quasar | b9e40ddacf304c8bca72e85f6874c5c0a6faf805546fddbf715be13d83075b05

General

Target

Client-built.exe
Size

3.1MB
MD5

7a02a595b7bd1078ffc896e35cb32a01
SHA1

4196a3ad1b599fba5fe93283dae0de4fe04cb5b7
SHA256

b9e40ddacf304c8bca72e85f6874c5c0a6faf805546fddbf715be13d83075b05
SHA512

05155aab2585b35793d5fc1fd2beda2457ed70f7fc37551ff6dddb222005ca08c4008a3f352cf6cb85658eca8e510d50af07e3eaee1b8da37ccd15eb45c42eb1
SSDEEP

49152:uv8hBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkas+YNjhtooGdoTHHB72eh2NT:uv2t2d5aKCuVPzlEmVQ0wvwfs+Yy

Score

10^/10

quasar microsoft support spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Microsoft Support

C2

147.185.221.25:57276

172.20.10.2:57276

Mutex

a4de83b9-ee43-4481-a07e-43005040ecb1

Attributes

encryption_key
208881ED62CAC7B5AB660B49C4B307B67863D844
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft Support
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/1768-1-0x0000000001060000-0x0000000001384000-memory.dmp	family_quasar
behavioral1/files/0x00060000000186c6-6.dat	family_quasar
behavioral1/memory/2724-9-0x0000000001110000-0x0000000001434000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2724	Client.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File created	C:\Windows\system32\SubDir\Client.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client-built.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2884	schtasks.exe
2748	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	Client-built.exe
Token: SeDebugPrivilege	2724	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2724	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2884	1768	Client-built.exe	30
PID 1768 wrote to memory of 2884	1768	Client-built.exe	30
PID 1768 wrote to memory of 2884	1768	Client-built.exe	30
PID 1768 wrote to memory of 2724	1768	Client-built.exe	32
PID 1768 wrote to memory of 2724	1768	Client-built.exe	32
PID 1768 wrote to memory of 2724	1768	Client-built.exe	32
PID 2724 wrote to memory of 2748	2724	Client.exe	33
PID 2724 wrote to memory of 2748	2724	Client.exe	33
PID 2724 wrote to memory of 2748	2724	Client.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Microsoft Support" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2884
- C:\Windows\system32\SubDir\Client.exe
  "C:\Windows\system32\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Microsoft Support" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\SubDir\Client.exe

Filesize
3.1MB

MD5
7a02a595b7bd1078ffc896e35cb32a01

SHA1
4196a3ad1b599fba5fe93283dae0de4fe04cb5b7

SHA256
b9e40ddacf304c8bca72e85f6874c5c0a6faf805546fddbf715be13d83075b05

SHA512
05155aab2585b35793d5fc1fd2beda2457ed70f7fc37551ff6dddb222005ca08c4008a3f352cf6cb85658eca8e510d50af07e3eaee1b8da37ccd15eb45c42eb1

Download Submit
memory/1768-0-0x000007FEF5F73000-0x000007FEF5F74000-memory.dmp

Filesize
4KB

Download
memory/1768-1-0x0000000001060000-0x0000000001384000-memory.dmp

Filesize
3.1MB

Download
memory/1768-2-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/1768-8-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/2724-10-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/2724-9-0x0000000001110000-0x0000000001434000-memory.dmp

Filesize
3.1MB

Download
memory/2724-11-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/2724-12-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads