quasar | 19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010

General

Target

19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010.exe
Size

3.1MB
MD5

c4f9f10a96ad4665cd156ce3d1a9e29c
SHA1

10f32538070d3f615e1f2298f94f0250d846c8ed
SHA256

19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010
SHA512

fc7277bb2c633c985c8d48c2d3b6936ec62b1c18daa6dd9043c817586eb531aa7116f28c998997b0a14db387dabe22e812957b33ddbed41732ce33afd8c07482
SSDEEP

49152:vvyt62XlaSFNWPjljiFa2RoUYIlxPEakWk/LCcoGdIS/THHB72eh2NT:vva62XlaSFNWPjljiFXRoUYIlxS5Y

Score

10^/10

quasar minecrafter spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

minecrafter

C2

87.228.57.81:4782

Mutex

cf3988ab-2fd9-4544-a16f-9faa71eb5bac

Attributes

encryption_key
19A0FAF8459F69650B5965C225752D425C429EEC
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svchoost.exe
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/2276-1-0x0000000000370000-0x0000000000694000-memory.dmp	family_quasar
behavioral1/files/0x00080000000174cc-6.dat	family_quasar
behavioral1/memory/2828-9-0x0000000001120000-0x0000000001444000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2828	Client.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2572	schtasks.exe
2704	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010.exe
Token: SeDebugPrivilege	2828	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2828	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2704	2276	19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010.exe	30
PID 2276 wrote to memory of 2704	2276	19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010.exe	30
PID 2276 wrote to memory of 2704	2276	19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010.exe	30
PID 2276 wrote to memory of 2828	2276	19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010.exe	32
PID 2276 wrote to memory of 2828	2276	19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010.exe	32
PID 2276 wrote to memory of 2828	2276	19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010.exe	32
PID 2828 wrote to memory of 2572	2828	Client.exe	33
PID 2828 wrote to memory of 2572	2828	Client.exe	33
PID 2828 wrote to memory of 2572	2828	Client.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010.exe
"C:\Users\Admin\AppData\Local\Temp\19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "svchoost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2704
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "svchoost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.1MB

MD5
c4f9f10a96ad4665cd156ce3d1a9e29c

SHA1
10f32538070d3f615e1f2298f94f0250d846c8ed

SHA256
19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010

SHA512
fc7277bb2c633c985c8d48c2d3b6936ec62b1c18daa6dd9043c817586eb531aa7116f28c998997b0a14db387dabe22e812957b33ddbed41732ce33afd8c07482

Download Submit
memory/2276-0-0x000007FEF4F63000-0x000007FEF4F64000-memory.dmp

Filesize
4KB

Download
memory/2276-1-0x0000000000370000-0x0000000000694000-memory.dmp

Filesize
3.1MB

Download
memory/2276-2-0x000007FEF4F60000-0x000007FEF594C000-memory.dmp

Filesize
9.9MB

Download
memory/2276-8-0x000007FEF4F60000-0x000007FEF594C000-memory.dmp

Filesize
9.9MB

Download
memory/2828-9-0x0000000001120000-0x0000000001444000-memory.dmp

Filesize
3.1MB

Download
memory/2828-11-0x000007FEF4F60000-0x000007FEF594C000-memory.dmp

Filesize
9.9MB

Download
memory/2828-10-0x000007FEF4F60000-0x000007FEF594C000-memory.dmp

Filesize
9.9MB

Download
memory/2828-12-0x000007FEF4F60000-0x000007FEF594C000-memory.dmp

Filesize
9.9MB

Download
memory/2828-13-0x000007FEF4F60000-0x000007FEF594C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads