Malware Analysis Report

2025-01-18 04:30

Sample ID 231223-tsqvjabdb4
Target FCane.exe
SHA256 b2ae8c71e0a9040da348c8d3bf511343fc8c935336c79bb84c224ff8034d951d
Tags
office04 quasar spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b2ae8c71e0a9040da348c8d3bf511343fc8c935336c79bb84c224ff8034d951d

Threat Level: Known bad

The file FCane.exe was found to be: Known bad.

Malicious Activity Summary

office04 quasar spyware trojan

Quasar payload

Quasar family

Quasar RAT

Executes dropped EXE

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-23 16:19

Signatures

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-23 16:19

Reported

2023-12-23 16:22

Platform

win7-20231215-en

Max time kernel

130s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FCane.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\FCane.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\FCane.exe

"C:\Users\Admin\AppData\Local\Temp\FCane.exe"

C:\Windows\system32\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\system32\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

Network

Country Destination Domain Proto
N/A 192.168.0.107:4782 tcp
N/A 192.168.13.1:4782 tcp
N/A 192.168.8.101:4782 tcp
N/A 192.168.0.107:4782 tcp
N/A 192.168.13.1:4782 tcp
N/A 192.168.8.101:4782 tcp

Files

memory/3028-0-0x0000000000060000-0x0000000000384000-memory.dmp

memory/3028-1-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

memory/3028-2-0x000000001ACB0000-0x000000001AD30000-memory.dmp

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

MD5 b45b51072c87df94db667d1016cf274b
SHA1 3c2188740e079bd23375a32a9636e5d5c8e189f0
SHA256 4d5cf8926ae2e22a37359f692ecb40092ea1a4ce781dfad574ef773bb0bf6ec2
SHA512 e1ebb219d30534639d41c4f938540010b2a765e866821453bcc1802ad9308ec514e7489f8b84a34d555a3d2d5d5602ee188db28434ff18ccdfbfbc02e9e61502

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

MD5 18d8af855f8e7c68826b7d7a97e61a19
SHA1 0d20a1da8cce66e4358370d7825eb80a24355fa7
SHA256 8758cbb9a5984c9150b695078d8a426888dffcf5d8297c378212e2e677803985
SHA512 363c536509b1bb902d11ff396293149d1f5abfafa05090d82db8e904079ea2c8ef95d9fc5d4ee0e63cd63b850f60b13c732664bf93abb35cbd6c04da8c8eb6db

memory/2128-8-0x0000000000EC0000-0x00000000011E4000-memory.dmp

memory/3028-9-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

memory/2128-10-0x000000001B290000-0x000000001B310000-memory.dmp

memory/2128-7-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

memory/2128-11-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

memory/2128-12-0x000000001B290000-0x000000001B310000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-23 16:19

Reported

2023-12-23 16:21

Platform

win10v2004-20231215-en

Max time kernel

67s

Max time network

74s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FCane.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\FCane.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\FCane.exe

"C:\Users\Admin\AppData\Local\Temp\FCane.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 19.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
N/A 192.168.0.107:4782 tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
N/A 192.168.13.1:4782 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
PH 23.37.1.217:80 www.microsoft.com tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 217.1.37.23.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
N/A 192.168.8.101:4782 tcp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp

Files

memory/3956-0-0x0000000000BD0000-0x0000000000EF4000-memory.dmp

memory/3956-1-0x00007FFD94720000-0x00007FFD951E1000-memory.dmp

memory/3956-2-0x000000001BDC0000-0x000000001BDD0000-memory.dmp

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

MD5 aae970faedab2169e5fda22a551af3c5
SHA1 365a56f765d7427081b3ae67e4164c52b043770a
SHA256 ec3701fbc582083c57b66d5697fc6abc45ccc04088c4b697b84e91c0854df4d6
SHA512 c3a1161a8dcd6bccf6d51305bb152b33440d9c300a9780b94b2cecc3342db1348e4e1cb2d99ef3423fd6c4cb489c4957de467f721afa4f28c8195ab9f6efb303

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

MD5 760b1ed876b1d18e8863c18629a90c28
SHA1 7413206f112ee88f2001470fa840abe38f91faa7
SHA256 9fcaf7d3e84a9c7297662aa105c0319e72d26685e7902ada5c779f18919babaf
SHA512 d08ec82d213d912f48882395f9fcac6b651187fd17128ff295f619776c313c258fcc86b7e242a552e218dc90fcd6820ecb943617e21b0c208149712f3f1343c9

memory/2008-9-0x00007FFD94720000-0x00007FFD951E1000-memory.dmp

memory/3956-8-0x00007FFD94720000-0x00007FFD951E1000-memory.dmp

memory/2008-10-0x0000000000B10000-0x0000000000B20000-memory.dmp

memory/2008-11-0x000000001BC00000-0x000000001BC50000-memory.dmp

memory/2008-12-0x000000001BD10000-0x000000001BDC2000-memory.dmp

memory/2008-13-0x00007FFD94720000-0x00007FFD951E1000-memory.dmp

memory/2008-14-0x0000000000B10000-0x0000000000B20000-memory.dmp