quasar | 6bf803ef550f4b654fe417656aa42d4a9bf467d96d99813deba7bd5bc6edb6f9

Analysis

max time kernel
94s
max time network
141s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250128-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
05-02-2025 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

waasdfasdfa-cleaned.exe
Size

9.6MB
MD5

7a08b3d3a74cd47bdcb3de677069cc0e
SHA1

303280734566b299afa135056cce5576b5c48310
SHA256

6bf803ef550f4b654fe417656aa42d4a9bf467d96d99813deba7bd5bc6edb6f9
SHA512

19f1ebddaebe51c5cb71be9e1e0dd3edd403e973bd2ad171f96fa3ab08bc555896ab115e29d7ad794a6606cd18401e1b9ccf9eb2475b80b1ebc82ae1aae2008d
SSDEEP

98304:5+rEWXvUvUlSJSbWlOeAlKqTkNUv6mrV4/j0azLwlEwvJzWNCOhssO00:2/xSJSbWli5lSmZ4b0az+RiZi

Score

10^/10

quasar seroxen v15.0 | fifa23 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

v15.0 | Fifa23

private123.duckdns.org:8808

dofucks.com:8808

Mutex

c398e98c-136e-4007-ab40-e179829f338c

Attributes

encryption_key
C84CB6134701741C5122A14FACDB67C8CFA9C0AB
install_name
.exe
log_directory
Logs
reconnect_delay
3000
startup_key
$sxr-seroxen

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/2256-1-0x00000000005B0000-0x0000000000F5C000-memory.dmp	family_quasar

Seroxen family
seroxen
Seroxen, Ser0xen
Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.
trojan seroxen

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2256 created 624	2256	waasdfasdfa-cleaned.exe	5

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2256 set thread context of 1536	2256	waasdfasdfa-cleaned.exe	84

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\$sxr-seroxen.bat	waasdfasdfa-cleaned.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2256	waasdfasdfa-cleaned.exe
2256	waasdfasdfa-cleaned.exe
1536	dllhost.exe
1536	dllhost.exe
1536	dllhost.exe
1536	dllhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2256	waasdfasdfa-cleaned.exe
Token: SeDebugPrivilege	2256	waasdfasdfa-cleaned.exe
Token: SeDebugPrivilege	1536	dllhost.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1536	2256	waasdfasdfa-cleaned.exe	84
PID 2256 wrote to memory of 1536	2256	waasdfasdfa-cleaned.exe	84
PID 2256 wrote to memory of 1536	2256	waasdfasdfa-cleaned.exe	84
PID 2256 wrote to memory of 1536	2256	waasdfasdfa-cleaned.exe	84
PID 2256 wrote to memory of 1536	2256	waasdfasdfa-cleaned.exe	84
PID 2256 wrote to memory of 1536	2256	waasdfasdfa-cleaned.exe	84
PID 2256 wrote to memory of 1536	2256	waasdfasdfa-cleaned.exe	84
PID 2256 wrote to memory of 1536	2256	waasdfasdfa-cleaned.exe	84
PID 2256 wrote to memory of 1536	2256	waasdfasdfa-cleaned.exe	84
PID 2256 wrote to memory of 1536	2256	waasdfasdfa-cleaned.exe	84
PID 2256 wrote to memory of 1536	2256	waasdfasdfa-cleaned.exe	84
PID 2256 wrote to memory of 1536	2256	waasdfasdfa-cleaned.exe	84
PID 2256 wrote to memory of 1536	2256	waasdfasdfa-cleaned.exe	84
PID 2256 wrote to memory of 1536	2256	waasdfasdfa-cleaned.exe	84
PID 2256 wrote to memory of 1536	2256	waasdfasdfa-cleaned.exe	84
PID 2256 wrote to memory of 1760	2256	waasdfasdfa-cleaned.exe	85
PID 2256 wrote to memory of 1760	2256	waasdfasdfa-cleaned.exe	85

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{41fd0abf-9215-4c4d-9e70-e53f98366fa7}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1536

C:\Users\Admin\AppData\Local\Temp\waasdfasdfa-cleaned.exe
"C:\Users\Admin\AppData\Local\Temp\waasdfasdfa-cleaned.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C cd C:\Windows\ & $sxr-seroxen.bat
  2⤵
  PID:1760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-6-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/1536-8-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/1536-10-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/1536-7-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/1536-12-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/2256-0-0x00007FF9B4B53000-0x00007FF9B4B55000-memory.dmp

Filesize
8KB

Download
memory/2256-1-0x00000000005B0000-0x0000000000F5C000-memory.dmp

Filesize
9.7MB

Download
memory/2256-3-0x000000001C0E0000-0x000000001C206000-memory.dmp

Filesize
1.1MB

Download
memory/2256-4-0x00007FF9D2EF0000-0x00007FF9D30E8000-memory.dmp

Filesize
2.0MB

Download
memory/2256-9-0x00007FF9B4B50000-0x00007FF9B5612000-memory.dmp

Filesize
10.8MB

Download
memory/2256-5-0x00007FF9D2C90000-0x00007FF9D2D4D000-memory.dmp

Filesize
756KB

Download
memory/2256-13-0x00007FF9B4B50000-0x00007FF9B5612000-memory.dmp

Filesize
10.8MB

Download