quasar | f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe
Size

3.2MB
MD5

e9ed2adca7e63a58d0895179fc1e121f
SHA1

ae23767acd8d4a88b7c69d84e4df5f9733653662
SHA256

f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7
SHA512

7fc5de0e2d85c85592ff935faa5ffa10e33615c8b2d274d28c322764706c2847ee40a9f15c3867cf278981fe2ac3778cbb9b3bd400f6c4064691f9c7c9ff51b0
SSDEEP

98304:visDo5sRzG+RVgbtHSB2MqlcY+kd4204+N1o:6uRq+8btHSdA/N

Score

10^/10

quasar stereo spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Stereo

nickhill112-30910.portmap.host:30910

Mutex

c93b672f-8b8c-48b8-a712-e952d64b741a

Attributes

encryption_key
985DB7D034DB1B5D52F524873569DDDE4080F31C
install_name
Stereo.exe
log_directory
Logs
reconnect_delay
3000
startup_key
update.exe
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/3588-45-0x0000000000400000-0x0000000000726000-memory.dmp family_quasar

resource	yara_rule
behavioral2/memory/3588-45-0x0000000000400000-0x0000000000726000-memory.dmp	family_quasar

Detects .NET executables utilizing NyanX-CAT C# Loader 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4052-1-0x0000000000D30000-0x0000000001066000-memory.dmp	INDICATOR_EXE_Packed_NyanXCat_CSharpLoader
behavioral2/memory/3152-13-0x0000000000400000-0x000000000072C000-memory.dmp	INDICATOR_EXE_Packed_NyanXCat_CSharpLoader

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/3588-45-0x0000000000400000-0x0000000000726000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/3588-45-0x0000000000400000-0x0000000000726000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers
Detects executables containing common artifacts observed in infostealers 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/3588-45-0x0000000000400000-0x0000000000726000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer
Executes dropped EXE 1 IoCs

Processes:

Stereo.exe

pid process

2688 Stereo.exe

resource	yara_rule
behavioral2/memory/3588-45-0x0000000000400000-0x0000000000726000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

resource	yara_rule
behavioral2/memory/3588-45-0x0000000000400000-0x0000000000726000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

resource	yara_rule
behavioral2/memory/3588-45-0x0000000000400000-0x0000000000726000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer

pid	process
2688	Stereo.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exeRegSvcs.exe

description	pid	process	target process
PID 4052 set thread context of 3152	4052	f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe	RegSvcs.exe
PID 3152 set thread context of 3588	3152	RegSvcs.exe	RegAsm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3612 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exeRegSvcs.exe

pid process

432 powershell.exe
432 powershell.exe
3152 RegSvcs.exe
3152 RegSvcs.exe
3152 RegSvcs.exe
3152 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeRegSvcs.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 432 powershell.exe
Token: SeDebugPrivilege 3152 RegSvcs.exe
Token: SeDebugPrivilege 3588 RegAsm.exe

pid	process
3612	schtasks.exe

pid	process
432	powershell.exe
432	powershell.exe
3152	RegSvcs.exe
3152	RegSvcs.exe
3152	RegSvcs.exe
3152	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	432	powershell.exe
Token: SeDebugPrivilege	3152	RegSvcs.exe
Token: SeDebugPrivilege	3588	RegAsm.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exeRegSvcs.exeRegAsm.exe

description	pid	process	target process
PID 4052 wrote to memory of 432	4052	f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe	powershell.exe
PID 4052 wrote to memory of 432	4052	f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe	powershell.exe
PID 4052 wrote to memory of 432	4052	f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe	powershell.exe
PID 4052 wrote to memory of 3152	4052	f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe	RegSvcs.exe
PID 4052 wrote to memory of 3152	4052	f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe	RegSvcs.exe
PID 4052 wrote to memory of 3152	4052	f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe	RegSvcs.exe
PID 4052 wrote to memory of 3152	4052	f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe	RegSvcs.exe
PID 4052 wrote to memory of 3152	4052	f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe	RegSvcs.exe
PID 4052 wrote to memory of 3152	4052	f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe	RegSvcs.exe
PID 4052 wrote to memory of 3152	4052	f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe	RegSvcs.exe
PID 4052 wrote to memory of 3152	4052	f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe	RegSvcs.exe
PID 3152 wrote to memory of 1960	3152	RegSvcs.exe	RegAsm.exe
PID 3152 wrote to memory of 1960	3152	RegSvcs.exe	RegAsm.exe
PID 3152 wrote to memory of 1960	3152	RegSvcs.exe	RegAsm.exe
PID 3152 wrote to memory of 1804	3152	RegSvcs.exe	RegAsm.exe
PID 3152 wrote to memory of 1804	3152	RegSvcs.exe	RegAsm.exe
PID 3152 wrote to memory of 1804	3152	RegSvcs.exe	RegAsm.exe
PID 3152 wrote to memory of 3588	3152	RegSvcs.exe	RegAsm.exe
PID 3152 wrote to memory of 3588	3152	RegSvcs.exe	RegAsm.exe
PID 3152 wrote to memory of 3588	3152	RegSvcs.exe	RegAsm.exe
PID 3152 wrote to memory of 3588	3152	RegSvcs.exe	RegAsm.exe
PID 3152 wrote to memory of 3588	3152	RegSvcs.exe	RegAsm.exe
PID 3152 wrote to memory of 3588	3152	RegSvcs.exe	RegAsm.exe
PID 3152 wrote to memory of 3588	3152	RegSvcs.exe	RegAsm.exe
PID 3152 wrote to memory of 3588	3152	RegSvcs.exe	RegAsm.exe
PID 3588 wrote to memory of 3612	3588	RegAsm.exe	schtasks.exe
PID 3588 wrote to memory of 3612	3588	RegAsm.exe	schtasks.exe
PID 3588 wrote to memory of 3612	3588	RegAsm.exe	schtasks.exe
PID 3588 wrote to memory of 2688	3588	RegAsm.exe	Stereo.exe
PID 3588 wrote to memory of 2688	3588	RegAsm.exe	Stereo.exe
PID 3588 wrote to memory of 2688	3588	RegAsm.exe	Stereo.exe

C:\Users\Admin\AppData\Local\Temp\f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe
"C:\Users\Admin\AppData\Local\Temp\f8fb11582d89eceb099be971266172a0bc9033d350d5343f09436063adfb3ad7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4052

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '' -Value '"C:\Users\Admin\AppData\Roaming\.exe"' -PropertyType 'String'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1960

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3588

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "update.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Stereo.exe" /rl HIGHEST /f
4⤵
- Scheduled Task/Job: Scheduled Task
PID:3612

C:\Users\Admin\AppData\Roaming\SubDir\Stereo.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Stereo.exe"
4⤵
- Executes dropped EXE
PID:2688

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s1tcl3o5.mgz.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Stereo.exe
Filesize
63KB

MD5
0d5df43af2916f47d00c1573797c1a13

SHA1
230ab5559e806574d26b4c20847c368ed55483b0

SHA256
c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

SHA512
f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

Download Submit
memory/432-39-0x00000000067E0000-0x0000000006802000-memory.dmp

Filesize
136KB

Download
memory/432-24-0x0000000005450000-0x00000000054B6000-memory.dmp

Filesize
408KB

Download
memory/432-20-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/432-23-0x00000000053E0000-0x0000000005446000-memory.dmp

Filesize
408KB

Download
memory/432-30-0x0000000005B80000-0x0000000005ED4000-memory.dmp

Filesize
3.3MB

Download
memory/432-22-0x0000000005340000-0x0000000005362000-memory.dmp

Filesize
136KB

Download
memory/432-36-0x00000000066F0000-0x000000000673C000-memory.dmp

Filesize
304KB

Download
memory/432-42-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/432-38-0x0000000006790000-0x00000000067AA000-memory.dmp

Filesize
104KB

Download
memory/432-12-0x00000000029B0000-0x00000000029E6000-memory.dmp

Filesize
216KB

Download
memory/432-37-0x00000000074E0000-0x0000000007576000-memory.dmp

Filesize
600KB

Download
memory/432-14-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/432-16-0x00000000054D0000-0x0000000005AF8000-memory.dmp

Filesize
6.2MB

Download
memory/432-35-0x00000000062D0000-0x00000000062EE000-memory.dmp

Filesize
120KB

Download
memory/432-17-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/2688-54-0x0000000000190000-0x00000000001A2000-memory.dmp

Filesize
72KB

Download
memory/3152-18-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/3152-13-0x0000000000400000-0x000000000072C000-memory.dmp

Filesize
3.2MB

Download
memory/3152-43-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/3152-44-0x00000000060C0000-0x00000000063EA000-memory.dmp

Filesize
3.2MB

Download
memory/3152-47-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/3152-21-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/3588-45-0x0000000000400000-0x0000000000726000-memory.dmp

Filesize
3.1MB

Download
memory/4052-5-0x0000000005B10000-0x0000000005B1A000-memory.dmp

Filesize
40KB

Download
memory/4052-2-0x00000000060E0000-0x0000000006684000-memory.dmp

Filesize
5.6MB

Download
memory/4052-0-0x000000007478E000-0x000000007478F000-memory.dmp

Filesize
4KB

Download
memory/4052-7-0x000000007478E000-0x000000007478F000-memory.dmp

Filesize
4KB

Download
memory/4052-3-0x0000000005A50000-0x0000000005AE2000-memory.dmp

Filesize
584KB

Download
memory/4052-19-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/4052-10-0x0000000006090000-0x00000000060AE000-memory.dmp

Filesize
120KB

Download
memory/4052-9-0x0000000005D40000-0x000000000606E000-memory.dmp

Filesize
3.2MB

Download
memory/4052-8-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/4052-6-0x0000000005CC0000-0x0000000005D36000-memory.dmp

Filesize
472KB

Download
memory/4052-4-0x0000000074780000-0x0000000074F30000-memory.dmp

Filesize
7.7MB

Download
memory/4052-1-0x0000000000D30000-0x0000000001066000-memory.dmp

Filesize
3.2MB

Download