quasar | 8ad32ff282a91fd4dcc732cab9c853db3c0085dec8bbabb5388553938fd42f60

Analysis

max time kernel
153s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

344KB
MD5

697898102d367f3a5fb7f790d199112e
SHA1

ee94d4ade21d267503869c47a3b61ff30bb6305d
SHA256

8ad32ff282a91fd4dcc732cab9c853db3c0085dec8bbabb5388553938fd42f60
SHA512

752fead6eff8116e5caf37d2c9af5f01bf756ec00e5bc98dabe72d552546e4537ef0d040c1f049e9707b536833abdd0b0f94ff4b4eb5cd2fa63cef22bb918b13
SSDEEP

6144:7zkVzIZzF1Pq2o2zlOlqZ+Tz3RNGfbQpNsYsoSA7fiCEq/ab:Dh1P22zlkTNsY/iy/ab

Score

10^/10

quasar officebox spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

OfficeBOX

185.81.157.174:4554

Mutex

QSR_MUTEX_xSMql9r0AKSYarKyPE

Attributes

encryption_key
RQ0DJiJOKJWym1FwBiYm
install_name
Clientchrome.exe
log_directory
Logs
reconnect_delay
3000
startup_key
ChromeClient Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5068-132-0x0000000000A40000-0x0000000000A9C000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Clientchrome.exe

pid process

1328 Clientchrome.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 ip-api.com
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1676 schtasks.exe
2816 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.exeClientchrome.exe

description pid process

Token: SeDebugPrivilege 5068 tmp.exe
Token: SeDebugPrivilege 1328 Clientchrome.exe

pid	process
1328	Clientchrome.exe

flow	ioc
9	ip-api.com

pid	process
1676	schtasks.exe
2816	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	5068	tmp.exe
Token: SeDebugPrivilege	1328	Clientchrome.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

tmp.exeClientchrome.exe

description	pid	process	target process
PID 5068 wrote to memory of 2816	5068	tmp.exe	schtasks.exe
PID 5068 wrote to memory of 2816	5068	tmp.exe	schtasks.exe
PID 5068 wrote to memory of 2816	5068	tmp.exe	schtasks.exe
PID 5068 wrote to memory of 1328	5068	tmp.exe	Clientchrome.exe
PID 5068 wrote to memory of 1328	5068	tmp.exe	Clientchrome.exe
PID 5068 wrote to memory of 1328	5068	tmp.exe	Clientchrome.exe
PID 1328 wrote to memory of 1676	1328	Clientchrome.exe	schtasks.exe
PID 1328 wrote to memory of 1676	1328	Clientchrome.exe	schtasks.exe
PID 1328 wrote to memory of 1676	1328	Clientchrome.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "ChromeClient Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\tmp.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2816

C:\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "ChromeClient Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe

Filesize
344KB

MD5
697898102d367f3a5fb7f790d199112e

SHA1
ee94d4ade21d267503869c47a3b61ff30bb6305d

SHA256
8ad32ff282a91fd4dcc732cab9c853db3c0085dec8bbabb5388553938fd42f60

SHA512
752fead6eff8116e5caf37d2c9af5f01bf756ec00e5bc98dabe72d552546e4537ef0d040c1f049e9707b536833abdd0b0f94ff4b4eb5cd2fa63cef22bb918b13

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Clientchrome.exe

Filesize
344KB

MD5
697898102d367f3a5fb7f790d199112e

SHA1
ee94d4ade21d267503869c47a3b61ff30bb6305d

SHA256
8ad32ff282a91fd4dcc732cab9c853db3c0085dec8bbabb5388553938fd42f60

SHA512
752fead6eff8116e5caf37d2c9af5f01bf756ec00e5bc98dabe72d552546e4537ef0d040c1f049e9707b536833abdd0b0f94ff4b4eb5cd2fa63cef22bb918b13

Download Submit
memory/1328-139-0x0000000000000000-mapping.dmp

Download
memory/1328-143-0x0000000006DA0000-0x0000000006DAA000-memory.dmp

Filesize
40KB

Download
memory/1676-142-0x0000000000000000-mapping.dmp

Download
memory/2816-138-0x0000000000000000-mapping.dmp

Download
memory/5068-132-0x0000000000A40000-0x0000000000A9C000-memory.dmp

Filesize
368KB

Download
memory/5068-133-0x0000000005A30000-0x0000000005FD4000-memory.dmp

Filesize
5.6MB

Download
memory/5068-134-0x0000000005480000-0x0000000005512000-memory.dmp

Filesize
584KB

Download
memory/5068-135-0x0000000005520000-0x0000000005586000-memory.dmp

Filesize
408KB

Download
memory/5068-136-0x0000000005A00000-0x0000000005A12000-memory.dmp

Filesize
72KB

Download
memory/5068-137-0x00000000068A0000-0x00000000068DC000-memory.dmp

Filesize
240KB

Download