quasar | 9ce882116ae23f4d32f4937f2b61ca8deea0c476be41fdd3158dadc14335a45f

Analysis

max time kernel
147s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-06-2023 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

5ddcc9baa65b17926f2262a9fe530b93
SHA1

6fa7fd0df2a9928b6c063fc03b10bdcd84e26008
SHA256

9ce882116ae23f4d32f4937f2b61ca8deea0c476be41fdd3158dadc14335a45f
SHA512

79fd0d0ff6115972017fef2c6feeddaf26db86bb69437ca431abd2ba35d4b6c249c7150f3969fd589006b2d3defa674c589610caee5a1585e50f027b06f6aa06
SSDEEP

49152:+vaY52fyaSZOrPWluWBuGG5g5hPbRJ6KbR3LoGd/THHB72eh2NT:+vv52fyaSZOrPWluWBDG5g5hPbRJ6k

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

127.0.0.1:4782

Mutex

57af6279-a68f-4f70-9b6b-439dccca1ff4

Attributes

encryption_key
1B9C51B90AB1DE21D6A313176E631A6295A0C2E6
install_name
Memes.exe
log_directory
Logs
reconnect_delay
3000
startup_key
memes
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1948-54-0x0000000001020000-0x0000000001344000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Memes.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Memes.exe	family_quasar
behavioral1/memory/1428-61-0x0000000000F60000-0x0000000001284000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Memes.exe

pid process

1428 Memes.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1168 schtasks.exe
660 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Client-built.exeMemes.exe

description pid process

Token: SeDebugPrivilege 1948 Client-built.exe
Token: SeDebugPrivilege 1428 Memes.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Memes.exe

pid process

1428 Memes.exe

pid	process
1428	Memes.exe

pid	process
1168	schtasks.exe
660	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1948	Client-built.exe
Token: SeDebugPrivilege	1428	Memes.exe

pid	process
1428	Memes.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Client-built.exeMemes.exe

description	pid	process	target process
PID 1948 wrote to memory of 1168	1948	Client-built.exe	schtasks.exe
PID 1948 wrote to memory of 1168	1948	Client-built.exe	schtasks.exe
PID 1948 wrote to memory of 1168	1948	Client-built.exe	schtasks.exe
PID 1948 wrote to memory of 1428	1948	Client-built.exe	Memes.exe
PID 1948 wrote to memory of 1428	1948	Client-built.exe	Memes.exe
PID 1948 wrote to memory of 1428	1948	Client-built.exe	Memes.exe
PID 1428 wrote to memory of 660	1428	Memes.exe	schtasks.exe
PID 1428 wrote to memory of 660	1428	Memes.exe	schtasks.exe
PID 1428 wrote to memory of 660	1428	Memes.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "memes" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Memes.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1168

C:\Users\Admin\AppData\Roaming\SubDir\Memes.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Memes.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "memes" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Memes.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Memes.exe
Filesize
3.1MB

MD5
5ddcc9baa65b17926f2262a9fe530b93

SHA1
6fa7fd0df2a9928b6c063fc03b10bdcd84e26008

SHA256
9ce882116ae23f4d32f4937f2b61ca8deea0c476be41fdd3158dadc14335a45f

SHA512
79fd0d0ff6115972017fef2c6feeddaf26db86bb69437ca431abd2ba35d4b6c249c7150f3969fd589006b2d3defa674c589610caee5a1585e50f027b06f6aa06

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Memes.exe
Filesize
3.1MB

MD5
5ddcc9baa65b17926f2262a9fe530b93

SHA1
6fa7fd0df2a9928b6c063fc03b10bdcd84e26008

SHA256
9ce882116ae23f4d32f4937f2b61ca8deea0c476be41fdd3158dadc14335a45f

SHA512
79fd0d0ff6115972017fef2c6feeddaf26db86bb69437ca431abd2ba35d4b6c249c7150f3969fd589006b2d3defa674c589610caee5a1585e50f027b06f6aa06

Download Submit
memory/1428-61-0x0000000000F60000-0x0000000001284000-memory.dmp

Filesize
3.1MB

Download
memory/1428-62-0x000000001B610000-0x000000001B690000-memory.dmp

Filesize
512KB

Download
memory/1428-63-0x000000001B610000-0x000000001B690000-memory.dmp

Filesize
512KB

Download
memory/1948-54-0x0000000001020000-0x0000000001344000-memory.dmp

Filesize
3.1MB

Download
memory/1948-55-0x0000000000D80000-0x0000000000E00000-memory.dmp

Filesize
512KB

Download