quasar | a7e7d00dbcfded8345042410b362d04338fa33dea700a9cdf18679578f6d51af

General

Target

a6c317dcb5b9f43c26d53121a696eadb.exe
Size

3.1MB
MD5

a6c317dcb5b9f43c26d53121a696eadb
SHA1

10516eb3ed753b9f224f2170da50cde5f0e32d2c
SHA256

a7e7d00dbcfded8345042410b362d04338fa33dea700a9cdf18679578f6d51af
SHA512

5cf4f966dc5b94d35804448dde4600049407884330971e34e9462f044f8bb966035759f3a1d1ddb2796565cfed215b544c5adcdb60a75b4cbd15f9b1b1a4583d
SSDEEP

49152:bvyI22SsaNYfdPBldt698dBcjHsRu6nBxHOoGdG5MbOTHHB72eh2NT:bvf22SsaNYfdPBldt6+dBcjHf6q

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

147.135.165.27:4782

Mutex

f500aa4e-d127-4766-9ef9-64174e95f29c

Attributes

encryption_key
491408BD5297689B51A8088AE3C37B6548A71F50
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/836-54-0x0000000000250000-0x0000000000574000-memory.dmp	family_quasar
C:\Windows\System32\SubDir\Client.exe	family_quasar
C:\Windows\system32\SubDir\Client.exe	family_quasar
behavioral1/memory/628-61-0x00000000012E0000-0x0000000001604000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

628 Client.exe

pid	process
628	Client.exe

Drops file in System32 directory 5 IoCs

Processes:

Client.exea6c317dcb5b9f43c26d53121a696eadb.exe

description	ioc	process
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File created	C:\Windows\system32\SubDir\Client.exe	a6c317dcb5b9f43c26d53121a696eadb.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	a6c317dcb5b9f43c26d53121a696eadb.exe
File opened for modification	C:\Windows\system32\SubDir	a6c317dcb5b9f43c26d53121a696eadb.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1124 schtasks.exe
580 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a6c317dcb5b9f43c26d53121a696eadb.exeClient.exe

description pid process

Token: SeDebugPrivilege 836 a6c317dcb5b9f43c26d53121a696eadb.exe
Token: SeDebugPrivilege 628 Client.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

628 Client.exe

pid	process
1124	schtasks.exe
580	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	836	a6c317dcb5b9f43c26d53121a696eadb.exe
Token: SeDebugPrivilege	628	Client.exe

pid	process
628	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a6c317dcb5b9f43c26d53121a696eadb.exeClient.exe

description	pid	process	target process
PID 836 wrote to memory of 1124	836	a6c317dcb5b9f43c26d53121a696eadb.exe	schtasks.exe
PID 836 wrote to memory of 1124	836	a6c317dcb5b9f43c26d53121a696eadb.exe	schtasks.exe
PID 836 wrote to memory of 1124	836	a6c317dcb5b9f43c26d53121a696eadb.exe	schtasks.exe
PID 836 wrote to memory of 628	836	a6c317dcb5b9f43c26d53121a696eadb.exe	Client.exe
PID 836 wrote to memory of 628	836	a6c317dcb5b9f43c26d53121a696eadb.exe	Client.exe
PID 836 wrote to memory of 628	836	a6c317dcb5b9f43c26d53121a696eadb.exe	Client.exe
PID 628 wrote to memory of 580	628	Client.exe	schtasks.exe
PID 628 wrote to memory of 580	628	Client.exe	schtasks.exe
PID 628 wrote to memory of 580	628	Client.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a6c317dcb5b9f43c26d53121a696eadb.exe
"C:\Users\Admin\AppData\Local\Temp\a6c317dcb5b9f43c26d53121a696eadb.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1124

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:580

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\SubDir\Client.exe
Filesize
3.1MB

MD5
a6c317dcb5b9f43c26d53121a696eadb

SHA1
10516eb3ed753b9f224f2170da50cde5f0e32d2c

SHA256
a7e7d00dbcfded8345042410b362d04338fa33dea700a9cdf18679578f6d51af

SHA512
5cf4f966dc5b94d35804448dde4600049407884330971e34e9462f044f8bb966035759f3a1d1ddb2796565cfed215b544c5adcdb60a75b4cbd15f9b1b1a4583d

Download Submit
C:\Windows\system32\SubDir\Client.exe
Filesize
3.1MB

MD5
a6c317dcb5b9f43c26d53121a696eadb

SHA1
10516eb3ed753b9f224f2170da50cde5f0e32d2c

SHA256
a7e7d00dbcfded8345042410b362d04338fa33dea700a9cdf18679578f6d51af

SHA512
5cf4f966dc5b94d35804448dde4600049407884330971e34e9462f044f8bb966035759f3a1d1ddb2796565cfed215b544c5adcdb60a75b4cbd15f9b1b1a4583d

Download Submit
memory/628-61-0x00000000012E0000-0x0000000001604000-memory.dmp

Filesize
3.1MB

Download
memory/628-62-0x0000000000410000-0x0000000000490000-memory.dmp

Filesize
512KB

Download
memory/628-63-0x0000000000410000-0x0000000000490000-memory.dmp

Filesize
512KB

Download
memory/836-54-0x0000000000250000-0x0000000000574000-memory.dmp

Filesize
3.1MB

Download
memory/836-55-0x000000001AC80000-0x000000001AD00000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads