quasar | 1a94dce8eb86e5a531a316491267bfba4dae6bab0e5a89b84f6ddcf8e0dd57c2

Resubmissions

05-02-2025 01:47

250205-b72apsvmaj 10

05-02-2025 01:46

250205-b689xstjct 10

Analysis

max time kernel
95s
max time network
140s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250128-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
05-02-2025 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

waasdfasdfa-cleaned.exe
Size

9.6MB
MD5

f7dff4ea8253c72ac87edc0fb5bad744
SHA1

0ad62cbeb4bbfe55f598d8150eb47fe11c605d18
SHA256

1a94dce8eb86e5a531a316491267bfba4dae6bab0e5a89b84f6ddcf8e0dd57c2
SHA512

01aac77f314af5650a9c9e2c4dc6033e57c83eed73b1245ff807c8740cb5e4ecd247b82c0289d8d2371a3c4eaebfcfbcf20a97ee1305562caebb4e0fc1ab5701
SSDEEP

98304:pCjJmhnQCCHMFfrblOeAlKqTkNUv6mrV4/j0azLwlEwvJzWNCOhssO0y:fVgMFfrbli5lSmZ4b0az+RiZi

Score

10^/10

quasar seroxen v15.0 | fifa23 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

v15.0 | Fifa23

private123.duckdns.org:8808

dofucks.com:8808

Mutex

c398e98c-136e-4007-ab40-e179829f338c

Attributes

encryption_key
C84CB6134701741C5122A14FACDB67C8CFA9C0AB
install_name
.exe
log_directory
Logs
reconnect_delay
3000
startup_key
$sxr-seroxen

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/2508-1-0x0000000000D80000-0x000000000172C000-memory.dmp	family_quasar

Seroxen family
seroxen
Seroxen, Ser0xen
Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.
trojan seroxen

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2508 created 640	2508	waasdfasdfa-cleaned.exe	5

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2508 set thread context of 1860	2508	waasdfasdfa-cleaned.exe	81

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\$sxr-seroxen.bat	waasdfasdfa-cleaned.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2508	waasdfasdfa-cleaned.exe
2508	waasdfasdfa-cleaned.exe
1860	dllhost.exe
1860	dllhost.exe
1860	dllhost.exe
1860	dllhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	waasdfasdfa-cleaned.exe
Token: SeDebugPrivilege	2508	waasdfasdfa-cleaned.exe
Token: SeDebugPrivilege	1860	dllhost.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1860	2508	waasdfasdfa-cleaned.exe	81
PID 2508 wrote to memory of 1860	2508	waasdfasdfa-cleaned.exe	81
PID 2508 wrote to memory of 1860	2508	waasdfasdfa-cleaned.exe	81
PID 2508 wrote to memory of 1860	2508	waasdfasdfa-cleaned.exe	81
PID 2508 wrote to memory of 1860	2508	waasdfasdfa-cleaned.exe	81
PID 2508 wrote to memory of 1860	2508	waasdfasdfa-cleaned.exe	81
PID 2508 wrote to memory of 1860	2508	waasdfasdfa-cleaned.exe	81
PID 2508 wrote to memory of 1860	2508	waasdfasdfa-cleaned.exe	81
PID 2508 wrote to memory of 1860	2508	waasdfasdfa-cleaned.exe	81
PID 2508 wrote to memory of 1860	2508	waasdfasdfa-cleaned.exe	81
PID 2508 wrote to memory of 1860	2508	waasdfasdfa-cleaned.exe	81
PID 2508 wrote to memory of 1860	2508	waasdfasdfa-cleaned.exe	81
PID 2508 wrote to memory of 1860	2508	waasdfasdfa-cleaned.exe	81
PID 2508 wrote to memory of 1860	2508	waasdfasdfa-cleaned.exe	81
PID 2508 wrote to memory of 1860	2508	waasdfasdfa-cleaned.exe	81
PID 2508 wrote to memory of 1744	2508	waasdfasdfa-cleaned.exe	82
PID 2508 wrote to memory of 1744	2508	waasdfasdfa-cleaned.exe	82

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{3e13f124-453f-4b1a-8a8f-4b2d5fbcdaba}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1860

C:\Users\Admin\AppData\Local\Temp\waasdfasdfa-cleaned.exe
"C:\Users\Admin\AppData\Local\Temp\waasdfasdfa-cleaned.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C cd C:\Windows\ & $sxr-seroxen.bat
  2⤵
  PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-7-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/1860-8-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/1860-11-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/1860-9-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/1860-13-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/2508-0-0x00007FFB17883000-0x00007FFB17885000-memory.dmp

Filesize
8KB

Download
memory/2508-1-0x0000000000D80000-0x000000000172C000-memory.dmp

Filesize
9.7MB

Download
memory/2508-3-0x000000001C940000-0x000000001CA66000-memory.dmp

Filesize
1.1MB

Download
memory/2508-5-0x00007FFB33F00000-0x00007FFB33FBD000-memory.dmp

Filesize
756KB

Download
memory/2508-4-0x00007FFB35BF0000-0x00007FFB35DE8000-memory.dmp

Filesize
2.0MB

Download
memory/2508-6-0x00007FFB17880000-0x00007FFB18342000-memory.dmp

Filesize
10.8MB

Download
memory/2508-12-0x00007FFB17880000-0x00007FFB18342000-memory.dmp

Filesize
10.8MB

Download