quasar | 67e35ca53e1ee18113207c2edf4b165ae9158cfed151e08bac627327f9c60f21

General

Target

RedEngine.exe
Size

502KB
MD5

7178d81c9afdabb202f31315f7eed7e2
SHA1

527a063588b3e4d3acc04cf211d9b0df33f5ade2
SHA256

67e35ca53e1ee18113207c2edf4b165ae9158cfed151e08bac627327f9c60f21
SHA512

80b770bd2d3541400386c4aa446da8840823864a62d73554dd62ea08d5e9596f2b737fa8046eb6fb892690d115eb928022cdb1d24f4f8d9cf2e449adfd0809a5
SSDEEP

6144:9TEgdc0Y5XAGbgiIN2RSBTuYNzBlh/gKeFwQHocEhyb8F9ODx2cTR30:9TEgdfYVbg/uOiFwR12x2cd0

Score

10^/10

quasar training spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

TRAINING

C2

185.241.208.185:16145

Mutex

22073971-8d9a-4364-9916-abbb09ac9d8b

Attributes

encryption_key
7A9A8376440E3257DB2B54403642F366A5FBE14A
install_name
Starter Module.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Starter Module
subdirectory
Modules

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3796-1-0x0000000000BE0000-0x0000000000C64000-memory.dmp	family_quasar
behavioral2/files/0x000c000000023ca4-5.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
708	Starter Module.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Modules\Starter Module.exe	Starter Module.exe
File opened for modification	C:\Windows\system32\Modules	Starter Module.exe
File created	C:\Windows\system32\Modules\Starter Module.exe	RedEngine.exe
File opened for modification	C:\Windows\system32\Modules\Starter Module.exe	RedEngine.exe
File opened for modification	C:\Windows\system32\Modules	RedEngine.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4116	schtasks.exe
3136	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3796	RedEngine.exe
Token: SeDebugPrivilege	708	Starter Module.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
708	Starter Module.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
708	Starter Module.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
708	Starter Module.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 4116	3796	RedEngine.exe	87
PID 3796 wrote to memory of 4116	3796	RedEngine.exe	87
PID 3796 wrote to memory of 708	3796	RedEngine.exe	89
PID 3796 wrote to memory of 708	3796	RedEngine.exe	89
PID 708 wrote to memory of 3136	708	Starter Module.exe	90
PID 708 wrote to memory of 3136	708	Starter Module.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RedEngine.exe
"C:\Users\Admin\AppData\Local\Temp\RedEngine.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Starter Module" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\RedEngine.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4116
- C:\Windows\system32\Modules\Starter Module.exe
  "C:\Windows\system32\Modules\Starter Module.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Starter Module" /sc ONLOGON /tr "C:\Windows\system32\Modules\Starter Module.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\Modules\Starter Module.exe

Filesize
502KB

MD5
7178d81c9afdabb202f31315f7eed7e2

SHA1
527a063588b3e4d3acc04cf211d9b0df33f5ade2

SHA256
67e35ca53e1ee18113207c2edf4b165ae9158cfed151e08bac627327f9c60f21

SHA512
80b770bd2d3541400386c4aa446da8840823864a62d73554dd62ea08d5e9596f2b737fa8046eb6fb892690d115eb928022cdb1d24f4f8d9cf2e449adfd0809a5

Download Submit
memory/708-8-0x00007FFAC9B40000-0x00007FFACA601000-memory.dmp

Filesize
10.8MB

Download
memory/708-10-0x00007FFAC9B40000-0x00007FFACA601000-memory.dmp

Filesize
10.8MB

Download
memory/708-11-0x000000001C560000-0x000000001C5B0000-memory.dmp

Filesize
320KB

Download
memory/708-12-0x000000001C670000-0x000000001C722000-memory.dmp

Filesize
712KB

Download
memory/708-13-0x00007FFAC9B40000-0x00007FFACA601000-memory.dmp

Filesize
10.8MB

Download
memory/3796-0-0x00007FFAC9B43000-0x00007FFAC9B45000-memory.dmp

Filesize
8KB

Download
memory/3796-1-0x0000000000BE0000-0x0000000000C64000-memory.dmp

Filesize
528KB

Download
memory/3796-2-0x00007FFAC9B40000-0x00007FFACA601000-memory.dmp

Filesize
10.8MB

Download
memory/3796-9-0x00007FFAC9B40000-0x00007FFACA601000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads