quasar | 3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8

Analysis

max time kernel
53s
max time network
143s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
25-01-2023 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe
Size

17KB
MD5

f6f83ba3f1e87503941e50b3e50d390f
SHA1

6983d00bc9cda93f0da126504d99a851ffef6cea
SHA256

3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8
SHA512

d9afb2024c16229d1245d1c8faf1a5fb7b1c2a4c2e379078e0c70493c8dedc7fb76be3233c4e9757168382b27b8ae4f17726209af893297fe67838472443e3d4
SSDEEP

384:O0CqWx4t+dWNzuY7/aAygucwhb6v/uFi:O0CL4sBTguJmei

Score

10^/10

quasar revengerat office04 persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office04

51.89.157.248:4782

Mutex

MvfU8Y7jQptTEqcSWG

Attributes

encryption_key
gfcyUhYEMEq5BWNn8aVX
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4772-325-0x000000000044943E-mapping.dmp	family_quasar
behavioral1/memory/4772-415-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\DriverHelp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DriverHelp.exe\""	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 ip-api.com

flow	ioc
5	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe

description	pid	process	target process
PID 2796 set thread context of 4772	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exe

pid process

1296 powershell.exe
1296 powershell.exe
1296 powershell.exe
4216 powershell.exe
4216 powershell.exe
4216 powershell.exe

pid	process
1296	powershell.exe
1296	powershell.exe
1296	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exepowershell.exepowershell.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe
Token: SeDebugPrivilege	1296	powershell.exe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeDebugPrivilege	4772	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegAsm.exe

pid process

4772 RegAsm.exe

pid	process
4772	RegAsm.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.execmd.exe

description	pid	process	target process
PID 2796 wrote to memory of 1296	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe	powershell.exe
PID 2796 wrote to memory of 1296	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe	powershell.exe
PID 2796 wrote to memory of 1296	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe	powershell.exe
PID 2796 wrote to memory of 5088	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe	cmd.exe
PID 2796 wrote to memory of 5088	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe	cmd.exe
PID 2796 wrote to memory of 5088	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe	cmd.exe
PID 5088 wrote to memory of 4216	5088	cmd.exe	powershell.exe
PID 5088 wrote to memory of 4216	5088	cmd.exe	powershell.exe
PID 5088 wrote to memory of 4216	5088	cmd.exe	powershell.exe
PID 2796 wrote to memory of 4772	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe	RegAsm.exe
PID 2796 wrote to memory of 4772	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe	RegAsm.exe
PID 2796 wrote to memory of 4772	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe	RegAsm.exe
PID 2796 wrote to memory of 4772	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe	RegAsm.exe
PID 2796 wrote to memory of 4772	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe	RegAsm.exe
PID 2796 wrote to memory of 4772	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe	RegAsm.exe
PID 2796 wrote to memory of 4772	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe	RegAsm.exe
PID 2796 wrote to memory of 4772	2796	3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe
"C:\Users\Admin\AppData\Local\Temp\3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
2⤵
- Suspicious use of WriteProcessMemory
PID:5088

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
66382a4ca6c4dcf75ce41417d44be93e

SHA1
8132cbef1c12f8a89a68a6153ade4286bf130812

SHA256
a70acce0f4c6ab59b88ce79d84c38d4abffe19b72b033250499b17d788a2db56

SHA512
2bf66f2850f4a65220085c55a5b3c8866453104d78fe516e5bd6e3e47df783062ce4ea10de580f2eb0274ac8c3ce71965201c49ef55a78f307731ccc8600aadc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
45KB

MD5
5f640bd48e2547b4c1a7421f080f815f

SHA1
a8f4a743f5b7da5cba7b8e6fb1d7ad4d67fefc6a

SHA256
916c83c7c8d059aea295523b8b3f24e1e2436df894f7fae26c47c9bad04baa9c

SHA512
a6ac100a351946b1bbb40c98aeda6e16e12f90f81063aff08c16d4d9afec8ed65c2cbcf25b42946627d67653f75740b1137dab625c99e9492ba35aba68b79a8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
16KB

MD5
bfe65f339bd09aa484448f4db07d908c

SHA1
b8998361e69235b36f0a1ba983ac7e5746464c82

SHA256
f6386a46c3f9640ca735b46d29478a2969702e1ee5a53f6abb3414d8153c1c49

SHA512
6239a9ce8cdb3bd25886d350ad971a225309cfb8fcb90ae6ff830bdf23bb18bb09089b745a9b6ceb70c4dd750efb080408e890a04d15317a3fe3a49295eda979

Download Submit
memory/1296-276-0x0000000008200000-0x0000000008276000-memory.dmp

Filesize
472KB

Download
memory/1296-287-0x0000000009AF0000-0x000000000A168000-memory.dmp

Filesize
6.5MB

Download
memory/1296-288-0x0000000009060000-0x000000000907A000-memory.dmp

Filesize
104KB

Download
memory/1296-207-0x0000000000000000-mapping.dmp

Download
memory/1296-272-0x0000000008490000-0x00000000084DB000-memory.dmp

Filesize
300KB

Download
memory/1296-271-0x0000000007F80000-0x0000000007F9C000-memory.dmp

Filesize
112KB

Download
memory/1296-268-0x0000000007B80000-0x0000000007BE6000-memory.dmp

Filesize
408KB

Download
memory/1296-267-0x0000000007270000-0x00000000072D6000-memory.dmp

Filesize
408KB

Download
memory/1296-248-0x0000000007450000-0x0000000007A78000-memory.dmp

Filesize
6.2MB

Download
memory/1296-243-0x0000000004740000-0x0000000004776000-memory.dmp

Filesize
216KB

Download
memory/2796-149-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-177-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-138-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-139-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-137-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-141-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-142-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-144-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-146-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-148-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-147-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-145-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-120-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-143-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-150-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-140-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-136-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-151-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-153-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-154-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-152-0x0000000000790000-0x000000000079A000-memory.dmp

Filesize
40KB

Download
memory/2796-135-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-155-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-156-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-158-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-157-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-159-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-161-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-164-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-163-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-162-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-160-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-165-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-166-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-168-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-167-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-169-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-170-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-171-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-172-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-173-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-174-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-175-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-134-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-180-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-179-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-181-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-178-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-182-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-176-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-183-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-184-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-191-0x0000000005900000-0x0000000005A76000-memory.dmp

Filesize
1.5MB

Download
memory/2796-192-0x0000000005B80000-0x0000000005C12000-memory.dmp

Filesize
584KB

Download
memory/2796-193-0x0000000005D90000-0x0000000005DB2000-memory.dmp

Filesize
136KB

Download
memory/2796-195-0x0000000005DC0000-0x0000000006110000-memory.dmp

Filesize
3.3MB

Download
memory/2796-125-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-133-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-126-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-129-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-131-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-132-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-130-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-128-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-127-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-124-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-123-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-122-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/2796-315-0x00000000057D0000-0x000000000582C000-memory.dmp

Filesize
368KB

Download
memory/2796-121-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/4216-440-0x00000000092C0000-0x00000000092DE000-memory.dmp

Filesize
120KB

Download
memory/4216-409-0x0000000007C00000-0x0000000007F50000-memory.dmp

Filesize
3.3MB

Download
memory/4216-299-0x0000000000000000-mapping.dmp

Download
memory/4216-696-0x00000000085C0000-0x00000000085C8000-memory.dmp

Filesize
32KB

Download
memory/4216-691-0x00000000085D0000-0x00000000085EA000-memory.dmp

Filesize
104KB

Download
memory/4216-417-0x0000000008640000-0x000000000868B000-memory.dmp

Filesize
300KB

Download
memory/4216-462-0x00000000097E0000-0x0000000009874000-memory.dmp

Filesize
592KB

Download
memory/4216-452-0x0000000009620000-0x00000000096C5000-memory.dmp

Filesize
660KB

Download
memory/4216-439-0x00000000092E0000-0x0000000009313000-memory.dmp

Filesize
204KB

Download
memory/4772-418-0x00000000056A0000-0x0000000005B9E000-memory.dmp

Filesize
5.0MB

Download
memory/4772-421-0x00000000051A0000-0x0000000005232000-memory.dmp

Filesize
584KB

Download
memory/4772-486-0x0000000005EE0000-0x0000000005EF2000-memory.dmp

Filesize
72KB

Download
memory/4772-544-0x00000000062B0000-0x00000000062EE000-memory.dmp

Filesize
248KB

Download
memory/4772-561-0x0000000006620000-0x000000000662A000-memory.dmp

Filesize
40KB

Download
memory/4772-325-0x000000000044943E-mapping.dmp

Download
memory/4772-415-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5088-293-0x0000000000000000-mapping.dmp

Download