quasar | 05beec4f23efa88995a5a91ff292bc824714ad940c785cdf7d4d5686a0ed3692

Analysis

max time kernel
54s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2024, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
npx.exe
Size 3.1MB
Sample240218-y2vx3aeb7y
SHA256 05beec4f23efa88995a5a91ff292bc824714ad940c785cdf7d4d5686a0ed3692
MD5 f4ecc70cd338a77d5fa868ef4fe95879
SHA1 ead0d3fb5ccd1b4eb408f3647130bdec72c4d57c
SHA512 fac1b634a917589ca8c807ab7cb3d849a6f170dcc930cb02e16cf99b2ca01133feffec78fdbdb4a9348e3b5bd15eb4a409e8a44d31e58685188ff1e1c74719ab
SSDEEP 49152:3v+lL26AaNeWgPhlmVqvMQ7XSKEfHNmzoloGdYDITHHB72eh2NT:3vuL26AaNeWgPhlmVqkQ7XSKEfHDoD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

panpoppo-35085.portmap.io:35085

Mutex

4c66ad2a-cec5-494c-85df-288c69f5c3e9

Attributes

encryption_key
D0E82A17B54C1504BBAFF49C5F025FB5AA2144B6
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral2/memory/4480-0-0x0000000000380000-0x00000000006A4000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023107-6.dat	family_quasar
behavioral2/files/0x0007000000023107-7.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
4340	Client.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1584	schtasks.exe
4192	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	npx.exe
Token: SeDebugPrivilege	4340	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4340	Client.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 1584	4480	npx.exe	84
PID 4480 wrote to memory of 1584	4480	npx.exe	84
PID 4480 wrote to memory of 4340	4480	npx.exe	86
PID 4480 wrote to memory of 4340	4480	npx.exe	86
PID 4340 wrote to memory of 4192	4340	Client.exe	87
PID 4340 wrote to memory of 4192	4340	Client.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\npx.exe
"C:\Users\Admin\AppData\Local\Temp\npx.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1584
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 2.4MB
SHA256 1231402184f3eeea94584aedf8c2a1c36674f61b1eb7ae5f19f09447d8460d6a
MD5 b10af6ca2303f89cd46b1b014471e3c3
SHA1 248c0ea02127e8e89068e966c018e9b3918a52d0
SHA512 f18cf9275bca52b4291dc5b5bd6d6eef03186526b2f9e239cd364fb531d0180cb04eafa489f17cb480f680043a35e625687ac07b0e6bb31ca56a454ebff187b7
SSDEEP 49152:3v+lL26AaNeWgPhlmVqvMQ7XSKEfHNmzo6:3vuL26AaNeWgPhlmVqkQ7XSKEfHs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 2.0MB
SHA256 d7fb716c4eb6b921d680d42ea2cf57cf2e0966c29d6d35648ed398a9eee0f671
MD5 43d5accb91957af995ccb4736087ba70
SHA1 135fe2af28ad5c7b4e282f62b33ba425acb0fe5c
SHA512 cd79c480e4f459b8d2239751757cc88f9f568cdd66ad7665e4706f9ad5f803487ae7bc8414951998f50bb8f3ec5e8e7bdfe738caa873863af07883b8918f83da
SSDEEP 24576:3v3ul7z7lDnZ+C26+faNeWyzPhleVVq3/MY37XR38jeN3qYzVr+isYbp2HSU:3v+lL26AaNeWgPhlmVqvMQ7XSKEfHx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4340-9-0x00007FFC19600000-0x00007FFC1A0C1000-memory.dmp

Download

memory/4340-11-0x0000000000E60000-0x0000000000E70000-memory.dmp

Download

memory/4340-12-0x000000001B940000-0x000000001B990000-memory.dmp

Download

memory/4340-13-0x000000001BA50000-0x000000001BB02000-memory.dmp

Download

memory/4340-14-0x00007FFC19600000-0x00007FFC1A0C1000-memory.dmp

Download

memory/4340-15-0x0000000000E60000-0x0000000000E70000-memory.dmp

Download

memory/4480-0-0x0000000000380000-0x00000000006A4000-memory.dmp

Download

memory/4480-1-0x00007FFC19600000-0x00007FFC1A0C1000-memory.dmp

Download

memory/4480-2-0x0000000000F50000-0x0000000000F60000-memory.dmp

Download

memory/4480-10-0x00007FFC19600000-0x00007FFC1A0C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads