quasar | fec56ffb3c5a61bffba235044da127eae17d9772dbd3817b8a5ce8cad0e93cb1

General

Target

office82.exe
Size

348KB
MD5

ee6b41b84b38df2ca1ababd9d3d8f4a0
SHA1

2df1f670d50cb1736a3623dd04973de093e2d512
SHA256

fec56ffb3c5a61bffba235044da127eae17d9772dbd3817b8a5ce8cad0e93cb1
SHA512

38435c3105967b41159542530c7043254a7752b9dd578fc89fb6f61075feed7a4dae26fac20ffb916ad6dbca9809a5fe873fa0858c137bc92c6adf9f87261291

Score

10^/10

quasar spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

984 Client.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ip-api.com
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2712 schtasks.exe
904 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

office82.exeClient.exe

description pid process

Token: SeDebugPrivilege 4704 office82.exe
Token: SeDebugPrivilege 984 Client.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

984 Client.exe

pid	process
984	Client.exe

flow	ioc
14	ip-api.com

pid	process
2712	schtasks.exe
904	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	4704	office82.exe
Token: SeDebugPrivilege	984	Client.exe

pid	process
984	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

office82.exeClient.exe

description	pid	process	target process
PID 4704 wrote to memory of 2712	4704	office82.exe	schtasks.exe
PID 4704 wrote to memory of 2712	4704	office82.exe	schtasks.exe
PID 4704 wrote to memory of 2712	4704	office82.exe	schtasks.exe
PID 4704 wrote to memory of 984	4704	office82.exe	Client.exe
PID 4704 wrote to memory of 984	4704	office82.exe	Client.exe
PID 4704 wrote to memory of 984	4704	office82.exe	Client.exe
PID 984 wrote to memory of 904	984	Client.exe	schtasks.exe
PID 984 wrote to memory of 904	984	Client.exe	schtasks.exe
PID 984 wrote to memory of 904	984	Client.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\office82.exe
"C:\Users\Admin\AppData\Local\Temp\office82.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "msoffice2" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\office82.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2712

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "msoffice2" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
MD5
ee6b41b84b38df2ca1ababd9d3d8f4a0

SHA1
2df1f670d50cb1736a3623dd04973de093e2d512

SHA256
fec56ffb3c5a61bffba235044da127eae17d9772dbd3817b8a5ce8cad0e93cb1

SHA512
38435c3105967b41159542530c7043254a7752b9dd578fc89fb6f61075feed7a4dae26fac20ffb916ad6dbca9809a5fe873fa0858c137bc92c6adf9f87261291

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
MD5
ee6b41b84b38df2ca1ababd9d3d8f4a0

SHA1
2df1f670d50cb1736a3623dd04973de093e2d512

SHA256
fec56ffb3c5a61bffba235044da127eae17d9772dbd3817b8a5ce8cad0e93cb1

SHA512
38435c3105967b41159542530c7043254a7752b9dd578fc89fb6f61075feed7a4dae26fac20ffb916ad6dbca9809a5fe873fa0858c137bc92c6adf9f87261291

Download Submit
memory/904-20-0x0000000000000000-mapping.dmp

Download
memory/984-21-0x0000000005F10000-0x0000000005F11000-memory.dmp

Filesize
4KB

Download
memory/984-12-0x0000000074040000-0x000000007472E000-memory.dmp

Filesize
6.9MB

Download
memory/984-9-0x0000000000000000-mapping.dmp

Download
memory/2712-8-0x0000000000000000-mapping.dmp

Download
memory/4704-4-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/4704-7-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

Filesize
4KB

Download
memory/4704-6-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/4704-5-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/4704-0-0x0000000074040000-0x000000007472E000-memory.dmp

Filesize
6.9MB

Download
memory/4704-3-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/4704-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads