quasar | ec5f46d31e3640082deea41ecd1ec3977376737db0a044e9ffb9f3fece8dcb82

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2023, 13:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Valorant Coin Hack (2).exe
Size 4.5MB
Sample230717-qbhwtacg2x
SHA256 ec5f46d31e3640082deea41ecd1ec3977376737db0a044e9ffb9f3fece8dcb82
MD5 576ff204d9896ca30bfcce09b672470d
SHA1 c6a8d74f5ad6c058d27588404411d062850c2157
SHA512 f5688d86b79883d480d074f0a8de5e9d0cc9ab94bad256a8ec2a1d342a08e2077c7526c0d6d103ecdbf7a92959815b780ae8cf9e45b88f00c44c48dedc291c80
SSDEEP 98304:FusihuInm4o46YDGngBDQkAiY0mf0dZl:Fuvuym4olZuDQkA29
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar kurban spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Kurban

mamitox.duckdns.org:1604

Mutex

a9674f8e-a278-4ef8-9966-cd33fd932b84

Attributes

encryption_key
003D20CB377AA334B523ED02DFFB8D8D91D26B3C
install_name
Valorant Coin Hack.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/2952-136-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar

Executes dropped EXE 6 IoCs

pid	Process
3452	Valorant Coin Hack.exe
4224	Valorant Coin Hack.exe
3556	Valorant Coin Hack.exe
3916	Valorant Coin Hack.exe
3192	Valorant Coin Hack.exe
4888	Valorant Coin Hack.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe	Valorant Coin Hack (2).exe
File opened for modification	C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe	Valorant Coin Hack (2).exe
File created	C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe	Valorant Coin Hack.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3780 set thread context of 2952	3780	Valorant Coin Hack (2).exe	87
PID 3452 set thread context of 4888	3452	Valorant Coin Hack.exe	95

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3780	Valorant Coin Hack (2).exe
3780	Valorant Coin Hack (2).exe
3452	Valorant Coin Hack.exe
3452	Valorant Coin Hack.exe
3452	Valorant Coin Hack.exe
3452	Valorant Coin Hack.exe
3452	Valorant Coin Hack.exe
3452	Valorant Coin Hack.exe
3452	Valorant Coin Hack.exe
3452	Valorant Coin Hack.exe
4888	Valorant Coin Hack.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3780	Valorant Coin Hack (2).exe
Token: SeDebugPrivilege	2952	Valorant Coin Hack (2).exe
Token: SeDebugPrivilege	3452	Valorant Coin Hack.exe
Token: SeDebugPrivilege	4888	Valorant Coin Hack.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 1888	3780	Valorant Coin Hack (2).exe	86
PID 3780 wrote to memory of 1888	3780	Valorant Coin Hack (2).exe	86
PID 3780 wrote to memory of 1888	3780	Valorant Coin Hack (2).exe	86
PID 3780 wrote to memory of 2952	3780	Valorant Coin Hack (2).exe	87
PID 3780 wrote to memory of 2952	3780	Valorant Coin Hack (2).exe	87
PID 3780 wrote to memory of 2952	3780	Valorant Coin Hack (2).exe	87
PID 3780 wrote to memory of 2952	3780	Valorant Coin Hack (2).exe	87
PID 3780 wrote to memory of 2952	3780	Valorant Coin Hack (2).exe	87
PID 3780 wrote to memory of 2952	3780	Valorant Coin Hack (2).exe	87
PID 3780 wrote to memory of 2952	3780	Valorant Coin Hack (2).exe	87
PID 3780 wrote to memory of 2952	3780	Valorant Coin Hack (2).exe	87
PID 2952 wrote to memory of 3452	2952	Valorant Coin Hack (2).exe	89
PID 2952 wrote to memory of 3452	2952	Valorant Coin Hack (2).exe	89
PID 2952 wrote to memory of 3452	2952	Valorant Coin Hack (2).exe	89
PID 3452 wrote to memory of 4224	3452	Valorant Coin Hack.exe	93
PID 3452 wrote to memory of 4224	3452	Valorant Coin Hack.exe	93
PID 3452 wrote to memory of 4224	3452	Valorant Coin Hack.exe	93
PID 3452 wrote to memory of 3556	3452	Valorant Coin Hack.exe	94
PID 3452 wrote to memory of 3556	3452	Valorant Coin Hack.exe	94
PID 3452 wrote to memory of 3556	3452	Valorant Coin Hack.exe	94
PID 3452 wrote to memory of 3916	3452	Valorant Coin Hack.exe	97
PID 3452 wrote to memory of 3916	3452	Valorant Coin Hack.exe	97
PID 3452 wrote to memory of 3916	3452	Valorant Coin Hack.exe	97
PID 3452 wrote to memory of 3192	3452	Valorant Coin Hack.exe	96
PID 3452 wrote to memory of 3192	3452	Valorant Coin Hack.exe	96
PID 3452 wrote to memory of 3192	3452	Valorant Coin Hack.exe	96
PID 3452 wrote to memory of 4888	3452	Valorant Coin Hack.exe	95
PID 3452 wrote to memory of 4888	3452	Valorant Coin Hack.exe	95
PID 3452 wrote to memory of 4888	3452	Valorant Coin Hack.exe	95
PID 3452 wrote to memory of 4888	3452	Valorant Coin Hack.exe	95
PID 3452 wrote to memory of 4888	3452	Valorant Coin Hack.exe	95
PID 3452 wrote to memory of 4888	3452	Valorant Coin Hack.exe	95
PID 3452 wrote to memory of 4888	3452	Valorant Coin Hack.exe	95
PID 3452 wrote to memory of 4888	3452	Valorant Coin Hack.exe	95

C:\Users\Admin\AppData\Local\Temp\Valorant Coin Hack (2).exe
"C:\Users\Admin\AppData\Local\Temp\Valorant Coin Hack (2).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Users\Admin\AppData\Local\Temp\Valorant Coin Hack (2).exe
  "C:\Users\Admin\AppData\Local\Temp\Valorant Coin Hack (2).exe"
  2⤵
  PID:1888
- C:\Users\Admin\AppData\Local\Temp\Valorant Coin Hack (2).exe
  "C:\Users\Admin\AppData\Local\Temp\Valorant Coin Hack (2).exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe
    "C:\Windows\system32\SubDir\Valorant Coin Hack.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe
      "C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe"
      4⤵
      Executes dropped EXE
      PID:4224
  - - C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe
      "C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe"
      4⤵
      Executes dropped EXE
      PID:3556
  - - C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe
      "C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4888
  - - C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe
      "C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe"
      4⤵
      Executes dropped EXE
      PID:3192
  - - C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe
      "C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe"
      4⤵
      Executes dropped EXE
      PID:3916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Valorant Coin Hack (2).exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Valorant Coin Hack (2).exe.log
Size 226B
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
MD5 SHA1 SHA512

Submit Download

Valorant Coin Hack.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Valorant Coin Hack.exe.log
Size 226B
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
MD5 SHA1 SHA512

Submit Download

Valorant Coin Hack.exe

Path C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe
Size 4.5MB
SHA256 ec5f46d31e3640082deea41ecd1ec3977376737db0a044e9ffb9f3fece8dcb82
MD5 576ff204d9896ca30bfcce09b672470d
SHA1 c6a8d74f5ad6c058d27588404411d062850c2157
SHA512 f5688d86b79883d480d074f0a8de5e9d0cc9ab94bad256a8ec2a1d342a08e2077c7526c0d6d103ecdbf7a92959815b780ae8cf9e45b88f00c44c48dedc291c80
SSDEEP 98304:FusihuInm4o46YDGngBDQkAiY0mf0dZl:Fuvuym4olZuDQkA29
MD5 SHA1 SHA512 SSDEEP

Submit Download

Valorant Coin Hack.exe

Path C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe
Size 4.5MB
SHA256 ec5f46d31e3640082deea41ecd1ec3977376737db0a044e9ffb9f3fece8dcb82
MD5 576ff204d9896ca30bfcce09b672470d
SHA1 c6a8d74f5ad6c058d27588404411d062850c2157
SHA512 f5688d86b79883d480d074f0a8de5e9d0cc9ab94bad256a8ec2a1d342a08e2077c7526c0d6d103ecdbf7a92959815b780ae8cf9e45b88f00c44c48dedc291c80
SSDEEP 98304:FusihuInm4o46YDGngBDQkAiY0mf0dZl:Fuvuym4olZuDQkA29
MD5 SHA1 SHA512 SSDEEP

Submit Download

Valorant Coin Hack.exe

Path C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe
Size 4.5MB
SHA256 ec5f46d31e3640082deea41ecd1ec3977376737db0a044e9ffb9f3fece8dcb82
MD5 576ff204d9896ca30bfcce09b672470d
SHA1 c6a8d74f5ad6c058d27588404411d062850c2157
SHA512 f5688d86b79883d480d074f0a8de5e9d0cc9ab94bad256a8ec2a1d342a08e2077c7526c0d6d103ecdbf7a92959815b780ae8cf9e45b88f00c44c48dedc291c80
SSDEEP 98304:FusihuInm4o46YDGngBDQkAiY0mf0dZl:Fuvuym4olZuDQkA29
MD5 SHA1 SHA512 SSDEEP

Submit Download

Valorant Coin Hack.exe

Path C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe
Size 4.5MB
SHA256 ec5f46d31e3640082deea41ecd1ec3977376737db0a044e9ffb9f3fece8dcb82
MD5 576ff204d9896ca30bfcce09b672470d
SHA1 c6a8d74f5ad6c058d27588404411d062850c2157
SHA512 f5688d86b79883d480d074f0a8de5e9d0cc9ab94bad256a8ec2a1d342a08e2077c7526c0d6d103ecdbf7a92959815b780ae8cf9e45b88f00c44c48dedc291c80
SSDEEP 98304:FusihuInm4o46YDGngBDQkAiY0mf0dZl:Fuvuym4olZuDQkA29
MD5 SHA1 SHA512 SSDEEP

Submit Download

Valorant Coin Hack.exe

Path C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe
Size 4.5MB
SHA256 ec5f46d31e3640082deea41ecd1ec3977376737db0a044e9ffb9f3fece8dcb82
MD5 576ff204d9896ca30bfcce09b672470d
SHA1 c6a8d74f5ad6c058d27588404411d062850c2157
SHA512 f5688d86b79883d480d074f0a8de5e9d0cc9ab94bad256a8ec2a1d342a08e2077c7526c0d6d103ecdbf7a92959815b780ae8cf9e45b88f00c44c48dedc291c80
SSDEEP 98304:FusihuInm4o46YDGngBDQkAiY0mf0dZl:Fuvuym4olZuDQkA29
MD5 SHA1 SHA512 SSDEEP

Submit Download

Valorant Coin Hack.exe

Path C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe
Size 4.5MB
SHA256 ec5f46d31e3640082deea41ecd1ec3977376737db0a044e9ffb9f3fece8dcb82
MD5 576ff204d9896ca30bfcce09b672470d
SHA1 c6a8d74f5ad6c058d27588404411d062850c2157
SHA512 f5688d86b79883d480d074f0a8de5e9d0cc9ab94bad256a8ec2a1d342a08e2077c7526c0d6d103ecdbf7a92959815b780ae8cf9e45b88f00c44c48dedc291c80
SSDEEP 98304:FusihuInm4o46YDGngBDQkAiY0mf0dZl:Fuvuym4olZuDQkA29
MD5 SHA1 SHA512 SSDEEP

Submit Download

Valorant Coin Hack.exe

Path C:\Windows\SysWOW64\SubDir\Valorant Coin Hack.exe
Size 4.5MB
SHA256 ec5f46d31e3640082deea41ecd1ec3977376737db0a044e9ffb9f3fece8dcb82
MD5 576ff204d9896ca30bfcce09b672470d
SHA1 c6a8d74f5ad6c058d27588404411d062850c2157
SHA512 f5688d86b79883d480d074f0a8de5e9d0cc9ab94bad256a8ec2a1d342a08e2077c7526c0d6d103ecdbf7a92959815b780ae8cf9e45b88f00c44c48dedc291c80
SSDEEP 98304:FusihuInm4o46YDGngBDQkAiY0mf0dZl:Fuvuym4olZuDQkA29
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2952-136-0x0000000000400000-0x0000000000724000-memory.dmp

Download

memory/2952-144-0x0000000005B50000-0x0000000005B5A000-memory.dmp

Download

memory/2952-139-0x00000000752D0000-0x0000000075A80000-memory.dmp

Download

memory/2952-143-0x0000000005BD0000-0x0000000005BE0000-memory.dmp

Download

memory/2952-149-0x00000000752D0000-0x0000000075A80000-memory.dmp

Download

memory/2952-142-0x0000000005BE0000-0x0000000005C72000-memory.dmp

Download

memory/2952-141-0x00000000060D0000-0x0000000006674000-memory.dmp

Download

memory/3452-150-0x00000000752D0000-0x0000000075A80000-memory.dmp

Download

memory/3452-151-0x0000000005030000-0x0000000005040000-memory.dmp

Download

memory/3452-161-0x00000000752D0000-0x0000000075A80000-memory.dmp

Download

memory/3780-135-0x0000000005D80000-0x0000000005D90000-memory.dmp

Download

memory/3780-133-0x00000000752D0000-0x0000000075A80000-memory.dmp

Download

memory/3780-134-0x0000000000C80000-0x000000000110E000-memory.dmp

Download

memory/3780-140-0x00000000752D0000-0x0000000075A80000-memory.dmp

Download

memory/4888-160-0x00000000752D0000-0x0000000075A80000-memory.dmp

Download

memory/4888-162-0x0000000005820000-0x0000000005830000-memory.dmp

Download

memory/4888-163-0x00000000752D0000-0x0000000075A80000-memory.dmp

Download

memory/4888-164-0x0000000005820000-0x0000000005830000-memory.dmp

Download