quasar | 1a94dce8eb86e5a531a316491267bfba4dae6bab0e5a89b84f6ddcf8e0dd57c2

Resubmissions

05/02/2025, 01:47

250205-b72apsvmaj 10

05/02/2025, 01:46

250205-b689xstjct 10

Analysis

max time kernel
838s
max time network
839s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05/02/2025, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

waasdfasdfa-cleaned.exe
Size

9.6MB
MD5

f7dff4ea8253c72ac87edc0fb5bad744
SHA1

0ad62cbeb4bbfe55f598d8150eb47fe11c605d18
SHA256

1a94dce8eb86e5a531a316491267bfba4dae6bab0e5a89b84f6ddcf8e0dd57c2
SHA512

01aac77f314af5650a9c9e2c4dc6033e57c83eed73b1245ff807c8740cb5e4ecd247b82c0289d8d2371a3c4eaebfcfbcf20a97ee1305562caebb4e0fc1ab5701
SSDEEP

98304:pCjJmhnQCCHMFfrblOeAlKqTkNUv6mrV4/j0azLwlEwvJzWNCOhssO0y:fVgMFfrbli5lSmZ4b0az+RiZi

Score

10^/10

quasar seroxen v15.0 | fifa23 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

v15.0 | Fifa23

private123.duckdns.org:8808

dofucks.com:8808

Mutex

c398e98c-136e-4007-ab40-e179829f338c

Attributes

encryption_key
C84CB6134701741C5122A14FACDB67C8CFA9C0AB
install_name
.exe
log_directory
Logs
reconnect_delay
3000
startup_key
$sxr-seroxen

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/1012-1-0x00000000009A0000-0x000000000134C000-memory.dmp	family_quasar
behavioral1/files/0x00070000000186d9-12.dat	family_quasar

Seroxen family
seroxen
Seroxen, Ser0xen
Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.
trojan seroxen

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1012 created 432	1012	waasdfasdfa-cleaned.exe	5

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1012 set thread context of 2884	1012	waasdfasdfa-cleaned.exe	30

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\$sxr-seroxen.bat	waasdfasdfa-cleaned.exe
File created	C:\Windows\$sxr-seroxen.bat	waasdfasdfa-cleaned.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1012	waasdfasdfa-cleaned.exe
1012	waasdfasdfa-cleaned.exe
2884	dllhost.exe
2884	dllhost.exe
2884	dllhost.exe
2884	dllhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1012	waasdfasdfa-cleaned.exe
Token: SeDebugPrivilege	1012	waasdfasdfa-cleaned.exe
Token: SeDebugPrivilege	2884	dllhost.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 2884	1012	waasdfasdfa-cleaned.exe	30
PID 1012 wrote to memory of 3012	1012	waasdfasdfa-cleaned.exe	31
PID 1012 wrote to memory of 3012	1012	waasdfasdfa-cleaned.exe	31
PID 1012 wrote to memory of 3012	1012	waasdfasdfa-cleaned.exe	31

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{05f7fdf1-5667-4410-aaef-98e6ee2d3bc8}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884

C:\Users\Admin\AppData\Local\Temp\waasdfasdfa-cleaned.exe
"C:\Users\Admin\AppData\Local\Temp\waasdfasdfa-cleaned.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C cd C:\Windows\ & $sxr-seroxen.bat
  2⤵
  PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\$sxr-seroxen.bat

Filesize
9.6MB

MD5
f7dff4ea8253c72ac87edc0fb5bad744

SHA1
0ad62cbeb4bbfe55f598d8150eb47fe11c605d18

SHA256
1a94dce8eb86e5a531a316491267bfba4dae6bab0e5a89b84f6ddcf8e0dd57c2

SHA512
01aac77f314af5650a9c9e2c4dc6033e57c83eed73b1245ff807c8740cb5e4ecd247b82c0289d8d2371a3c4eaebfcfbcf20a97ee1305562caebb4e0fc1ab5701

Download Submit
memory/1012-1-0x00000000009A0000-0x000000000134C000-memory.dmp

Filesize
9.7MB

Download
memory/1012-3-0x000007FEF6BF0000-0x000007FEF75DC000-memory.dmp

Filesize
9.9MB

Download
memory/1012-4-0x000000001B1E0000-0x000000001B306000-memory.dmp

Filesize
1.1MB

Download
memory/1012-6-0x0000000077A70000-0x0000000077B8F000-memory.dmp

Filesize
1.1MB

Download
memory/1012-5-0x0000000077B90000-0x0000000077D39000-memory.dmp

Filesize
1.7MB

Download
memory/1012-0-0x000007FEF6BF3000-0x000007FEF6BF4000-memory.dmp

Filesize
4KB

Download
memory/1012-11-0x000007FEF6BF0000-0x000007FEF75DC000-memory.dmp

Filesize
9.9MB

Download
memory/1012-13-0x000007FEF6BF0000-0x000007FEF75DC000-memory.dmp

Filesize
9.9MB

Download
memory/1012-9-0x0000000077A71000-0x0000000077B0C000-memory.dmp

Filesize
620KB

Download
memory/2884-7-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/2884-15-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/2884-14-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/2884-16-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download