quasar | 274e032cefa381cff9cdddba5463d2f1a14c9e64c3ae8e41b4b960b8e3f95ac5

Analysis

max time kernel
114s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
16/02/2023, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Credit note FEB23.exe
Size 956KB
Sample230216-khk2vsgd6s
SHA256 274e032cefa381cff9cdddba5463d2f1a14c9e64c3ae8e41b4b960b8e3f95ac5
MD5 d0620b6592435383246986535d5bd90c
SHA1 c7bfdd4e3d77ae0417f8dfa84af98db180b89e31
SHA512 620511215cbfdb34c05ced3722588ab25eff93cd64bd377c3882ea6014593d73954657d58b6c1573354abad89efd1333e2b2b4eb1b44214f18b7c3595b671c27
SSDEEP 24576:QAzssFINDnpNOlAe/2wPdVF5iMZagA39+vD8+qiS0DCtIT:QGd/5iMZagAuQ+s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

37.120.210.219:9771

Mutex

cdc62cc3-297d-4baa-b514-fcd69f23b760

Attributes

encryption_key
F6CA1DFF4431556F5D775676A4005D1B1ABD97F4
install_name
Client.exe
log_directory
quasar
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/2284-140-0x0000000000400000-0x0000000000484000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Credit note FEB23.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Credit note FEB23.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
44	api.ipify.org
45	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3668 set thread context of 2284	3668	Credit note FEB23.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4496	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1480	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3668	Credit note FEB23.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3668	Credit note FEB23.exe
Token: SeDebugPrivilege	2284	Credit note FEB23.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2284	Credit note FEB23.exe
2284	Credit note FEB23.exe
2284	Credit note FEB23.exe
2284	Credit note FEB23.exe
2284	Credit note FEB23.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2284	Credit note FEB23.exe
2284	Credit note FEB23.exe
2284	Credit note FEB23.exe
2284	Credit note FEB23.exe
2284	Credit note FEB23.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2284	Credit note FEB23.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 4496	3668	Credit note FEB23.exe	90
PID 3668 wrote to memory of 4496	3668	Credit note FEB23.exe	90
PID 3668 wrote to memory of 4496	3668	Credit note FEB23.exe	90
PID 3668 wrote to memory of 2284	3668	Credit note FEB23.exe	92
PID 3668 wrote to memory of 2284	3668	Credit note FEB23.exe	92
PID 3668 wrote to memory of 2284	3668	Credit note FEB23.exe	92
PID 3668 wrote to memory of 2284	3668	Credit note FEB23.exe	92
PID 3668 wrote to memory of 2284	3668	Credit note FEB23.exe	92
PID 3668 wrote to memory of 2284	3668	Credit note FEB23.exe	92
PID 3668 wrote to memory of 2284	3668	Credit note FEB23.exe	92
PID 3668 wrote to memory of 2284	3668	Credit note FEB23.exe	92
PID 2284 wrote to memory of 1392	2284	Credit note FEB23.exe	93
PID 2284 wrote to memory of 1392	2284	Credit note FEB23.exe	93
PID 2284 wrote to memory of 1392	2284	Credit note FEB23.exe	93
PID 1392 wrote to memory of 4060	1392	cmd.exe	95
PID 1392 wrote to memory of 4060	1392	cmd.exe	95
PID 1392 wrote to memory of 4060	1392	cmd.exe	95
PID 1392 wrote to memory of 1480	1392	cmd.exe	96
PID 1392 wrote to memory of 1480	1392	cmd.exe	96
PID 1392 wrote to memory of 1480	1392	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\Credit note FEB23.exe
"C:\Users\Admin\AppData\Local\Temp\Credit note FEB23.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XaPoiNVecr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8B58.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4496
- C:\Users\Admin\AppData\Local\Temp\Credit note FEB23.exe
  "{path}"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pqgLDMWk4Z2q.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:4060
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:1480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Credit note FEB23.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Credit note FEB23.exe.log
Size 1KB
SHA256 e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
MD5 84e77a587d94307c0ac1357eb4d3d46f
SHA1 83cc900f9401f43d181207d64c5adba7a85edc1e
SHA512 aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
MD5 SHA1 SHA512

Submit Download

pqgLDMWk4Z2q.bat

Path C:\Users\Admin\AppData\Local\Temp\pqgLDMWk4Z2q.bat
Size 218B
SHA256 f4d569caad401d1b6e67310231d640866cb19011fc71feb84289cce385c0537c
MD5 5d78fd6f598539c2470b28ff5b330da9
SHA1 b90eb4330ffc443048421d1bf1ef9a3efc0bc145
SHA512 5aaf385c54a7b70918e673118fe8488a64314f11b6d96bbee3ec9a7cd1f60b5e26a1d9e6ca5706ddd92ab2a55e1ecb5bccc9f1b4b088127449165850b17ea529
MD5 SHA1 SHA512

Submit Download

tmp8B58.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp8B58.tmp
Size 1KB
SHA256 9f2e158e09f0c9d548db3b25d21a47d7c0deec8abb97ae4952335052e289374b
MD5 3f19d8e929d5e0965abf7dea2c5bf3b9
SHA1 e408f9e598e4ed105912952dcae4826d40723539
SHA512 6faa533437478856fe90f0bcb02b73c8c7cf8166f118ba86fd48419f9e4e525dbe34c31bc7b9069d03378eee9e54d49cceaedbb3a71213e8b6a1911d4587063f
MD5 SHA1 SHA512

Submit Download

memory/2284-144-0x0000000006700000-0x00000000067B2000-memory.dmp

Download

memory/2284-140-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/2284-142-0x00000000069E0000-0x0000000006FF8000-memory.dmp

Download

memory/2284-143-0x0000000006490000-0x00000000064E0000-memory.dmp

Download

memory/2284-145-0x00000000079F0000-0x0000000007A56000-memory.dmp

Download

memory/3668-136-0x0000000004EF0000-0x0000000004EFA000-memory.dmp

Download

memory/3668-132-0x0000000000490000-0x0000000000584000-memory.dmp

Download

memory/3668-135-0x0000000005030000-0x00000000050CC000-memory.dmp

Download

memory/3668-134-0x0000000004F90000-0x0000000005022000-memory.dmp

Download

memory/3668-133-0x0000000005540000-0x0000000005AE4000-memory.dmp

Download