quasar | f7b9f44883cc004d34cd03dd739cbecccb3ff66824856d30dcdc31d6b5165aff

General

Target
Spoofer.exe
Size 3.1MB
Sample230321-db6awsae7y
SHA256 f7b9f44883cc004d34cd03dd739cbecccb3ff66824856d30dcdc31d6b5165aff
MD5 40258dcce3671d3a542cffce4cb874cf
SHA1 0a8ef5122aee73d56d914c959845886cab801a42
SHA512 60e8dc50e7cd6340de5c688619059b95f0badfe6b31793564ef3f17d0ecdd5aad75d3ecad7e0544bd10a9e264a6274f69fe0010248ecadf289fcba2252c3c82a
SSDEEP 49152:bvLlL26AaNeWgPhlmVqvMQ7XSKhLL9mzhcoGdOTHHB72eh2NT:bvxL26AaNeWgPhlmVqkQ7XSKhLLX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

thebest39393.ddns.net:8809

Mutex

1224f465-e32d-4085-9a02-731b542e4878

Attributes

encryption_key
8BD2B58EA96EA698E3D164141109BBA2A69EE028
install_name
Windows Defender.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft Services
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

resource	yara_rule
behavioral1/memory/912-54-0x0000000000DD0000-0x00000000010F4000-memory.dmp	family_quasar
behavioral1/files/0x000a0000000122f5-59.dat	family_quasar
behavioral1/memory/1428-61-0x0000000000B50000-0x0000000000E74000-memory.dmp	family_quasar
behavioral1/files/0x000a0000000122f5-60.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
1428	Windows Defender.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\SubDir\Windows Defender.exe	Spoofer.exe
File opened for modification	C:\Windows\system32\SubDir\Windows Defender.exe	Spoofer.exe
File opened for modification	C:\Windows\system32\SubDir	Spoofer.exe
File opened for modification	C:\Windows\system32\SubDir\Windows Defender.exe	Windows Defender.exe
File opened for modification	C:\Windows\system32\SubDir	Windows Defender.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1756	schtasks.exe
1472	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	Spoofer.exe
Token: SeDebugPrivilege	1428	Windows Defender.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1428	Windows Defender.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1756	912	Spoofer.exe	29
PID 912 wrote to memory of 1756	912	Spoofer.exe	29
PID 912 wrote to memory of 1756	912	Spoofer.exe	29
PID 912 wrote to memory of 1428	912	Spoofer.exe	30
PID 912 wrote to memory of 1428	912	Spoofer.exe	30
PID 912 wrote to memory of 1428	912	Spoofer.exe	30
PID 1428 wrote to memory of 1472	1428	Windows Defender.exe	31
PID 1428 wrote to memory of 1472	1428	Windows Defender.exe	31
PID 1428 wrote to memory of 1472	1428	Windows Defender.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Microsoft Services" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Windows Defender.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1756
- C:\Windows\system32\SubDir\Windows Defender.exe
  "C:\Windows\system32\SubDir\Windows Defender.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Microsoft Services" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Windows Defender.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Windows Defender.exe

Path C:\Windows\System32\SubDir\Windows Defender.exe
Size 3.1MB
SHA256 f7b9f44883cc004d34cd03dd739cbecccb3ff66824856d30dcdc31d6b5165aff
MD5 40258dcce3671d3a542cffce4cb874cf
SHA1 0a8ef5122aee73d56d914c959845886cab801a42
SHA512 60e8dc50e7cd6340de5c688619059b95f0badfe6b31793564ef3f17d0ecdd5aad75d3ecad7e0544bd10a9e264a6274f69fe0010248ecadf289fcba2252c3c82a
SSDEEP 49152:bvLlL26AaNeWgPhlmVqvMQ7XSKhLL9mzhcoGdOTHHB72eh2NT:bvxL26AaNeWgPhlmVqkQ7XSKhLLX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows Defender.exe

Path C:\Windows\system32\SubDir\Windows Defender.exe
Size 3.1MB
SHA256 f7b9f44883cc004d34cd03dd739cbecccb3ff66824856d30dcdc31d6b5165aff
MD5 40258dcce3671d3a542cffce4cb874cf
SHA1 0a8ef5122aee73d56d914c959845886cab801a42
SHA512 60e8dc50e7cd6340de5c688619059b95f0badfe6b31793564ef3f17d0ecdd5aad75d3ecad7e0544bd10a9e264a6274f69fe0010248ecadf289fcba2252c3c82a
SSDEEP 49152:bvLlL26AaNeWgPhlmVqvMQ7XSKhLL9mzhcoGdOTHHB72eh2NT:bvxL26AaNeWgPhlmVqkQ7XSKhLLX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/912-54-0x0000000000DD0000-0x00000000010F4000-memory.dmp

Download

memory/912-55-0x000000001B210000-0x000000001B290000-memory.dmp

Download

memory/1428-61-0x0000000000B50000-0x0000000000E74000-memory.dmp

Download

memory/1428-62-0x0000000000280000-0x0000000000300000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads