quasar | 00e3eebe4bbea52843a8d335bdf5e4b5d6c8de8079f8d86a345cceb2375ccb25

General

Target

26aba4e9a028a23c065ce9611c164288.exe
Size

2.8MB
MD5

26aba4e9a028a23c065ce9611c164288
SHA1

58bc1e70429c58615863e1704d3a6b575fab767f
SHA256

00e3eebe4bbea52843a8d335bdf5e4b5d6c8de8079f8d86a345cceb2375ccb25
SHA512

0db32f58a5d54d04bd3ca60111b3963a50741893a16325a2f3bbeba237fc280fa6f3c63d054d5b9cef0443e8e5ed1de38e4a459c3e7f0c3be4d0a054e08b5095
SSDEEP

49152:ZfjG7SXx1c7V1tgRk5ysKxqEDtIupA7f/za32ehyfT36Dq2w:ZfSSB1c7V1yypKxq1ubw

Score

10^/10

quasar office04 persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

39.107.242.96:47820

Mutex

fda87a73-83f3-4200-85c4-d2289eb5f51f

Attributes

encryption_key
38F957A7714EBE6FC27E56C6EAB8BADC987F5E2B
install_name
Windows Search.exe
log_directory
Logs
reconnect_delay
3000
startup_key
WindowsSearchPrograms
subdirectory
WindowsSearch

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral2/memory/1104-132-0x0000000000010000-0x00000000002E8000-memory.dmp	family_quasar
behavioral2/files/0x0002000000021b42-137.dat	family_quasar
behavioral2/files/0x0002000000021b42-136.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
4580	Windows Search.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ARMA3Client = "\"C:\\Windows\\ARMA3Client.exe\""	Windows Search.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ARMA3Client = "\"C:\\Windows\\ARMA3Client.exe\""	26aba4e9a028a23c065ce9611c164288.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.ipify.org
17	api.ipify.org

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
448	schtasks.exe
4948	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	26aba4e9a028a23c065ce9611c164288.exe
Token: SeDebugPrivilege	4580	Windows Search.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4580	Windows Search.exe
4580	Windows Search.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4580	Windows Search.exe
4580	Windows Search.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4580	Windows Search.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 448	1104	26aba4e9a028a23c065ce9611c164288.exe	81
PID 1104 wrote to memory of 448	1104	26aba4e9a028a23c065ce9611c164288.exe	81
PID 1104 wrote to memory of 4580	1104	26aba4e9a028a23c065ce9611c164288.exe	83
PID 1104 wrote to memory of 4580	1104	26aba4e9a028a23c065ce9611c164288.exe	83
PID 4580 wrote to memory of 4948	4580	Windows Search.exe	84
PID 4580 wrote to memory of 4948	4580	Windows Search.exe	84

C:\Users\Admin\AppData\Local\Temp\26aba4e9a028a23c065ce9611c164288.exe
"C:\Users\Admin\AppData\Local\Temp\26aba4e9a028a23c065ce9611c164288.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "WindowsSearchPrograms" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\26aba4e9a028a23c065ce9611c164288.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:448
- C:\Users\Admin\AppData\Roaming\WindowsSearch\Windows Search.exe
  "C:\Users\Admin\AppData\Roaming\WindowsSearch\Windows Search.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "WindowsSearchPrograms" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsSearch\Windows Search.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WindowsSearch\Windows Search.exe

Filesize
2.8MB

MD5
26aba4e9a028a23c065ce9611c164288

SHA1
58bc1e70429c58615863e1704d3a6b575fab767f

SHA256
00e3eebe4bbea52843a8d335bdf5e4b5d6c8de8079f8d86a345cceb2375ccb25

SHA512
0db32f58a5d54d04bd3ca60111b3963a50741893a16325a2f3bbeba237fc280fa6f3c63d054d5b9cef0443e8e5ed1de38e4a459c3e7f0c3be4d0a054e08b5095

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsSearch\Windows Search.exe

Filesize
2.8MB

MD5
26aba4e9a028a23c065ce9611c164288

SHA1
58bc1e70429c58615863e1704d3a6b575fab767f

SHA256
00e3eebe4bbea52843a8d335bdf5e4b5d6c8de8079f8d86a345cceb2375ccb25

SHA512
0db32f58a5d54d04bd3ca60111b3963a50741893a16325a2f3bbeba237fc280fa6f3c63d054d5b9cef0443e8e5ed1de38e4a459c3e7f0c3be4d0a054e08b5095

Download Submit
memory/1104-132-0x0000000000010000-0x00000000002E8000-memory.dmp

Filesize
2.8MB

Download
memory/1104-133-0x00007FFE53930000-0x00007FFE543F1000-memory.dmp

Filesize
10.8MB

Download
memory/1104-138-0x00007FFE53930000-0x00007FFE543F1000-memory.dmp

Filesize
10.8MB

Download
memory/4580-139-0x00007FFE53930000-0x00007FFE543F1000-memory.dmp

Filesize
10.8MB

Download
memory/4580-141-0x000000001BA80000-0x000000001BAD0000-memory.dmp

Filesize
320KB

Download
memory/4580-142-0x000000001C690000-0x000000001C742000-memory.dmp

Filesize
712KB

Download
memory/4580-143-0x00007FFE53930000-0x00007FFE543F1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads