quasar | 718833d88ff6500a6dde11a5b3b1809a61c591823ae214a59d99450abfb006ce

General

Target

Client-built66.exe
Size

1.5MB
MD5

67d95d3eb21ca6d4e309d3e0c7b65595
SHA1

f60d16348059a74b03d368ef3df41a15c2c6cc01
SHA256

718833d88ff6500a6dde11a5b3b1809a61c591823ae214a59d99450abfb006ce
SHA512

004e8fa6499b640be4d6f69ebeb752d6dcaeececc4832a920fe6d2dec3988eee52350cb69b90a6d9fc458a38bb12fa96ff7457a6dbded25266545c3c2428706f
SSDEEP

24576:ffMnwA1Qg+S2HIPbcNE0KKzaOwIRxl2SLuLLusXbQ4q045nLjuodgD:HYrMEwKKzwipyX8WGLj9g

Score

10^/10

quasar spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/5792-1-0x000001C4A0880000-0x000001C4A0A0C000-memory.dmp	family_quasar
behavioral1/memory/5792-2-0x000001C4A25F0000-0x000001C4A260A000-memory.dmp	family_quasar
behavioral1/files/0x001900000002b043-9.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
3084	Clientsided.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir	Clientsided.exe
File created	C:\Windows\system32\SubDir\Clientsided.exe	Client-built66.exe
File opened for modification	C:\Windows\system32\SubDir\Clientsided.exe	Client-built66.exe
File opened for modification	C:\Windows\system32\SubDir	Client-built66.exe
File opened for modification	C:\Windows\system32\SubDir\Clientsided.exe	Clientsided.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5360	schtasks.exe
3224	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3084	Clientsided.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5792	Client-built66.exe
Token: SeDebugPrivilege	3084	Clientsided.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3084	Clientsided.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 5360	5792	Client-built66.exe	82
PID 5792 wrote to memory of 5360	5792	Client-built66.exe	82
PID 5792 wrote to memory of 3084	5792	Client-built66.exe	84
PID 5792 wrote to memory of 3084	5792	Client-built66.exe	84
PID 3084 wrote to memory of 3224	3084	Clientsided.exe	85
PID 3084 wrote to memory of 3224	3084	Clientsided.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built66.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built66.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "hack Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Clientsided.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5360
- C:\Windows\system32\SubDir\Clientsided.exe
  "C:\Windows\system32\SubDir\Clientsided.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "hack Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Clientsided.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\SubDir\Clientsided.exe

Filesize
1.5MB

MD5
67d95d3eb21ca6d4e309d3e0c7b65595

SHA1
f60d16348059a74b03d368ef3df41a15c2c6cc01

SHA256
718833d88ff6500a6dde11a5b3b1809a61c591823ae214a59d99450abfb006ce

SHA512
004e8fa6499b640be4d6f69ebeb752d6dcaeececc4832a920fe6d2dec3988eee52350cb69b90a6d9fc458a38bb12fa96ff7457a6dbded25266545c3c2428706f

Download Submit
memory/3084-14-0x000002EF77260000-0x000002EF772B0000-memory.dmp

Filesize
320KB

Download
memory/3084-11-0x00007FFB923B0000-0x00007FFB92E72000-memory.dmp

Filesize
10.8MB

Download
memory/3084-12-0x00007FFB923B0000-0x00007FFB92E72000-memory.dmp

Filesize
10.8MB

Download
memory/3084-13-0x000002EF766D0000-0x000002EF766E2000-memory.dmp

Filesize
72KB

Download
memory/3084-15-0x000002EF77370000-0x000002EF77422000-memory.dmp

Filesize
712KB

Download
memory/3084-16-0x000002EF76EF0000-0x000002EF76F3E000-memory.dmp

Filesize
312KB

Download
memory/3084-17-0x00007FFB923B0000-0x00007FFB92E72000-memory.dmp

Filesize
10.8MB

Download
memory/5792-2-0x000001C4A25F0000-0x000001C4A260A000-memory.dmp

Filesize
104KB

Download
memory/5792-3-0x00007FFB923B0000-0x00007FFB92E72000-memory.dmp

Filesize
10.8MB

Download
memory/5792-1-0x000001C4A0880000-0x000001C4A0A0C000-memory.dmp

Filesize
1.5MB

Download
memory/5792-10-0x00007FFB923B0000-0x00007FFB92E72000-memory.dmp

Filesize
10.8MB

Download
memory/5792-0-0x00007FFB923B3000-0x00007FFB923B5000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads