quasar | 874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5

General

Target

874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5.exe
Size

3.1MB
MD5

c965446805dc5c40e1bffe859716bea7
SHA1

7d6b257f8f830f512552bd11b36bb1fc88a1e966
SHA256

874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5
SHA512

157b7d59cb94d83dceba138207f1d335df6f9da90c510cbad8e0b252173be05679352de83d2aef2e3ae3d7de58f7253f93422b44680d2cb63e6c3640fd68233b
SSDEEP

49152:bv1I22SsaNYfdPBldt698dBcjHQFwGSBe1LoLdfTHHB72eh2NT:bve22SsaNYfdPBldt6+dBcjH5GD

Score

10^/10

quasar prudabackend spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

PrudaBackend

C2

45.131.108.110:4782

Mutex

8f8e6059-ac4f-4e47-8d62-3ce070083ecf

Attributes

encryption_key
D82EC4913FC5B28DDFF5AC48635D190A9342C6BD
install_name
update.exe
log_directory
Logs
reconnect_delay
2500
startup_key
Runtime Broker.exe

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4520-1-0x00000000005C0000-0x00000000008E4000-memory.dmp	family_quasar
behavioral2/files/0x0008000000023c90-7.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2204	update.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\update.exe	update.exe
File created	C:\Windows\system32\update.exe	874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5.exe
File opened for modification	C:\Windows\system32\update.exe	874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3500	schtasks.exe
2400	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4520	874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5.exe
Token: SeDebugPrivilege	2204	update.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2204	update.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 2400	4520	874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5.exe	82
PID 4520 wrote to memory of 2400	4520	874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5.exe	82
PID 4520 wrote to memory of 2204	4520	874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5.exe	84
PID 4520 wrote to memory of 2204	4520	874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5.exe	84
PID 2204 wrote to memory of 3500	2204	update.exe	85
PID 2204 wrote to memory of 3500	2204	update.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5.exe
"C:\Users\Admin\AppData\Local\Temp\874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Runtime Broker.exe" /sc ONLOGON /tr "C:\Windows\system32\update.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2400
- C:\Windows\system32\update.exe
  "C:\Windows\system32\update.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Runtime Broker.exe" /sc ONLOGON /tr "C:\Windows\system32\update.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\update.exe

Filesize
3.1MB

MD5
c965446805dc5c40e1bffe859716bea7

SHA1
7d6b257f8f830f512552bd11b36bb1fc88a1e966

SHA256
874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5

SHA512
157b7d59cb94d83dceba138207f1d335df6f9da90c510cbad8e0b252173be05679352de83d2aef2e3ae3d7de58f7253f93422b44680d2cb63e6c3640fd68233b

Download Submit
memory/2204-10-0x00007FF8CE2F0000-0x00007FF8CEDB1000-memory.dmp

Filesize
10.8MB

Download
memory/2204-11-0x00007FF8CE2F0000-0x00007FF8CEDB1000-memory.dmp

Filesize
10.8MB

Download
memory/2204-12-0x000000001BEA0000-0x000000001BEF0000-memory.dmp

Filesize
320KB

Download
memory/2204-13-0x000000001BFB0000-0x000000001C062000-memory.dmp

Filesize
712KB

Download
memory/2204-16-0x000000001BF30000-0x000000001BF42000-memory.dmp

Filesize
72KB

Download
memory/2204-17-0x000000001C7B0000-0x000000001C7EC000-memory.dmp

Filesize
240KB

Download
memory/2204-18-0x00007FF8CE2F0000-0x00007FF8CEDB1000-memory.dmp

Filesize
10.8MB

Download
memory/4520-0-0x00007FF8CE2F3000-0x00007FF8CE2F5000-memory.dmp

Filesize
8KB

Download
memory/4520-1-0x00000000005C0000-0x00000000008E4000-memory.dmp

Filesize
3.1MB

Download
memory/4520-2-0x00007FF8CE2F0000-0x00007FF8CEDB1000-memory.dmp

Filesize
10.8MB

Download
memory/4520-9-0x00007FF8CE2F0000-0x00007FF8CEDB1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads