quasar | a792be03af23fe52b708d22df6cadeb3374bb5500416a862eee57ea56db20fd5

Resubmissions

23/07/2021, 10:14

210723-tke37qc4wx10

24/06/2021, 13:06

210624-tmff1at66610

Analysis

max time kernel
150s
max time network
192s
platform
windows7_x64
resource
win7v20210410
submitted
24/06/2021, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
439e49a4df2f4bcc359283d02f612e98.exe
Size 527KB
Sample210624-tmff1at666
SHA256 a792be03af23fe52b708d22df6cadeb3374bb5500416a862eee57ea56db20fd5
MD5 439e49a4df2f4bcc359283d02f612e98
SHA1 bf6e8632bedeb80e72f664e2d4ca8b260a77115d
SHA512 4d1fd328d45b67ce5a8acb91fe25cbc6e4b6bc252ef95e94cb43ae3264f83f77d0e66cff16fbe8b40a2ac063c8b95758dd6969001a1d56a7e4f96ca3a786c992
MD5 SHA1 SHA512

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

45.77.20.114:1604

Mutex

39083318-6c39-4d8c-beda-fd48beb29cc9

Attributes

encryption_key
7E1D5BE8A11725FE11CAC5785F9684E24960D4AC
install_name
Media.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Media
subdirectory
SubDir

Signatures

Quasar Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00040000000130e2-64.dat	family_quasar
behavioral1/files/0x00040000000130e2-65.dat	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Executes dropped EXE 1 IoCs

pid	Process
296	Media.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1700	schtasks.exe
868	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	439e49a4df2f4bcc359283d02f612e98.exe
Token: SeDebugPrivilege	296	Media.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
296	Media.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1700	1932	439e49a4df2f4bcc359283d02f612e98.exe	29
PID 1932 wrote to memory of 1700	1932	439e49a4df2f4bcc359283d02f612e98.exe	29
PID 1932 wrote to memory of 1700	1932	439e49a4df2f4bcc359283d02f612e98.exe	29
PID 1932 wrote to memory of 296	1932	439e49a4df2f4bcc359283d02f612e98.exe	31
PID 1932 wrote to memory of 296	1932	439e49a4df2f4bcc359283d02f612e98.exe	31
PID 1932 wrote to memory of 296	1932	439e49a4df2f4bcc359283d02f612e98.exe	31
PID 296 wrote to memory of 868	296	Media.exe	32
PID 296 wrote to memory of 868	296	Media.exe	32
PID 296 wrote to memory of 868	296	Media.exe	32

C:\Users\Admin\AppData\Local\Temp\439e49a4df2f4bcc359283d02f612e98.exe
"C:\Users\Admin\AppData\Local\Temp\439e49a4df2f4bcc359283d02f612e98.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Media" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\439e49a4df2f4bcc359283d02f612e98.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1700
- C:\Users\Admin\AppData\Roaming\SubDir\Media.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Media.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:296
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Media" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Media.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/296-66-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/296-68-0x000000001B140000-0x000000001B142000-memory.dmp

Download

memory/1932-59-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Download

memory/1932-61-0x000000001ACA0000-0x000000001ACA2000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads