quasar | da320fb9d212b7d38eb28a54e1283bb4e9546ee5009540f46aff61083fecbed0

General

Target

vers2.0.0-installx64.exe
Size

3.6MB
MD5

62af7389396c21b283d8655e7562d106
SHA1

c54841ab13b60aaf222b926f787c8669564a8090
SHA256

da320fb9d212b7d38eb28a54e1283bb4e9546ee5009540f46aff61083fecbed0
SHA512

9967b67006ba3a4ec6c13025b84ba42a112ccce4c38040f3849b001d39d27febf746f6e46e6a2673f3769fdbc4dff94f722fe5593e06d6ee82c176619b7e75c3
SSDEEP

98304:9EmUsgCgxpVbU/g6+WJdDldtYqdqbqjom6/JfS1:WVbU/gAhdtYqAgkJfS

Score

10^/10

quasar xworm chxmp discovery rat spyware trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:7000

Attributes

Install_directory
%LocalAppData%

Extracted

Family

quasar

Version

1.4.1

Botnet

CHXMP

C2

8.8.8.8:4337

Mutex

d0ee0679-1d6f-403e-a05a-fa08da0e7baa

Attributes

encryption_key
3D2B9436E897CB92D0C2E82EF036B6F461BCAEC4
install_name
win10-updateKB087586-x64.exe
log_directory
Temp
reconnect_delay
3000
startup_key
Windows Update
subdirectory
wininst

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023c14-9.dat	family_xworm
behavioral2/memory/2964-27-0x00000000005E0000-0x0000000000618000-memory.dmp	family_xworm

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 5 IoCs

resource	yara_rule
behavioral2/memory/1060-34-0x0000000000A00000-0x00000000010A8000-memory.dmp	family_quasar
behavioral2/memory/1060-35-0x0000000000A00000-0x00000000010A8000-memory.dmp	family_quasar
behavioral2/memory/1060-47-0x0000000000A00000-0x00000000010A8000-memory.dmp	family_quasar
behavioral2/memory/3608-49-0x00000000006A0000-0x0000000000D48000-memory.dmp	family_quasar
behavioral2/memory/3608-48-0x00000000006A0000-0x0000000000D48000-memory.dmp	family_quasar

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	vers2.0.0-installx64.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mdlu.pif	firefox.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mdlu.pif	firefox.exe

Executes dropped EXE 3 IoCs

pid	Process
2964	firefox.exe
1060	winlogon.exe
3608	win10-updateKB087586-x64.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs

pid	Process
2348	vers2.0.0-installx64.exe
1060	winlogon.exe
1060	winlogon.exe
3608	win10-updateKB087586-x64.exe
3608	win10-updateKB087586-x64.exe
3608	win10-updateKB087586-x64.exe
3608	win10-updateKB087586-x64.exe
3608	win10-updateKB087586-x64.exe
3608	win10-updateKB087586-x64.exe
3608	win10-updateKB087586-x64.exe
3608	win10-updateKB087586-x64.exe
3608	win10-updateKB087586-x64.exe
3608	win10-updateKB087586-x64.exe
3608	win10-updateKB087586-x64.exe
3608	win10-updateKB087586-x64.exe
3608	win10-updateKB087586-x64.exe
3608	win10-updateKB087586-x64.exe
3608	win10-updateKB087586-x64.exe
3608	win10-updateKB087586-x64.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\firefox.exe	vers2.0.0-installx64.exe
File opened for modification	C:\Program Files (x86)\winlogon.exe	vers2.0.0-installx64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vers2.0.0-installx64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win10-updateKB087586-x64.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3164	schtasks.exe
1044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2964	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	firefox.exe
Token: SeDebugPrivilege	1060	winlogon.exe
Token: SeDebugPrivilege	3608	win10-updateKB087586-x64.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	vers2.0.0-installx64.exe
2348	vers2.0.0-installx64.exe
1060	winlogon.exe
3608	win10-updateKB087586-x64.exe
2964	firefox.exe
3608	win10-updateKB087586-x64.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2964	2348	vers2.0.0-installx64.exe	83
PID 2348 wrote to memory of 2964	2348	vers2.0.0-installx64.exe	83
PID 2348 wrote to memory of 1060	2348	vers2.0.0-installx64.exe	84
PID 2348 wrote to memory of 1060	2348	vers2.0.0-installx64.exe	84
PID 2348 wrote to memory of 1060	2348	vers2.0.0-installx64.exe	84
PID 1060 wrote to memory of 3164	1060	winlogon.exe	85
PID 1060 wrote to memory of 3164	1060	winlogon.exe	85
PID 1060 wrote to memory of 3164	1060	winlogon.exe	85
PID 1060 wrote to memory of 3608	1060	winlogon.exe	87
PID 1060 wrote to memory of 3608	1060	winlogon.exe	87
PID 1060 wrote to memory of 3608	1060	winlogon.exe	87
PID 3608 wrote to memory of 1044	3608	win10-updateKB087586-x64.exe	88
PID 3608 wrote to memory of 1044	3608	win10-updateKB087586-x64.exe	88
PID 3608 wrote to memory of 1044	3608	win10-updateKB087586-x64.exe	88

C:\Users\Admin\AppData\Local\Temp\vers2.0.0-installx64.exe
"C:\Users\Admin\AppData\Local\Temp\vers2.0.0-installx64.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\firefox.exe
  "C:\Program Files (x86)\firefox.exe" 0
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2964
- C:\Program Files (x86)\winlogon.exe
  "C:\Program Files (x86)\winlogon.exe" 0
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\wininst\win10-updateKB087586-x64.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3164
- - C:\Users\Admin\AppData\Roaming\wininst\win10-updateKB087586-x64.exe
    "C:\Users\Admin\AppData\Roaming\wininst\win10-updateKB087586-x64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\wininst\win10-updateKB087586-x64.exe" /rl HIGHEST /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\firefox.exe

Filesize
202KB

MD5
dda99892c0812b8c3560618c6c80306d

SHA1
4e758b0ac3b1a59ef7f2487c7bbb05ba06b8a079

SHA256
41f95b5d0b1e73157b0b61dc5e946a3e941554e45d7eaaabf96b88cf6634ba4e

SHA512
562f474c064227d39058b81b6f36c0d5682c8891c588c6b6dc388a53d3dca20e137ca7a666bcc80955088d91672c9defb77013b636d0cca56239216c113701ef

Download Submit
C:\Program Files (x86)\winlogon.exe

Filesize
2.3MB

MD5
626eac3eba8dc885b1c4fd56db614a6e

SHA1
ab181653bc3bad16d8cfd5a6d6837c4d6775c68f

SHA256
2a2272751fc1dfb43f20cf3bba8b4925e38c972573bb30afd8c77229e8d4bb76

SHA512
0eb8fa63aaa99d68fad28d7428f0741313d9496b9b4b99e183a726b596e9c5b1e9f3f594b8ff859975be255881ed63574b6a026500bfb746083949197b5d8747

Download Submit
memory/1060-32-0x0000000077E52000-0x0000000077E53000-memory.dmp

Filesize
4KB

Download
memory/1060-47-0x0000000000A00000-0x00000000010A8000-memory.dmp

Filesize
6.7MB

Download
memory/1060-30-0x0000000000A00000-0x00000000010A8000-memory.dmp

Filesize
6.7MB

Download
memory/1060-33-0x0000000077E53000-0x0000000077E54000-memory.dmp

Filesize
4KB

Download
memory/1060-38-0x0000000005EA0000-0x0000000005EAA000-memory.dmp

Filesize
40KB

Download
memory/1060-34-0x0000000000A00000-0x00000000010A8000-memory.dmp

Filesize
6.7MB

Download
memory/1060-35-0x0000000000A00000-0x00000000010A8000-memory.dmp

Filesize
6.7MB

Download
memory/1060-36-0x0000000006380000-0x0000000006924000-memory.dmp

Filesize
5.6MB

Download
memory/1060-37-0x0000000005F00000-0x0000000005F92000-memory.dmp

Filesize
584KB

Download
memory/2348-1-0x0000000077E52000-0x0000000077E53000-memory.dmp

Filesize
4KB

Download
memory/2348-2-0x0000000077E53000-0x0000000077E54000-memory.dmp

Filesize
4KB

Download
memory/2348-0-0x0000000000400000-0x00000000009E4000-memory.dmp

Filesize
5.9MB

Download
memory/2348-31-0x0000000000400000-0x00000000009E4000-memory.dmp

Filesize
5.9MB

Download
memory/2964-27-0x00000000005E0000-0x0000000000618000-memory.dmp

Filesize
224KB

Download
memory/2964-24-0x00007FFF30AC3000-0x00007FFF30AC5000-memory.dmp

Filesize
8KB

Download
memory/2964-59-0x0000000000DC0000-0x0000000000DD0000-memory.dmp

Filesize
64KB

Download
memory/2964-62-0x0000000000DC0000-0x0000000000DD0000-memory.dmp

Filesize
64KB

Download
memory/3608-44-0x00000000006A0000-0x0000000000D48000-memory.dmp

Filesize
6.7MB

Download
memory/3608-49-0x00000000006A0000-0x0000000000D48000-memory.dmp

Filesize
6.7MB

Download
memory/3608-48-0x00000000006A0000-0x0000000000D48000-memory.dmp

Filesize
6.7MB

Download
memory/3608-50-0x00000000073A0000-0x00000000079B8000-memory.dmp

Filesize
6.1MB

Download
memory/3608-51-0x0000000006F10000-0x0000000006F60000-memory.dmp

Filesize
320KB

Download
memory/3608-52-0x0000000007180000-0x0000000007232000-memory.dmp

Filesize
712KB

Download
memory/3608-60-0x00000000006A0000-0x0000000000D48000-memory.dmp

Filesize
6.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads