quasar | 1a94dce8eb86e5a531a316491267bfba4dae6bab0e5a89b84f6ddcf8e0dd57c2

Resubmissions

05-02-2025 01:47

250205-b72apsvmaj 10

05-02-2025 01:46

250205-b689xstjct 10

Analysis

max time kernel
432s
max time network
435s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2025 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

waasdfasdfa-cleaned.exe
Size

9.6MB
MD5

f7dff4ea8253c72ac87edc0fb5bad744
SHA1

0ad62cbeb4bbfe55f598d8150eb47fe11c605d18
SHA256

1a94dce8eb86e5a531a316491267bfba4dae6bab0e5a89b84f6ddcf8e0dd57c2
SHA512

01aac77f314af5650a9c9e2c4dc6033e57c83eed73b1245ff807c8740cb5e4ecd247b82c0289d8d2371a3c4eaebfcfbcf20a97ee1305562caebb4e0fc1ab5701
SSDEEP

98304:pCjJmhnQCCHMFfrblOeAlKqTkNUv6mrV4/j0azLwlEwvJzWNCOhssO0y:fVgMFfrbli5lSmZ4b0az+RiZi

Score

10^/10

quasar seroxen v15.0 | fifa23 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

v15.0 | Fifa23

private123.duckdns.org:8808

dofucks.com:8808

Mutex

c398e98c-136e-4007-ab40-e179829f338c

Attributes

encryption_key
C84CB6134701741C5122A14FACDB67C8CFA9C0AB
install_name
.exe
log_directory
Logs
reconnect_delay
3000
startup_key
$sxr-seroxen

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4216-1-0x00000000004A0000-0x0000000000E4C000-memory.dmp	family_quasar
behavioral2/files/0x000b000000023b53-13.dat	family_quasar

Seroxen family
seroxen
Seroxen, Ser0xen
Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.
trojan seroxen

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4216 created 616	4216	waasdfasdfa-cleaned.exe	5

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4216 set thread context of 3408	4216	waasdfasdfa-cleaned.exe	85

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\$sxr-seroxen.bat	waasdfasdfa-cleaned.exe
File opened for modification	C:\Windows\$sxr-seroxen.bat	waasdfasdfa-cleaned.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4216	waasdfasdfa-cleaned.exe
4216	waasdfasdfa-cleaned.exe
3408	dllhost.exe
3408	dllhost.exe
3408	dllhost.exe
3408	dllhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	waasdfasdfa-cleaned.exe
Token: SeDebugPrivilege	4216	waasdfasdfa-cleaned.exe
Token: SeDebugPrivilege	3408	dllhost.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 3408	4216	waasdfasdfa-cleaned.exe	85
PID 4216 wrote to memory of 3408	4216	waasdfasdfa-cleaned.exe	85
PID 4216 wrote to memory of 3408	4216	waasdfasdfa-cleaned.exe	85
PID 4216 wrote to memory of 3408	4216	waasdfasdfa-cleaned.exe	85
PID 4216 wrote to memory of 3408	4216	waasdfasdfa-cleaned.exe	85
PID 4216 wrote to memory of 3408	4216	waasdfasdfa-cleaned.exe	85
PID 4216 wrote to memory of 3408	4216	waasdfasdfa-cleaned.exe	85
PID 4216 wrote to memory of 3408	4216	waasdfasdfa-cleaned.exe	85
PID 4216 wrote to memory of 3408	4216	waasdfasdfa-cleaned.exe	85
PID 4216 wrote to memory of 3408	4216	waasdfasdfa-cleaned.exe	85
PID 4216 wrote to memory of 3408	4216	waasdfasdfa-cleaned.exe	85
PID 4216 wrote to memory of 3408	4216	waasdfasdfa-cleaned.exe	85
PID 4216 wrote to memory of 3408	4216	waasdfasdfa-cleaned.exe	85
PID 4216 wrote to memory of 3408	4216	waasdfasdfa-cleaned.exe	85
PID 4216 wrote to memory of 3408	4216	waasdfasdfa-cleaned.exe	85
PID 4216 wrote to memory of 3908	4216	waasdfasdfa-cleaned.exe	86
PID 4216 wrote to memory of 3908	4216	waasdfasdfa-cleaned.exe	86

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{a7de66dd-b3ad-4331-9fd4-8a68bb83421e}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3408

C:\Users\Admin\AppData\Local\Temp\waasdfasdfa-cleaned.exe
"C:\Users\Admin\AppData\Local\Temp\waasdfasdfa-cleaned.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C cd C:\Windows\ & $sxr-seroxen.bat
  2⤵
  PID:3908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\$sxr-seroxen.bat

Filesize
9.6MB

MD5
f7dff4ea8253c72ac87edc0fb5bad744

SHA1
0ad62cbeb4bbfe55f598d8150eb47fe11c605d18

SHA256
1a94dce8eb86e5a531a316491267bfba4dae6bab0e5a89b84f6ddcf8e0dd57c2

SHA512
01aac77f314af5650a9c9e2c4dc6033e57c83eed73b1245ff807c8740cb5e4ecd247b82c0289d8d2371a3c4eaebfcfbcf20a97ee1305562caebb4e0fc1ab5701

Download Submit
memory/3408-10-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/3408-7-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/3408-9-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/3408-12-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/3408-14-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/4216-3-0x000000001C140000-0x000000001C266000-memory.dmp

Filesize
1.1MB

Download
memory/4216-4-0x00007FFB30550000-0x00007FFB30745000-memory.dmp

Filesize
2.0MB

Download
memory/4216-6-0x00007FFB120C0000-0x00007FFB12B81000-memory.dmp

Filesize
10.8MB

Download
memory/4216-1-0x00000000004A0000-0x0000000000E4C000-memory.dmp

Filesize
9.7MB

Download
memory/4216-0-0x00007FFB120C3000-0x00007FFB120C5000-memory.dmp

Filesize
8KB

Download
memory/4216-5-0x00007FFB301C0000-0x00007FFB3027E000-memory.dmp

Filesize
760KB

Download
memory/4216-15-0x00007FFB120C0000-0x00007FFB12B81000-memory.dmp

Filesize
10.8MB

Download