quasar | da320fb9d212b7d38eb28a54e1283bb4e9546ee5009540f46aff61083fecbed0

Analysis

max time kernel
145s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-01-2025 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vers2.0.0-installx64.exe
Size

3.6MB
MD5

62af7389396c21b283d8655e7562d106
SHA1

c54841ab13b60aaf222b926f787c8669564a8090
SHA256

da320fb9d212b7d38eb28a54e1283bb4e9546ee5009540f46aff61083fecbed0
SHA512

9967b67006ba3a4ec6c13025b84ba42a112ccce4c38040f3849b001d39d27febf746f6e46e6a2673f3769fdbc4dff94f722fe5593e06d6ee82c176619b7e75c3
SSDEEP

98304:9EmUsgCgxpVbU/g6+WJdDldtYqdqbqjom6/JfS1:WVbU/gAhdtYqAgkJfS

Score

10^/10

quasar xworm chxmp discovery rat spyware trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:7000

Attributes

Install_directory
%LocalAppData%

Extracted

Family

quasar

Version

1.4.1

Botnet

CHXMP

8.8.8.8:4337

Mutex

d0ee0679-1d6f-403e-a05a-fa08da0e7baa

Attributes

encryption_key
3D2B9436E897CB92D0C2E82EF036B6F461BCAEC4
install_name
win10-updateKB087586-x64.exe
log_directory
Temp
reconnect_delay
3000
startup_key
Windows Update
subdirectory
wininst

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000186de-7.dat	family_xworm
behavioral1/memory/2776-25-0x0000000001030000-0x0000000001068000-memory.dmp	family_xworm

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 5 IoCs

resource	yara_rule
behavioral1/memory/2760-28-0x0000000000BB0000-0x0000000001258000-memory.dmp	family_quasar
behavioral1/memory/2760-29-0x0000000000BB0000-0x0000000001258000-memory.dmp	family_quasar
behavioral1/memory/2760-42-0x0000000000BB0000-0x0000000001258000-memory.dmp	family_quasar
behavioral1/memory/2668-45-0x0000000000980000-0x0000000001028000-memory.dmp	family_quasar
behavioral1/memory/2668-46-0x0000000000980000-0x0000000001028000-memory.dmp	family_quasar

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mdlu.pif	firefox.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mdlu.pif	firefox.exe

Executes dropped EXE 3 IoCs

pid	Process
2776	firefox.exe
2760	winlogon.exe
2668	win10-updateKB087586-x64.exe

Loads dropped DLL 7 IoCs

pid	Process
2748	vers2.0.0-installx64.exe
2748	vers2.0.0-installx64.exe
2760	winlogon.exe
2760	winlogon.exe
2760	winlogon.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
2748	vers2.0.0-installx64.exe
2760	winlogon.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\firefox.exe	vers2.0.0-installx64.exe
File opened for modification	C:\Program Files (x86)\winlogon.exe	vers2.0.0-installx64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vers2.0.0-installx64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win10-updateKB087586-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2140	schtasks.exe
2596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2776	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	firefox.exe
Token: SeDebugPrivilege	2760	winlogon.exe
Token: SeDebugPrivilege	2668	win10-updateKB087586-x64.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2748	vers2.0.0-installx64.exe
2748	vers2.0.0-installx64.exe
2760	winlogon.exe
2668	win10-updateKB087586-x64.exe
2668	win10-updateKB087586-x64.exe
2776	firefox.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2776	2748	vers2.0.0-installx64.exe	31
PID 2748 wrote to memory of 2776	2748	vers2.0.0-installx64.exe	31
PID 2748 wrote to memory of 2776	2748	vers2.0.0-installx64.exe	31
PID 2748 wrote to memory of 2776	2748	vers2.0.0-installx64.exe	31
PID 2748 wrote to memory of 2760	2748	vers2.0.0-installx64.exe	32
PID 2748 wrote to memory of 2760	2748	vers2.0.0-installx64.exe	32
PID 2748 wrote to memory of 2760	2748	vers2.0.0-installx64.exe	32
PID 2748 wrote to memory of 2760	2748	vers2.0.0-installx64.exe	32
PID 2748 wrote to memory of 2760	2748	vers2.0.0-installx64.exe	32
PID 2748 wrote to memory of 2760	2748	vers2.0.0-installx64.exe	32
PID 2748 wrote to memory of 2760	2748	vers2.0.0-installx64.exe	32
PID 2760 wrote to memory of 2596	2760	winlogon.exe	33
PID 2760 wrote to memory of 2596	2760	winlogon.exe	33
PID 2760 wrote to memory of 2596	2760	winlogon.exe	33
PID 2760 wrote to memory of 2596	2760	winlogon.exe	33
PID 2760 wrote to memory of 2596	2760	winlogon.exe	33
PID 2760 wrote to memory of 2596	2760	winlogon.exe	33
PID 2760 wrote to memory of 2596	2760	winlogon.exe	33
PID 2760 wrote to memory of 2668	2760	winlogon.exe	35
PID 2760 wrote to memory of 2668	2760	winlogon.exe	35
PID 2760 wrote to memory of 2668	2760	winlogon.exe	35
PID 2760 wrote to memory of 2668	2760	winlogon.exe	35
PID 2760 wrote to memory of 2668	2760	winlogon.exe	35
PID 2760 wrote to memory of 2668	2760	winlogon.exe	35
PID 2760 wrote to memory of 2668	2760	winlogon.exe	35
PID 2668 wrote to memory of 2140	2668	win10-updateKB087586-x64.exe	36
PID 2668 wrote to memory of 2140	2668	win10-updateKB087586-x64.exe	36
PID 2668 wrote to memory of 2140	2668	win10-updateKB087586-x64.exe	36
PID 2668 wrote to memory of 2140	2668	win10-updateKB087586-x64.exe	36
PID 2668 wrote to memory of 2140	2668	win10-updateKB087586-x64.exe	36
PID 2668 wrote to memory of 2140	2668	win10-updateKB087586-x64.exe	36
PID 2668 wrote to memory of 2140	2668	win10-updateKB087586-x64.exe	36

C:\Users\Admin\AppData\Local\Temp\vers2.0.0-installx64.exe
"C:\Users\Admin\AppData\Local\Temp\vers2.0.0-installx64.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\firefox.exe
  "C:\Program Files (x86)\firefox.exe" 0
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2776
- C:\Program Files (x86)\winlogon.exe
  "C:\Program Files (x86)\winlogon.exe" 0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\wininst\win10-updateKB087586-x64.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2596
- - C:\Users\Admin\AppData\Roaming\wininst\win10-updateKB087586-x64.exe
    "C:\Users\Admin\AppData\Roaming\wininst\win10-updateKB087586-x64.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\wininst\win10-updateKB087586-x64.exe" /rl HIGHEST /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\firefox.exe

Filesize
202KB

MD5
dda99892c0812b8c3560618c6c80306d

SHA1
4e758b0ac3b1a59ef7f2487c7bbb05ba06b8a079

SHA256
41f95b5d0b1e73157b0b61dc5e946a3e941554e45d7eaaabf96b88cf6634ba4e

SHA512
562f474c064227d39058b81b6f36c0d5682c8891c588c6b6dc388a53d3dca20e137ca7a666bcc80955088d91672c9defb77013b636d0cca56239216c113701ef

Download Submit
\Program Files (x86)\winlogon.exe

Filesize
2.3MB

MD5
626eac3eba8dc885b1c4fd56db614a6e

SHA1
ab181653bc3bad16d8cfd5a6d6837c4d6775c68f

SHA256
2a2272751fc1dfb43f20cf3bba8b4925e38c972573bb30afd8c77229e8d4bb76

SHA512
0eb8fa63aaa99d68fad28d7428f0741313d9496b9b4b99e183a726b596e9c5b1e9f3f594b8ff859975be255881ed63574b6a026500bfb746083949197b5d8747

Download Submit
memory/2668-53-0x0000000001710000-0x0000000001DB8000-memory.dmp

Filesize
6.7MB

Download
memory/2668-43-0x0000000001710000-0x0000000001DB8000-memory.dmp

Filesize
6.7MB

Download
memory/2668-40-0x0000000001710000-0x0000000001DB8000-memory.dmp

Filesize
6.7MB

Download
memory/2668-44-0x0000000000980000-0x0000000001028000-memory.dmp

Filesize
6.7MB

Download
memory/2668-45-0x0000000000980000-0x0000000001028000-memory.dmp

Filesize
6.7MB

Download
memory/2668-46-0x0000000000980000-0x0000000001028000-memory.dmp

Filesize
6.7MB

Download
memory/2668-55-0x0000000000980000-0x0000000001028000-memory.dmp

Filesize
6.7MB

Download
memory/2748-13-0x0000000001130000-0x0000000001714000-memory.dmp

Filesize
5.9MB

Download
memory/2748-52-0x0000000004BD0000-0x0000000005278000-memory.dmp

Filesize
6.7MB

Download
memory/2748-22-0x0000000000400000-0x00000000009E4000-memory.dmp

Filesize
5.9MB

Download
memory/2748-0-0x0000000000400000-0x00000000009E4000-memory.dmp

Filesize
5.9MB

Download
memory/2748-23-0x0000000004BD0000-0x0000000005278000-memory.dmp

Filesize
6.7MB

Download
memory/2748-6-0x0000000001130000-0x0000000001714000-memory.dmp

Filesize
5.9MB

Download
memory/2748-1-0x0000000001130000-0x0000000001714000-memory.dmp

Filesize
5.9MB

Download
memory/2760-28-0x0000000000BB0000-0x0000000001258000-memory.dmp

Filesize
6.7MB

Download
memory/2760-39-0x00000000062B0000-0x0000000006958000-memory.dmp

Filesize
6.7MB

Download
memory/2760-42-0x0000000000BB0000-0x0000000001258000-memory.dmp

Filesize
6.7MB

Download
memory/2760-29-0x0000000000BB0000-0x0000000001258000-memory.dmp

Filesize
6.7MB

Download
memory/2760-27-0x0000000000BB0000-0x0000000001258000-memory.dmp

Filesize
6.7MB

Download
memory/2760-26-0x0000000001260000-0x0000000001908000-memory.dmp

Filesize
6.7MB

Download
memory/2760-24-0x0000000001260000-0x0000000001908000-memory.dmp

Filesize
6.7MB

Download
memory/2776-25-0x0000000001030000-0x0000000001068000-memory.dmp

Filesize
224KB

Download