quasar | 5b3dc5017ab4178e6a056c61ef8e205982bcfa7b7fd8854b82fd4e9aa9d0274d

Resubmissions

22/01/2024, 21:07

240122-zydp2sdhd810

22/01/2024, 19:29

240122-x7dejadbb710

Analysis

max time kernel
1797s
max time network
1807s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
22/01/2024, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Craft_Rise_Hack_Cheat_V1.17.23/Craft_Rise_Cheacker.exe
Size 1.5MB
Sample240122-x7dejadbb7
SHA256 def9ca51ee50b3e34df194b618b5db125712facd64dc4f9ab52d4044348ce36e
MD5 9bf7de62505839e62d84095f16e5f67a
SHA1 543612808cd9e7369007f06f9f57548614b8b320
SHA512 1c50c9947f8d8cbea90acf0ba1e3ef222b135574513f9f12143e761e1f1346cbb2d29a30d17c9ab2b66b79949419bbdcd8b1053ad8702d2e81642a7ce29d43dd
SSDEEP 24576:jEKdAe4q1cdYlqS5wjlq0cnHFl0oegbCmjZiwLGlaLPR7i+lRx+dCxOvuw7G3tHG:7dAK8SuY0cnHH0oVTjBClYpOyRxPy7GQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

139.180.171.110:22766

Mutex

559c79bc-4c64-4106-a5ab-e40703620b71

Attributes

encryption_key
9C52BAC3CB66706D47E06069A5809DE8E12F205F
install_name
System32.exe
log_directory
Logs
reconnect_delay
3000
startup_key
System32
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

resource	yara_rule
behavioral4/files/0x0002000000029e8a-18.dat	family_quasar
behavioral4/files/0x0002000000029e8a-24.dat	family_quasar
behavioral4/files/0x0002000000029e8a-23.dat	family_quasar
behavioral4/memory/2120-27-0x0000000000FA0000-0x00000000012C4000-memory.dmp	family_quasar
behavioral4/files/0x000100000002a7d3-35.dat	family_quasar
behavioral4/files/0x000100000002a7d3-33.dat	family_quasar

Executes dropped EXE 3 IoCs

pid	Process
2036	Valo_Cheat_V1.89.413.exe
2120	System32.exe
3672	System32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2776	schtasks.exe
3296	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2120	System32.exe
Token: SeDebugPrivilege	3672	System32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3672	System32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 2036	3396	Craft_Rise_Cheacker.exe	80
PID 3396 wrote to memory of 2036	3396	Craft_Rise_Cheacker.exe	80
PID 3396 wrote to memory of 2120	3396	Craft_Rise_Cheacker.exe	81
PID 3396 wrote to memory of 2120	3396	Craft_Rise_Cheacker.exe	81
PID 2120 wrote to memory of 2776	2120	System32.exe	83
PID 2120 wrote to memory of 2776	2120	System32.exe	83
PID 2120 wrote to memory of 3672	2120	System32.exe	84
PID 2120 wrote to memory of 3672	2120	System32.exe	84
PID 3672 wrote to memory of 3296	3672	System32.exe	86
PID 3672 wrote to memory of 3296	3672	System32.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Craft_Rise_Hack_Cheat_V1.17.23\Craft_Rise_Cheacker.exe
"C:\Users\Admin\AppData\Local\Temp\Craft_Rise_Hack_Cheat_V1.17.23\Craft_Rise_Cheacker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\AppData\Roaming\Valo_Cheat_V1.89.413.exe
  "C:\Users\Admin\AppData\Roaming\Valo_Cheat_V1.89.413.exe"
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\ProgramData\System32.exe
  "C:\ProgramData\System32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "System32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\System32.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2776
- - C:\Users\Admin\AppData\Roaming\SubDir\System32.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\System32.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "System32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\System32.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:3296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System32.exe

Path C:\ProgramData\System32.exe
Size 2.2MB
SHA256 247971566a4565740df5a83aeff0c214ced66f51cc6478d24ff7209586889914
MD5 1d04ed71600abb00060dc1c84313f32d
SHA1 4578cc3efa71e886bec732a27e8bba1461c66b5a
SHA512 07da193344dcca9996e5e5e3836fd345eccf93b761a5bd4ca6685bff8bf2c03af77de17a855c264108a2308fbacaa30691cd10d3f60cb6cd692101ea253ec4bb
SSDEEP 24576:evbotTaHX2XaSaSFNNgPjluEiFFo2AKoUX3Y3YN3qdlv+jWYDRR3H56J:evkt62XlaSFNWPjljiFa2RoUYIWCRJ6J
MD5 SHA1 SHA512 SSDEEP

Submit Download

System32.exe

Path C:\ProgramData\System32.exe
Size 2.1MB
SHA256 f76d72a7706a5e68cc82d7b16cc67499cf98f4b7a75621e5f0e141f1431b4393
MD5 4a103d53e33f1306fa93725df15bc3e8
SHA1 dd553ad3265f052ec8490dd7289d0d8e550f25f3
SHA512 5c697e1557ea5d0421a2d0104f3b8a0357931637206f9cdc2d07878c984f4a7bf9be2ec498d5d2e62e81ce227c3b9100fe460868a02cb776229b06a81301990c
SSDEEP 24576:evbotTaHX2XaSaSFNNgPjluEiFFo2AKoUX3Y3YN3qdlv+jWYDRR3H56q:evkt62XlaSFNWPjljiFa2RoUYIWCRJ6q
MD5 SHA1 SHA512 SSDEEP

Submit Download

System32.exe

Path C:\ProgramData\System32.exe
Size 1.7MB
SHA256 57dc1f8b6509dcba0a07e2c6f17e39913d85c98fe9a3b6b33d1d01787c28c984
MD5 1688fb9aa2976860948489626e7bdde2
SHA1 c7d1bf9896640b4586e8c305c97746bf61034a81
SHA512 3198bdf38b1e789e935c89cb0b3257cd36907594a78fa0d805ae0081df5c38b033f58724bc488baa0fcb57f1ec5ba01e35eb4422b8c3fb39b5f69539c883e27d
SSDEEP 24576:evbotTaHX2XaSaSFNNgPjluEiFFo2AKoUX3Y3YN3qdlv+ji:evkt62XlaSFNWPjljiFa2RoUYIWL
MD5 SHA1 SHA512 SSDEEP

Submit Download

System32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System32.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
MD5 SHA1 SHA512

Submit Download

System32.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\System32.exe
Size 1.0MB
SHA256 06f3ac680c3d4828dea7b52321687c44d799f3aff3db4366234579cfd7604ea2
MD5 168419f75677b8fe98fb16e6357b19e2
SHA1 0725a1dbf0f8426a54e2abdf1685feedcbf55220
SHA512 dc5c50d667799acee8b5b0bcea76c54887ed9dcf3dffb7be1c8fc65b348fca39bf56f124ab5930ac62e8fccaf0fef7e5e4c0f519325e4567644fff0e126e11a9
SSDEEP 12288:AvgMzKMZLLNbWHi2EIlOnefLBCmaquy+2gnF3C/kcPkPfSaSFN+8gPjluEiFFo26:evbotTaHX2XaSaSFNNgPjluEiFFo2At
MD5 SHA1 SHA512 SSDEEP

Submit Download

System32.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\System32.exe
Size 811KB
SHA256 f81d5eb8015cea7f69efbc55ecf5a2e3caee7334a13e6e6d02cba0880e467bf6
MD5 f058708850c1761760b863fc88fa0bf5
SHA1 43adb521e0817a905e2e75431cc14c10df4ce992
SHA512 9f16b7a6a1b80fcf652da50436e374468904685854968bfae101dcf0486ede35c8647b91d5f22a714b63ee9e672749c5368fd2a35e2da9cdf7179aa4b74bcdf6
SSDEEP 12288:AvgMzKMZLLNbWHi2EIlOnefLBCmaquy+2gnF3C/kcPkA:evbotTaHX2Xj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Valo_Cheat_V1.89.413.exe

Path C:\Users\Admin\AppData\Roaming\Valo_Cheat_V1.89.413.exe
Size 146KB
SHA256 5fd835db939307a0c43d18c702804d50c3ea5ea124f1e714edb82fa6ccaba214
MD5 37c8a9cc5370e6aff4ee7253a8c4ae53
SHA1 7c458906cbbe5c40aea13bf63d616e9c35dfc1cf
SHA512 3922097d78fe2a7a661c8dd78fca1a9fabe3c1dba0e17563c4589128440ffbb3db7ef09ffd3666aac268a9988325aa47e39b346e8570662f3668170c1e692fcd
SSDEEP 3072:wczkitvo4BpYN/6mBPry8TXROLdW5m4mURs9OOGX0kx:wA4NCmBPry/N24OOC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2120-29-0x000000001C0E0000-0x000000001C0F0000-memory.dmp

Download

memory/2120-27-0x0000000000FA0000-0x00000000012C4000-memory.dmp

Download

memory/2120-28-0x00007FFAD6B20000-0x00007FFAD75E2000-memory.dmp

Download

memory/2120-37-0x00007FFAD6B20000-0x00007FFAD75E2000-memory.dmp

Download

memory/3396-0-0x0000000074A60000-0x0000000075011000-memory.dmp

Download

memory/3396-26-0x0000000074A60000-0x0000000075011000-memory.dmp

Download

memory/3396-2-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

Download

memory/3396-1-0x0000000074A60000-0x0000000075011000-memory.dmp

Download

memory/3672-38-0x00007FFAD6B20000-0x00007FFAD75E2000-memory.dmp

Download

memory/3672-39-0x000000001BD80000-0x000000001BD90000-memory.dmp

Download

memory/3672-40-0x00000000031E0000-0x0000000003230000-memory.dmp

Download

memory/3672-41-0x000000001C550000-0x000000001C602000-memory.dmp

Download

memory/3672-42-0x00007FFAD6B20000-0x00007FFAD75E2000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads