quasar | d977d80c3735df4761faf5e37f8f4874b36d2c1d6aaa731f4e37b36c813e5754

General

Target
07d0c0de71b135af74f710585f13aa33.exe
Size 659KB
Sample210809-ld89gm3bc2
SHA256 d977d80c3735df4761faf5e37f8f4874b36d2c1d6aaa731f4e37b36c813e5754
MD5 07d0c0de71b135af74f710585f13aa33
SHA1 33c94cc78d9c48c04bda301c6d24069ddab11c63
SHA512 326fc2a1a015c9d45cb271d86d3d6e738c33f93ad38aa462aad9ea8d7de8a0a052fb53327fd8dd73013b51d079f1c9248930e07cdfb01b80eb3595372a6419b5
MD5 SHA1 SHA512

Score

10^/10

quasar office04w persistence spyware suricata trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04w

C2

societyf500.ddns.net:5490

Mutex

f4264bdc-b486-4a30-a042-2bcfb907b3c7

Attributes

encryption_key
0204DFA093E27B72F1617CCEA6076BCCE5D0A482
install_name
dwmq.exe
log_directory
Logs
reconnect_delay
3000
startup_key
dwmq
subdirectory
explorer

Signatures

Quasar Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1384-65-0x0000000000400000-0x0000000000484000-memory.dmp	family_quasar
behavioral1/memory/1384-66-0x000000000047E77E-mapping.dmp	family_quasar
behavioral1/memory/1384-67-0x0000000000400000-0x0000000000484000-memory.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
suricata

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\NVA = "\"C:\\Users\\Admin\\AppData\\Local\\NVA.exe\""	07d0c0de71b135af74f710585f13aa33.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 308 set thread context of 1384	308	07d0c0de71b135af74f710585f13aa33.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
308	07d0c0de71b135af74f710585f13aa33.exe
308	07d0c0de71b135af74f710585f13aa33.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	308	07d0c0de71b135af74f710585f13aa33.exe
Token: SeDebugPrivilege	1384	07d0c0de71b135af74f710585f13aa33.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 1384	308	07d0c0de71b135af74f710585f13aa33.exe	29
PID 308 wrote to memory of 1384	308	07d0c0de71b135af74f710585f13aa33.exe	29
PID 308 wrote to memory of 1384	308	07d0c0de71b135af74f710585f13aa33.exe	29
PID 308 wrote to memory of 1384	308	07d0c0de71b135af74f710585f13aa33.exe	29
PID 308 wrote to memory of 1384	308	07d0c0de71b135af74f710585f13aa33.exe	29
PID 308 wrote to memory of 1384	308	07d0c0de71b135af74f710585f13aa33.exe	29
PID 308 wrote to memory of 1384	308	07d0c0de71b135af74f710585f13aa33.exe	29
PID 308 wrote to memory of 1384	308	07d0c0de71b135af74f710585f13aa33.exe	29
PID 308 wrote to memory of 1384	308	07d0c0de71b135af74f710585f13aa33.exe	29

C:\Users\Admin\AppData\Local\Temp\07d0c0de71b135af74f710585f13aa33.exe
"C:\Users\Admin\AppData\Local\Temp\07d0c0de71b135af74f710585f13aa33.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:308
- C:\Users\Admin\AppData\Local\Temp\07d0c0de71b135af74f710585f13aa33.exe
  C:\Users\Admin\AppData\Local\Temp\07d0c0de71b135af74f710585f13aa33.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/308-60-0x00000000013E0000-0x00000000013E1000-memory.dmp

Download

memory/308-62-0x0000000004A50000-0x0000000004A51000-memory.dmp

Download

memory/308-63-0x0000000001010000-0x0000000001087000-memory.dmp

Download

memory/308-64-0x00000000010F0000-0x000000000115C000-memory.dmp

Download

memory/1384-65-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/1384-67-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/1384-69-0x0000000004B40000-0x0000000004B41000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads