Malware Analysis Report

2025-01-18 04:31

Sample ID 231230-fwdsgseeh7
Target 0fb77a7f91ccadcee16b1f264b0a53df
SHA256 a323a9891c15a533b2356c710a9610dcd764931b2122404d1278952d6a2611e1
Tags
quasar office04 spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a323a9891c15a533b2356c710a9610dcd764931b2122404d1278952d6a2611e1

Threat Level: Known bad

The file 0fb77a7f91ccadcee16b1f264b0a53df was found to be: Known bad.

Malicious Activity Summary

quasar office04 spyware trojan

Quasar payload

Quasar RAT

Suspicious use of SetThreadContext

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Checks processor information in registry

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-30 05:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-30 05:13

Reported

2024-01-01 00:46

Platform

win7-20231215-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2212 set thread context of 2196 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2212 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 2212 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 2212 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 2212 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 2212 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 2212 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 2212 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 2212 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 2212 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 2196 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2196 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2196 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2196 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe

"C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 388

C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe

C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe

Network

N/A

Files

memory/2212-0-0x0000000074B80000-0x000000007512B000-memory.dmp

memory/2196-2-0x0000000000400000-0x000000000045E000-memory.dmp

memory/2196-10-0x0000000002190000-0x00000000021D0000-memory.dmp

memory/2196-9-0x0000000074B80000-0x000000007512B000-memory.dmp

memory/2980-11-0x0000000002790000-0x0000000002791000-memory.dmp

memory/2212-8-0x0000000074B80000-0x000000007512B000-memory.dmp

memory/2196-7-0x0000000000400000-0x000000000045E000-memory.dmp

memory/2196-5-0x0000000000400000-0x000000000045E000-memory.dmp

memory/2212-3-0x0000000002060000-0x00000000020A0000-memory.dmp

memory/2212-1-0x0000000074B80000-0x000000007512B000-memory.dmp

memory/2196-13-0x0000000002190000-0x00000000021D0000-memory.dmp

memory/2196-12-0x0000000074B80000-0x000000007512B000-memory.dmp

memory/2980-14-0x0000000002790000-0x0000000002791000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-30 05:13

Reported

2024-01-01 00:47

Platform

win10v2004-20231215-en

Max time kernel

146s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3960 set thread context of 1648 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3960 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 3960 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 3960 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 3960 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 3960 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 3960 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 3960 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 3960 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe
PID 1648 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 1648 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 1648 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe

"C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe"

C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe

C:\Users\Admin\AppData\Local\Temp\0fb77a7f91ccadcee16b1f264b0a53df.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 784

Network

Country Destination Domain Proto
US 8.8.8.8:53 19.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 5.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 130.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 174.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 77.239.69.13.in-addr.arpa udp

Files

memory/3960-0-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/3960-1-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/3960-2-0x0000000001A20000-0x0000000001A30000-memory.dmp

memory/1648-3-0x0000000000400000-0x000000000045E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\0fb77a7f91ccadcee16b1f264b0a53df.exe.log

MD5 687357bfbb063545265a73281a2bc5ba
SHA1 ee498b21b89f9f47abd477ff19120f3b9cf43c69
SHA256 23988e78ff35f3785d21d4d7e35336c4b9fea2b550a6252b9e19a460e8963a90
SHA512 49b803bcbe231263eb5c5c188f69180ff56c520bb3021102dbdf731400c16ed3df70b3d3d2832919536c55bddd3a49cdfa26a565d264fe2b8e70d69d8d26a4a5

memory/1648-6-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/3960-7-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/1648-8-0x00000000014D0000-0x00000000014E0000-memory.dmp

memory/1648-9-0x0000000074C60000-0x0000000075211000-memory.dmp

memory/1648-16-0x0000000074C60000-0x0000000075211000-memory.dmp