quasar | 78eb982abdfb385ac2e0c9a640856077379355f16e29788456a6551c166b00fe

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2023, 07:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 4.2MB
Sample230514-jrhsesde2v
SHA256 78eb982abdfb385ac2e0c9a640856077379355f16e29788456a6551c166b00fe
MD5 b5eb699845a8e943a788280ed8b27517
SHA1 436e53d4a0bd510cfe242244a8d58855cb78ed18
SHA512 5dae2209ee960401a02d7c1597abb1356def23e142296d8007cd504515647ea9a2761c4d2472e1556fb0bc8c82bf6de96c21da05d778e267a79c89b8da9f294b
SSDEEP 98304:420RJx1z4xKUHmqwwbjBJT5vLuAyuZf/Wq/7kcaT65Z:aRJxdEbjljuAyIfeqjkWZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

217.196.96.37:5678

Mutex

561ba2d7-836d-4eba-8688-03a4852a44b9

Attributes

encryption_key
B97A933CE9789DFB0A082900F0B084F3B8D36164
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4940-133-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3168 set thread context of 4940	3168	file.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	InstallUtil.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 1328	3168	file.exe	83
PID 3168 wrote to memory of 1328	3168	file.exe	83
PID 3168 wrote to memory of 1328	3168	file.exe	83
PID 3168 wrote to memory of 1328	3168	file.exe	83
PID 3168 wrote to memory of 868	3168	file.exe	84
PID 3168 wrote to memory of 868	3168	file.exe	84
PID 3168 wrote to memory of 868	3168	file.exe	84
PID 3168 wrote to memory of 868	3168	file.exe	84
PID 3168 wrote to memory of 4940	3168	file.exe	85
PID 3168 wrote to memory of 4940	3168	file.exe	85
PID 3168 wrote to memory of 4940	3168	file.exe	85
PID 3168 wrote to memory of 4940	3168	file.exe	85
PID 3168 wrote to memory of 4940	3168	file.exe	85
PID 3168 wrote to memory of 4940	3168	file.exe	85
PID 3168 wrote to memory of 4940	3168	file.exe	85
PID 3168 wrote to memory of 4940	3168	file.exe	85

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1328
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4940-133-0x0000000000400000-0x0000000000724000-memory.dmp

Download

memory/4940-134-0x0000000005C30000-0x00000000061D4000-memory.dmp

Download

memory/4940-135-0x0000000005680000-0x0000000005712000-memory.dmp

Download

memory/4940-136-0x0000000005760000-0x0000000005770000-memory.dmp

Download

memory/4940-137-0x0000000005640000-0x000000000564A000-memory.dmp

Download

memory/4940-138-0x0000000006A00000-0x0000000007018000-memory.dmp

Download

memory/4940-139-0x0000000005B30000-0x0000000005B80000-memory.dmp

Download

memory/4940-140-0x0000000006550000-0x0000000006602000-memory.dmp

Download

memory/4940-141-0x0000000005760000-0x0000000005770000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads