quasar | a7e7d00dbcfded8345042410b362d04338fa33dea700a9cdf18679578f6d51af

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2023 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02220499.exe
Size

3.1MB
MD5

a6c317dcb5b9f43c26d53121a696eadb
SHA1

10516eb3ed753b9f224f2170da50cde5f0e32d2c
SHA256

a7e7d00dbcfded8345042410b362d04338fa33dea700a9cdf18679578f6d51af
SHA512

5cf4f966dc5b94d35804448dde4600049407884330971e34e9462f044f8bb966035759f3a1d1ddb2796565cfed215b544c5adcdb60a75b4cbd15f9b1b1a4583d
SSDEEP

49152:bvyI22SsaNYfdPBldt698dBcjHsRu6nBxHOoGdG5MbOTHHB72eh2NT:bvf22SsaNYfdPBldt6+dBcjHf6q

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

147.135.165.27:4782

Mutex

f500aa4e-d127-4766-9ef9-64174e95f29c

Attributes

encryption_key
491408BD5297689B51A8088AE3C37B6548A71F50
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3400-133-0x0000000000810000-0x0000000000B34000-memory.dmp	family_quasar
C:\Windows\System32\SubDir\Client.exe	family_quasar
C:\Windows\system32\SubDir\Client.exe	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

2352 Client.exe

pid	process
2352	Client.exe

Drops file in System32 directory 5 IoCs

Processes:

02220499.exeClient.exe

description	ioc	process
File created	C:\Windows\system32\SubDir\Client.exe	02220499.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	02220499.exe
File opened for modification	C:\Windows\system32\SubDir	02220499.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

5076 schtasks.exe
2116 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

02220499.exeClient.exe

description pid process

Token: SeDebugPrivilege 3400 02220499.exe
Token: SeDebugPrivilege 2352 Client.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

2352 Client.exe

pid	process
5076	schtasks.exe
2116	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	3400	02220499.exe
Token: SeDebugPrivilege	2352	Client.exe

pid	process
2352	Client.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

02220499.exeClient.exe

description	pid	process	target process
PID 3400 wrote to memory of 5076	3400	02220499.exe	schtasks.exe
PID 3400 wrote to memory of 5076	3400	02220499.exe	schtasks.exe
PID 3400 wrote to memory of 2352	3400	02220499.exe	Client.exe
PID 3400 wrote to memory of 2352	3400	02220499.exe	Client.exe
PID 2352 wrote to memory of 2116	2352	Client.exe	schtasks.exe
PID 2352 wrote to memory of 2116	2352	Client.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\02220499.exe
"C:\Users\Admin\AppData\Local\Temp\02220499.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2116

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\SubDir\Client.exe
Filesize
3.1MB

MD5
a6c317dcb5b9f43c26d53121a696eadb

SHA1
10516eb3ed753b9f224f2170da50cde5f0e32d2c

SHA256
a7e7d00dbcfded8345042410b362d04338fa33dea700a9cdf18679578f6d51af

SHA512
5cf4f966dc5b94d35804448dde4600049407884330971e34e9462f044f8bb966035759f3a1d1ddb2796565cfed215b544c5adcdb60a75b4cbd15f9b1b1a4583d

Download Submit
C:\Windows\system32\SubDir\Client.exe
Filesize
3.1MB

MD5
a6c317dcb5b9f43c26d53121a696eadb

SHA1
10516eb3ed753b9f224f2170da50cde5f0e32d2c

SHA256
a7e7d00dbcfded8345042410b362d04338fa33dea700a9cdf18679578f6d51af

SHA512
5cf4f966dc5b94d35804448dde4600049407884330971e34e9462f044f8bb966035759f3a1d1ddb2796565cfed215b544c5adcdb60a75b4cbd15f9b1b1a4583d

Download Submit
memory/2352-141-0x000000001B530000-0x000000001B540000-memory.dmp

Filesize
64KB

Download
memory/2352-142-0x0000000002A50000-0x0000000002AA0000-memory.dmp

Filesize
320KB

Download
memory/2352-143-0x000000001BD70000-0x000000001BE22000-memory.dmp

Filesize
712KB

Download
memory/2352-144-0x000000001B530000-0x000000001B540000-memory.dmp

Filesize
64KB

Download
memory/3400-133-0x0000000000810000-0x0000000000B34000-memory.dmp

Filesize
3.1MB

Download
memory/3400-134-0x000000001B7B0000-0x000000001B7C0000-memory.dmp

Filesize
64KB

Download