quasar | 17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248

General

Target

HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe
Size

144KB
MD5

7f7fa947c50c3f910aeb0ab971ddbe30
SHA1

fae2adb3424a82d8922e512b823bd85b9e1f9d00
SHA256

17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248
SHA512

9966ea045c835e97c93e34f00708e9d1cc88053dd7eb36a0aafe80596f902a51868c6a43a818a3e79e1db341ce69708c0a61da16c4f0c630abaa46c8c7278388
SSDEEP

3072:TW9VDGgVRschltqD7J/+kD5f2VX7X9sYoo:i9VL0GlMD7ImfOXL9ko

Score

10^/10

quasar office04 persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office04

C2

primary-comment.at.playit.gg:29022

Mutex

OxNTiA3vaw7DPYLLek

Attributes

encryption_key
jhDT0w3MDDqnddR6Tjen
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/1436-55-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quasar Client Startup = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe\""	HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1436	HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe
1436	HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe
1436	HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe
1436	HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe
1436	HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1744	1436	HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe	28
PID 1436 wrote to memory of 1744	1436	HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe	28
PID 1436 wrote to memory of 1744	1436	HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe	28
PID 360 wrote to memory of 1572	360	taskeng.exe	31
PID 360 wrote to memory of 1572	360	taskeng.exe	31
PID 360 wrote to memory of 1572	360	taskeng.exe	31
PID 360 wrote to memory of 1260	360	taskeng.exe	32
PID 360 wrote to memory of 1260	360	taskeng.exe	32
PID 360 wrote to memory of 1260	360	taskeng.exe	32

C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "WINDOWSSYSTEMHOST" /tr "C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe" /sc MINUTE /MO 1
  2⤵
  - Creates scheduled task(s)
  PID:1744

C:\Windows\system32\taskeng.exe
taskeng.exe {61A8122C-03DD-44AE-9CE6-7C09E88AB213} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:360
- C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe
  C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe
  2⤵
  PID:1572
- C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe
  C:\Users\Admin\AppData\Local\Temp\HEUR-Backdoor.MSIL.Quasar.gen-17f5902438ae8e7874be0cf1481d689b7cb4555934c0d48321ea085bee137248.exe
  2⤵
  PID:1260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1436-54-0x0000000001020000-0x0000000001028000-memory.dmp

Filesize
32KB

Download
memory/1436-55-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads