quasar | 4e6e48275b1f3412edc045e1a81d509ddcfe360c06bdd4483fcd5b4fc77b7ef3

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 08:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 3.1MB
Sample240122-kge48accdn
SHA256 4e6e48275b1f3412edc045e1a81d509ddcfe360c06bdd4483fcd5b4fc77b7ef3
MD5 5d93b7f3a4c9ce4c09856f416d564b1e
SHA1 7daf1e1b38741f4bdc9f9b4cef8b249fb8bd8422
SHA512 9afa66896cf33a9c77e55650668ffe2fadb01f893721c31eecb06b44e0099f9153d2d0160ba1f59b358f4ade347c72652e1c0f4502ff28af8f21de677c8d71dc
SSDEEP 49152:SvyI22SsaNYfdPBldt698dBcjHkIRJ6kbR3LoGdfCTHHB72eh2NT:Svf22SsaNYfdPBldt6+dBcjHkIRJ6u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.99.110:1234

Mutex

5c4c76ec-d876-4460-a1c2-968301016566

Attributes

encryption_key
DC1BC720780098E2E7EE679576CF3FD45D13DD0A
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

resource	yara_rule
behavioral1/memory/2932-0-0x0000000000270000-0x0000000000594000-memory.dmp	family_quasar
behavioral1/files/0x00090000000147f1-7.dat	family_quasar
behavioral1/files/0x00090000000147f1-6.dat	family_quasar
behavioral1/memory/2348-8-0x0000000001170000-0x0000000001494000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2348	Client.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2196	schtasks.exe
2240	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	Client.exe
Token: SeDebugPrivilege	2348	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2348	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2196	2932	Client.exe	29
PID 2932 wrote to memory of 2196	2932	Client.exe	29
PID 2932 wrote to memory of 2196	2932	Client.exe	29
PID 2932 wrote to memory of 2348	2932	Client.exe	30
PID 2932 wrote to memory of 2348	2932	Client.exe	30
PID 2932 wrote to memory of 2348	2932	Client.exe	30
PID 2348 wrote to memory of 2240	2348	Client.exe	32
PID 2348 wrote to memory of 2240	2348	Client.exe	32
PID 2348 wrote to memory of 2240	2348	Client.exe	32

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2196
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 664KB
SHA256 c0494809f75915f50a7acd3a436c6300b36e7920202ead93508b20f795a900db
MD5 6c7fac0d75b09cd40eb0ead14d67d1fe
SHA1 1f24294bdb85aba2cda24499372364c0d2ec32cd
SHA512 29739ca4ea702b38a01d56a32bf7d54dbacc3fb663846370c304563fcb7b4f4f7af89ac708a97ebb9576d69bb6871374d5ffbeed2f7c8ba4ea4b3d9dc9b6706e
SSDEEP 12288:UvgMzKMZSg5y3Dx59tOGPxf5C5i4Wd95D2Inhsygq:SvApIA4Wnh2Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 501KB
SHA256 f6fa3302c722374defa59f63daba19336431cdf4f6e2feed5634d61799641960
MD5 369b77a381559e759680da37ada2cf73
SHA1 2bea921a646c0ae3f60ea436bfc4a0ea57e3bd64
SHA512 c398ec78479249ee4e36389e466bd3652fad8007c6942cfc985888d3e9bbc99ce45c4d57a998ffb1a7b9509c2c80ef435677a67625788c75fbd843cc0a4d6104
SSDEEP 12288:UvgMzKMZSg5y3Dx59tOGPxf5C5i4Wd95v:SvApIA4WnN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2348-8-0x0000000001170000-0x0000000001494000-memory.dmp

Download

memory/2348-10-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Download

memory/2348-11-0x000000001B150000-0x000000001B1D0000-memory.dmp

Download

memory/2348-12-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Download

memory/2932-0-0x0000000000270000-0x0000000000594000-memory.dmp

Download

memory/2932-1-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Download

memory/2932-2-0x0000000000690000-0x0000000000710000-memory.dmp

Download

memory/2932-9-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads