quasar | 8ad32ff282a91fd4dcc732cab9c853db3c0085dec8bbabb5388553938fd42f60

General

Target

tmp.exe
Size

344KB
MD5

697898102d367f3a5fb7f790d199112e
SHA1

ee94d4ade21d267503869c47a3b61ff30bb6305d
SHA256

8ad32ff282a91fd4dcc732cab9c853db3c0085dec8bbabb5388553938fd42f60
SHA512

752fead6eff8116e5caf37d2c9af5f01bf756ec00e5bc98dabe72d552546e4537ef0d040c1f049e9707b536833abdd0b0f94ff4b4eb5cd2fa63cef22bb918b13
SSDEEP

6144:7zkVzIZzF1Pq2o2zlOlqZ+Tz3RNGfbQpNsYsoSA7fiCEq/ab:Dh1P22zlkTNsY/iy/ab

Score

10^/10

quasar officebox spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

OfficeBOX

C2

185.81.157.174:4554

Mutex

QSR_MUTEX_xSMql9r0AKSYarKyPE

Attributes

encryption_key
RQ0DJiJOKJWym1FwBiYm
install_name
Clientchrome.exe
log_directory
Logs
reconnect_delay
3000
startup_key
ChromeClient Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1940-54-0x0000000000C90000-0x0000000000CEC000-memory.dmp	family_quasar
\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe	family_quasar
behavioral1/memory/1688-61-0x0000000000B60000-0x0000000000BBC000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Clientchrome.exe

pid process

1688 Clientchrome.exe
Loads dropped DLL 1 IoCs

Processes:

tmp.exe

pid process

1940 tmp.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

836 schtasks.exe
340 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.exeClientchrome.exe

description pid process

Token: SeDebugPrivilege 1940 tmp.exe
Token: SeDebugPrivilege 1688 Clientchrome.exe

pid	process
1688	Clientchrome.exe

pid	process
1940	tmp.exe

flow	ioc
1	ip-api.com

pid	process
836	schtasks.exe
340	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1940	tmp.exe
Token: SeDebugPrivilege	1688	Clientchrome.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

tmp.exeClientchrome.exe

description	pid	process	target process
PID 1940 wrote to memory of 836	1940	tmp.exe	schtasks.exe
PID 1940 wrote to memory of 836	1940	tmp.exe	schtasks.exe
PID 1940 wrote to memory of 836	1940	tmp.exe	schtasks.exe
PID 1940 wrote to memory of 836	1940	tmp.exe	schtasks.exe
PID 1940 wrote to memory of 1688	1940	tmp.exe	Clientchrome.exe
PID 1940 wrote to memory of 1688	1940	tmp.exe	Clientchrome.exe
PID 1940 wrote to memory of 1688	1940	tmp.exe	Clientchrome.exe
PID 1940 wrote to memory of 1688	1940	tmp.exe	Clientchrome.exe
PID 1688 wrote to memory of 340	1688	Clientchrome.exe	schtasks.exe
PID 1688 wrote to memory of 340	1688	Clientchrome.exe	schtasks.exe
PID 1688 wrote to memory of 340	1688	Clientchrome.exe	schtasks.exe
PID 1688 wrote to memory of 340	1688	Clientchrome.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "ChromeClient Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\tmp.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:836

C:\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "ChromeClient Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe
Filesize
344KB

MD5
697898102d367f3a5fb7f790d199112e

SHA1
ee94d4ade21d267503869c47a3b61ff30bb6305d

SHA256
8ad32ff282a91fd4dcc732cab9c853db3c0085dec8bbabb5388553938fd42f60

SHA512
752fead6eff8116e5caf37d2c9af5f01bf756ec00e5bc98dabe72d552546e4537ef0d040c1f049e9707b536833abdd0b0f94ff4b4eb5cd2fa63cef22bb918b13

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe
Filesize
344KB

MD5
697898102d367f3a5fb7f790d199112e

SHA1
ee94d4ade21d267503869c47a3b61ff30bb6305d

SHA256
8ad32ff282a91fd4dcc732cab9c853db3c0085dec8bbabb5388553938fd42f60

SHA512
752fead6eff8116e5caf37d2c9af5f01bf756ec00e5bc98dabe72d552546e4537ef0d040c1f049e9707b536833abdd0b0f94ff4b4eb5cd2fa63cef22bb918b13

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe
Filesize
344KB

MD5
697898102d367f3a5fb7f790d199112e

SHA1
ee94d4ade21d267503869c47a3b61ff30bb6305d

SHA256
8ad32ff282a91fd4dcc732cab9c853db3c0085dec8bbabb5388553938fd42f60

SHA512
752fead6eff8116e5caf37d2c9af5f01bf756ec00e5bc98dabe72d552546e4537ef0d040c1f049e9707b536833abdd0b0f94ff4b4eb5cd2fa63cef22bb918b13

Download Submit
memory/340-63-0x0000000000000000-mapping.dmp

Download
memory/836-56-0x0000000000000000-mapping.dmp

Download
memory/1688-58-0x0000000000000000-mapping.dmp

Download
memory/1688-61-0x0000000000B60000-0x0000000000BBC000-memory.dmp

Filesize
368KB

Download
memory/1940-54-0x0000000000C90000-0x0000000000CEC000-memory.dmp

Filesize
368KB

Download
memory/1940-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads