quasar | 5b3dc5017ab4178e6a056c61ef8e205982bcfa7b7fd8854b82fd4e9aa9d0274d

Resubmissions

22/01/2024, 21:07

240122-zydp2sdhd810

22/01/2024, 19:29

240122-x7dejadbb710

Analysis

max time kernel
1802s
max time network
1808s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Craft_Rise_Hack_Cheat_V1.17.23/Craft_Rise_Cheacker.exe
Size 1.5MB
Sample240122-x7dejadbb7
SHA256 def9ca51ee50b3e34df194b618b5db125712facd64dc4f9ab52d4044348ce36e
MD5 9bf7de62505839e62d84095f16e5f67a
SHA1 543612808cd9e7369007f06f9f57548614b8b320
SHA512 1c50c9947f8d8cbea90acf0ba1e3ef222b135574513f9f12143e761e1f1346cbb2d29a30d17c9ab2b66b79949419bbdcd8b1053ad8702d2e81642a7ce29d43dd
SSDEEP 24576:jEKdAe4q1cdYlqS5wjlq0cnHFl0oegbCmjZiwLGlaLPR7i+lRx+dCxOvuw7G3tHG:7dAK8SuY0cnHH0oVTjBClYpOyRxPy7GQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

139.180.171.110:22766

Mutex

559c79bc-4c64-4106-a5ab-e40703620b71

Attributes

encryption_key
9C52BAC3CB66706D47E06069A5809DE8E12F205F
install_name
System32.exe
log_directory
Logs
reconnect_delay
3000
startup_key
System32
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

resource	yara_rule
behavioral3/files/0x000a000000023000-18.dat	family_quasar
behavioral3/memory/1708-27-0x0000000000280000-0x00000000005A4000-memory.dmp	family_quasar
behavioral3/files/0x0006000000023116-33.dat	family_quasar
behavioral3/files/0x0006000000023116-35.dat	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	Craft_Rise_Cheacker.exe

Executes dropped EXE 3 IoCs

pid	Process
2608	Valo_Cheat_V1.89.413.exe
1708	System32.exe
3176	System32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1580	schtasks.exe
4772	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	System32.exe
Token: SeDebugPrivilege	3176	System32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3176	System32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2608	2108	Craft_Rise_Cheacker.exe	86
PID 2108 wrote to memory of 2608	2108	Craft_Rise_Cheacker.exe	86
PID 2108 wrote to memory of 1708	2108	Craft_Rise_Cheacker.exe	87
PID 2108 wrote to memory of 1708	2108	Craft_Rise_Cheacker.exe	87
PID 1708 wrote to memory of 1580	1708	System32.exe	88
PID 1708 wrote to memory of 1580	1708	System32.exe	88
PID 1708 wrote to memory of 3176	1708	System32.exe	90
PID 1708 wrote to memory of 3176	1708	System32.exe	90
PID 3176 wrote to memory of 4772	3176	System32.exe	93
PID 3176 wrote to memory of 4772	3176	System32.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Craft_Rise_Hack_Cheat_V1.17.23\Craft_Rise_Cheacker.exe
"C:\Users\Admin\AppData\Local\Temp\Craft_Rise_Hack_Cheat_V1.17.23\Craft_Rise_Cheacker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Roaming\Valo_Cheat_V1.89.413.exe
  "C:\Users\Admin\AppData\Roaming\Valo_Cheat_V1.89.413.exe"
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\ProgramData\System32.exe
  "C:\ProgramData\System32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "System32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\System32.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1580
- - C:\Users\Admin\AppData\Roaming\SubDir\System32.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\System32.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "System32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\System32.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System32.exe

Path C:\ProgramData\System32.exe
Size 3.1MB
SHA256 d5eb16ca9cc58940c5ba41759552add0d6699632b12318db39a50670b4b8161a
MD5 d5c97a09da98478c9b5d74dc037e0121
SHA1 1c1223b900d0a256cc219bec07d00cca8084e2cf
SHA512 53f3b344fd437d8ef84e4d3187a0e9004ee6a6f212f68b29f875f56930d687e56b8f92a3f53dcac2efb78a13fb69f10781b2e8331a50c7cb97f1b1a8c9569c90
SSDEEP 49152:evkt62XlaSFNWPjljiFa2RoUYIWCRJ6ibR3LoGdRCTHHB72eh2NT:ev462XlaSFNWPjljiFXRoUYIWCRJ6cB
MD5 SHA1 SHA512 SSDEEP

Submit Download

System32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System32.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

System32.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\System32.exe
Size 1.2MB
SHA256 24b8169314dc91df109a257b34fd880413966f6abc1b0c67c074fffe96bd8b27
MD5 2cd4bbb4da9e42b9822964a3c835cb5d
SHA1 95705ff9d7fff9b15e005c27e356d43de1f82aa4
SHA512 0dbf5bf638cdf9bb6d0730252e29d297c395a9a450aca2c8500fb246c0b44b803faf1bbb8ece754d2bde1850e7e9928f200011745e882045c32b8b6f396f6e11
SSDEEP 24576:evbotTaHX2XaSaSFNNgPjluEiFFo2AKoUX3YL:evkt62XlaSFNWPjljiFa2RoUYL
MD5 SHA1 SHA512 SSDEEP

Submit Download

System32.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\System32.exe
Size 1.9MB
SHA256 e01e17168e070ed6d869581a5a064c2fbebc0bc7babdc19a4c5064e8cdf3c724
MD5 787faf8a0f7a501cbb2c2c1f91b66eab
SHA1 c6c52f26f27b4019e6c75a7ed1aac4cb67582512
SHA512 baa20cd3878a7e8ad67b228aca3c0f68600563e7eb4fad2921319641379c85a5999efabba257032027aa0cf07bad0757ea4d526eab4929ab3e3aa52ba14a8a4f
SSDEEP 24576:evbotTaHX2XaSaSFNNgPjluEiFFo2AKoUX3Y3YN3qdlv+jWYDRRN:evkt62XlaSFNWPjljiFa2RoUYIWCRN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Valo_Cheat_V1.89.413.exe

Path C:\Users\Admin\AppData\Roaming\Valo_Cheat_V1.89.413.exe
Size 146KB
SHA256 5fd835db939307a0c43d18c702804d50c3ea5ea124f1e714edb82fa6ccaba214
MD5 37c8a9cc5370e6aff4ee7253a8c4ae53
SHA1 7c458906cbbe5c40aea13bf63d616e9c35dfc1cf
SHA512 3922097d78fe2a7a661c8dd78fca1a9fabe3c1dba0e17563c4589128440ffbb3db7ef09ffd3666aac268a9988325aa47e39b346e8570662f3668170c1e692fcd
SSDEEP 3072:wczkitvo4BpYN/6mBPry8TXROLdW5m4mURs9OOGX0kx:wA4NCmBPry/N24OOC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1708-29-0x000000001B2F0000-0x000000001B300000-memory.dmp

Download

memory/1708-27-0x0000000000280000-0x00000000005A4000-memory.dmp

Download

memory/1708-28-0x00007FF9774C0000-0x00007FF977F81000-memory.dmp

Download

memory/1708-38-0x00007FF9774C0000-0x00007FF977F81000-memory.dmp

Download

memory/2108-0-0x0000000074C80000-0x0000000075231000-memory.dmp

Download

memory/2108-26-0x0000000074C80000-0x0000000075231000-memory.dmp

Download

memory/2108-2-0x0000000001930000-0x0000000001940000-memory.dmp

Download

memory/2108-1-0x0000000074C80000-0x0000000075231000-memory.dmp

Download

memory/3176-37-0x00007FF9774C0000-0x00007FF977F81000-memory.dmp

Download

memory/3176-39-0x000000001B5F0000-0x000000001B600000-memory.dmp

Download

memory/3176-40-0x000000001B590000-0x000000001B5E0000-memory.dmp

Download

memory/3176-41-0x000000001BE10000-0x000000001BEC2000-memory.dmp

Download

memory/3176-42-0x00007FF9774C0000-0x00007FF977F81000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads