
        5⤵
        
        PID:4724

C:\Windows\system32\cmd.exe
cmd /c start C:\Windows\temp\41pxujiu.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\temp\41pxujiu.exe
  C:\Windows\temp\41pxujiu.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:920

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DISCORD-BUILD.EXE

Filesize
1.6MB

MD5
f50a77623d245a4599777ab4fbf714c6

SHA1
ef50b96df7cd351b62bdca83b7244e550d4a2e89

SHA256
0f68faff74b9185ca8c48dd2aa5bfdf0ee5dcf0c7a0282e964b4d29d807143cf

SHA512
1b8c09465a6cb42a5b121187edbb1082edcd8f5983d61cb243514ef8da4f90a64f7d0d6f9a08b346a869a065f981ab469cc6f97c6edffd5be79f281b180094b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\JAVAFIX.EXE-BUILD.EXE

Filesize
2.6MB

MD5
6f5376f20c7f474f5554222d01456849

SHA1
4931b9dc0767c76dc31e3e6c4423a961c0f51d86

SHA256
bdbc5164ef806974456f579200541d7c84f643377c86b0bc3c1081ddd1317146

SHA512
3c0510afbd1b076889491f7e177e03cd7e73b1debd1c416765bf18890e916a504376af7b04923ee233d78e08124f0d89fc60ca4dcc256ca44adffa87b83a59e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\WINDEFENDDISABLE.EXE-BUILD.EXE

Filesize
1.6MB

MD5
9af255f8c616c0cce55ba6ebed9575cd

SHA1
06e0a3e0183c0dada31c3e7f2195f2156f98f336

SHA256
83a53512f6ed96e88941330b73ceffed794603da3204d169eb44826b0a03985f

SHA512
05e0c2d059de60ff0186b372198148f3980738e71328366b585045477ef9e3f62ad230fbcbee3c4aac9113f178d77cf2745c0a17205867a12e6dda5766bf14f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ugviswll.k3o.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\go-memexec-1888031034.exe

Filesize
5.8MB

MD5
456fda268601e84c3308378d26dc74d2

SHA1
a27d3718b6338927e98a38219862f5859528d5fb

SHA256
b9a1d3ee098339ac5942b437f76cb25bf5f33dacb65a883162a447c158702cfb

SHA512
a70ab8ffa8f429aa9e98eb181d405ad01333258b4646d67ec3b9743267e56de11cac9eff2a41611e7a3e269f8577a8db6217341f1ca68bdaedafbdd0e7699434

Download Submit
C:\Users\Admin\AppData\Local\Temp\go-memexec-2359588215.exe

Filesize
19KB

MD5
c6e7fd0dc447c35e6e31aad46e83de96

SHA1
5367e124d66f45babf625b56418155ea5a04ccd3

SHA256
60a855b888b3021d74803be43ae95ec62ec509ed3d70dd734295d12d9375a0a1

SHA512
6c7a43aa7dd335e388db6cb651ab1bfd4e3d3abb82b31dce2900178af27616e330e84d8e5d89a3435eb8939cfed0a23892f3aeac219c883f4e53a51932d61746

Download Submit
C:\Users\Admin\AppData\Local\Temp\go-memexec-3166282027.exe

Filesize
502KB

MD5
e49e8745bb3748c02b6991155ef988f9

SHA1
13ce804a8d4dd951b5535ceb819be3f04372f375

SHA256
9e105120064cd753917b8f60a20dedc1d5c33156189afdcc514189b07d23587e

SHA512
f7b514a905ba52970f5c17bd91e12a07ebd3e3715d3b5c59284c8f09ea7e4da317fd3968a46b164e520757de9567bd0ef36f0b0bed79e7aacd412032322a416d

Download Submit
C:\Windows\Temp\41pxujiu.exe

Filesize
12KB

MD5
9cfc5141261e2144858e32a779e4e87f

SHA1
5698cb6c917d92a40d44f6e096acbf90be3a86c5

SHA256
e117d0ef5ed73d676fb845556b2ca33fe68c1728069ad1df39429b2ad5feaa15

SHA512
340af9ef8bad9678ef458e2e57aa79d5038fe1805e8a7a67e5a839efd89f6aa414d0022d233d624317eff1ca225f1b7a3b8637f0555511fddc588a9aeab34003

Download Submit
C:\Windows\temp\p0haduwl.inf

Filesize
606B

MD5
fbe9d14768ca64c59d7eec402871a12b

SHA1
e982ee004aea305dcf8a204a88190b76f270591f

SHA256
98913e54c41256e9c7fcee352f90637bcb4ab716e6240f4074caf54535539434

SHA512
b4e4cb1c24ebbf38ed5bf281c96f9314c2d2dd80aac7ab32937e551a740df071bdbcc3858f95c442d039e9a708f76917bb686b3c89c369e4f1d505eae79d9046

Download Submit
memory/920-65-0x0000013EF8AC0000-0x0000013EF8AE2000-memory.dmp

Filesize
136KB

Download
memory/1888-55-0x0000000000270000-0x0000000000278000-memory.dmp

Filesize
32KB

Download
memory/2088-36-0x00007FFA07DA0000-0x00007FFA08861000-memory.dmp

Filesize
10.8MB

Download
memory/2088-50-0x00007FFA07DA0000-0x00007FFA08861000-memory.dmp

Filesize
10.8MB

Download
memory/2088-34-0x00000000008C0000-0x0000000000944000-memory.dmp

Filesize
528KB

Download
memory/2088-33-0x00007FFA07DA3000-0x00007FFA07DA5000-memory.dmp

Filesize
8KB

Download
memory/2364-70-0x0000000002DA0000-0x0000000002DF0000-memory.dmp

Filesize
320KB

Download
memory/2364-71-0x000000001C0D0000-0x000000001C182000-memory.dmp

Filesize
712KB

Download
memory/3240-41-0x0000000000320000-0x000000000032C000-memory.dmp

Filesize
48KB

Download