quasar | fec56ffb3c5a61bffba235044da127eae17d9772dbd3817b8a5ce8cad0e93cb1

General

Target

office82.exe
Size

348KB
MD5

ee6b41b84b38df2ca1ababd9d3d8f4a0
SHA1

2df1f670d50cb1736a3623dd04973de093e2d512
SHA256

fec56ffb3c5a61bffba235044da127eae17d9772dbd3817b8a5ce8cad0e93cb1
SHA512

38435c3105967b41159542530c7043254a7752b9dd578fc89fb6f61075feed7a4dae26fac20ffb916ad6dbca9809a5fe873fa0858c137bc92c6adf9f87261291

Score

10^/10

quasar spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

1748 Client.exe
Loads dropped DLL 1 IoCs

Processes:

office82.exe

pid process

1056 office82.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip-api.com
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1676 schtasks.exe
600 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

office82.exeClient.exe

description pid process

Token: SeDebugPrivilege 1056 office82.exe
Token: SeDebugPrivilege 1748 Client.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

1748 Client.exe

pid	process
1748	Client.exe

pid	process
1056	office82.exe

flow	ioc
3	ip-api.com

pid	process
1676	schtasks.exe
600	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1056	office82.exe
Token: SeDebugPrivilege	1748	Client.exe

pid	process
1748	Client.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

office82.exeClient.exe

description	pid	process	target process
PID 1056 wrote to memory of 1676	1056	office82.exe	schtasks.exe
PID 1056 wrote to memory of 1676	1056	office82.exe	schtasks.exe
PID 1056 wrote to memory of 1676	1056	office82.exe	schtasks.exe
PID 1056 wrote to memory of 1676	1056	office82.exe	schtasks.exe
PID 1056 wrote to memory of 1748	1056	office82.exe	Client.exe
PID 1056 wrote to memory of 1748	1056	office82.exe	Client.exe
PID 1056 wrote to memory of 1748	1056	office82.exe	Client.exe
PID 1056 wrote to memory of 1748	1056	office82.exe	Client.exe
PID 1748 wrote to memory of 600	1748	Client.exe	schtasks.exe
PID 1748 wrote to memory of 600	1748	Client.exe	schtasks.exe
PID 1748 wrote to memory of 600	1748	Client.exe	schtasks.exe
PID 1748 wrote to memory of 600	1748	Client.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\office82.exe
"C:\Users\Admin\AppData\Local\Temp\office82.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "msoffice2" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\office82.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1676

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "msoffice2" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:600

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
MD5
ee6b41b84b38df2ca1ababd9d3d8f4a0

SHA1
2df1f670d50cb1736a3623dd04973de093e2d512

SHA256
fec56ffb3c5a61bffba235044da127eae17d9772dbd3817b8a5ce8cad0e93cb1

SHA512
38435c3105967b41159542530c7043254a7752b9dd578fc89fb6f61075feed7a4dae26fac20ffb916ad6dbca9809a5fe873fa0858c137bc92c6adf9f87261291

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
MD5
ee6b41b84b38df2ca1ababd9d3d8f4a0

SHA1
2df1f670d50cb1736a3623dd04973de093e2d512

SHA256
fec56ffb3c5a61bffba235044da127eae17d9772dbd3817b8a5ce8cad0e93cb1

SHA512
38435c3105967b41159542530c7043254a7752b9dd578fc89fb6f61075feed7a4dae26fac20ffb916ad6dbca9809a5fe873fa0858c137bc92c6adf9f87261291

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Client.exe
MD5
ee6b41b84b38df2ca1ababd9d3d8f4a0

SHA1
2df1f670d50cb1736a3623dd04973de093e2d512

SHA256
fec56ffb3c5a61bffba235044da127eae17d9772dbd3817b8a5ce8cad0e93cb1

SHA512
38435c3105967b41159542530c7043254a7752b9dd578fc89fb6f61075feed7a4dae26fac20ffb916ad6dbca9809a5fe873fa0858c137bc92c6adf9f87261291

Download Submit
memory/600-11-0x0000000000000000-mapping.dmp

Download
memory/1056-0-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/1056-1-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1676-3-0x0000000000000000-mapping.dmp

Download
memory/1748-5-0x0000000000000000-mapping.dmp

Download
memory/1748-8-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/1748-9-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads