quasar | 7de357f984b1be5d0af071a906365c51a470881404b48d70f61e8b43b03eb760

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2024, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample240301-vmrqbaaf66
SHA256 7de357f984b1be5d0af071a906365c51a470881404b48d70f61e8b43b03eb760
MD5 031fda2a7da25f006e4e68a88df6d11f
SHA1 fe734168578bba395bfeb668c4e59b309e521274
SHA512 f7b8f2c01aecfa80bc169df53d728c3f4585bc4e22763e3dd7cf9f2767f784c8f88f6e5f5d18d109afcf2670c321fda4b9b1566fd2a25feb25584b7b04cf92a0
SSDEEP 49152:3vTI22SsaNYfdPBldt698dBcjHez8kbR4LoGdJPTHHB72eh2NT:3vs22SsaNYfdPBldt6+dBcjHez8r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.56.1:4782
0.tcp.eu.ngrok.io:15015:4782

Mutex

4b954fab-7429-499a-ab6b-df9c5e3096d7

Attributes

encryption_key
D75601A171551C23C0EEACEE58E7D707A2C948C8
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
TestWindows
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

resource	yara_rule
behavioral2/memory/2904-0-0x00000000005E0000-0x0000000000904000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023233-5.dat	family_quasar
behavioral2/files/0x0007000000023233-7.dat	family_quasar
behavioral2/files/0x0007000000023233-20.dat	family_quasar
behavioral2/files/0x0007000000023233-42.dat	family_quasar

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 4 IoCs

pid	Process
1936	Client.exe
1172	Client.exe
3232	Client.exe
808	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3192	schtasks.exe
4948	schtasks.exe
2344	schtasks.exe
3164	schtasks.exe
2372	schtasks.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
1176	PING.EXE
3108	PING.EXE
2128	PING.EXE
3132	PING.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	Client-built.exe
Token: SeDebugPrivilege	1936	Client.exe
Token: SeDebugPrivilege	1172	Client.exe
Token: SeDebugPrivilege	3232	Client.exe
Token: SeDebugPrivilege	808	Client.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1936	Client.exe
1172	Client.exe
3232	Client.exe
808	Client.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1936	Client.exe
1172	Client.exe
3232	Client.exe
808	Client.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2344	2904	Client-built.exe	96
PID 2904 wrote to memory of 2344	2904	Client-built.exe	96
PID 2904 wrote to memory of 1936	2904	Client-built.exe	98
PID 2904 wrote to memory of 1936	2904	Client-built.exe	98
PID 1936 wrote to memory of 3164	1936	Client.exe	99
PID 1936 wrote to memory of 3164	1936	Client.exe	99
PID 1936 wrote to memory of 3340	1936	Client.exe	103
PID 1936 wrote to memory of 3340	1936	Client.exe	103
PID 3340 wrote to memory of 3988	3340	cmd.exe	105
PID 3340 wrote to memory of 3988	3340	cmd.exe	105
PID 3340 wrote to memory of 1176	3340	cmd.exe	106
PID 3340 wrote to memory of 1176	3340	cmd.exe	106
PID 3340 wrote to memory of 1172	3340	cmd.exe	108
PID 3340 wrote to memory of 1172	3340	cmd.exe	108
PID 1172 wrote to memory of 2372	1172	Client.exe	110
PID 1172 wrote to memory of 2372	1172	Client.exe	110
PID 1172 wrote to memory of 2620	1172	Client.exe	112
PID 1172 wrote to memory of 2620	1172	Client.exe	112
PID 2620 wrote to memory of 3700	2620	cmd.exe	114
PID 2620 wrote to memory of 3700	2620	cmd.exe	114
PID 2620 wrote to memory of 3108	2620	cmd.exe	115
PID 2620 wrote to memory of 3108	2620	cmd.exe	115
PID 2620 wrote to memory of 3232	2620	cmd.exe	116
PID 2620 wrote to memory of 3232	2620	cmd.exe	116
PID 3232 wrote to memory of 3192	3232	Client.exe	117
PID 3232 wrote to memory of 3192	3232	Client.exe	117
PID 3232 wrote to memory of 456	3232	Client.exe	119
PID 3232 wrote to memory of 456	3232	Client.exe	119
PID 456 wrote to memory of 3988	456	cmd.exe	121
PID 456 wrote to memory of 3988	456	cmd.exe	121
PID 456 wrote to memory of 2128	456	cmd.exe	122
PID 456 wrote to memory of 2128	456	cmd.exe	122
PID 456 wrote to memory of 808	456	cmd.exe	123
PID 456 wrote to memory of 808	456	cmd.exe	123
PID 808 wrote to memory of 4948	808	Client.exe	124
PID 808 wrote to memory of 4948	808	Client.exe	124
PID 808 wrote to memory of 3032	808	Client.exe	126
PID 808 wrote to memory of 3032	808	Client.exe	126
PID 3032 wrote to memory of 2392	3032	cmd.exe	128
PID 3032 wrote to memory of 2392	3032	cmd.exe	128
PID 3032 wrote to memory of 3132	3032	cmd.exe	129
PID 3032 wrote to memory of 3132	3032	cmd.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2344
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jPYBZgz4S841.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3988
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:1176
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1172
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:2372
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Rw1YaeB2YJd7.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2620
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3700
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:3108
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Creates scheduled task(s)
        
        PID:3192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JkgMmEvmJPKV.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3988
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:2128
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:808
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Creates scheduled task(s)
        
        PID:4948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mPtu03sKiFSZ.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2392
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:3132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3096 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:3136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 23c077fd7da5a790f41d53439b19c7626afec3195ad45fc16b8f7c1bb8cd543f
MD5 22704a28d680687e37a2180cf2f7e896
SHA1 affc53d25c34832db3dfdd632445bec987119224
SHA512 5413bd3d742323e7d1e67874e96e8fe47ca6a78d2c9f3b211bdd9d5c9e9038f110b89e8b602cfdba3e3bac17a08821b182c7d4d75ae672ff466e1a866ca7ea7f
SSDEEP 96:YqUuhBtSlLD6dBRJHNXYfMtlyt3IMcRAsyStzJnmj240PmwyzQRjJ8:YzuhKLiPIAl3ryStzP40uwyzQRjC
MD5 SHA1 SHA512 SSDEEP

Submit Download

JkgMmEvmJPKV.bat

Path C:\Users\Admin\AppData\Local\Temp\JkgMmEvmJPKV.bat
Size 207B
SHA256 a67f974228a2441588950fb399a0e0b73f7a59bff27a3ed97728b9857f299d30
MD5 abdd38bcfb6f3cee42b0b993ea43c21b
SHA1 ba9385875877935da532c4e319050d6c4ee5f56f
SHA512 fe87c179d710d4ad3859f3277a71e8a6897da365a81928f136a46b1562d15f28650d2450c26e2ae2e45907580de1c3ef0aa7b69a4f0ac681fb4f88946a561d18
MD5 SHA1 SHA512

Submit Download

Rw1YaeB2YJd7.bat

Path C:\Users\Admin\AppData\Local\Temp\Rw1YaeB2YJd7.bat
Size 207B
SHA256 3bfe04be7c45d3c0e5491743d71dea467954f149bdbbb0cdcd2059285c8ef60d
MD5 31e13ed910cd9e67da0ff05ea0975eb3
SHA1 54a6fe79cc4172270321639cd0cdc27d744dc79c
SHA512 cf447e93fc714a40e5fc415683db9cab2764fb9b97c7e2032ef5c81981fe7b147c7bb9ba151f91ac18150140ef753a4e1786202a7b5e58af546ede7cd2bd039b
MD5 SHA1 SHA512

Submit Download

jPYBZgz4S841.bat

Path C:\Users\Admin\AppData\Local\Temp\jPYBZgz4S841.bat
Size 207B
SHA256 4c8b362cf9bb5b5425c1b23b958af0df6ba5017e090fd31dc97d2890a9a79ff2
MD5 113d8cac7ad87085dc73ab9406265957
SHA1 a11c3b3813b569ae00b3772b4491009adfa92823
SHA512 c3405525e7e6f636a94a0b8e0e70542b625d0096f3c37a1411751ac65e4e0ba4ab81814c631c1f42f493d84d3e186ff32f9b532b47e62d898f2878d6e96cdd59
MD5 SHA1 SHA512

Submit Download

mPtu03sKiFSZ.bat

Path C:\Users\Admin\AppData\Local\Temp\mPtu03sKiFSZ.bat
Size 207B
SHA256 cce08313811d9eb96653dc67be2d59e7a17f83d3f552b539b77d3945aaaf03bc
MD5 e4dacc51ae96957fbf68ba4b56ce09a9
SHA1 28148d09a99ab393765177be60ea1faa14052470
SHA512 a035d862d2db3b0958a063497b64df5818b5ce95387023706e524d560d03a0afd28b7f967b62b37201ebcb9fe413e823376020234d71872a907fb2c91add6f07
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 1.3MB
SHA256 bb9dcd5bbd870e29b70bdaaec53631b436e5faf52202cd739a0d55f0cc48836b
MD5 9b3496780b760c25898866fe9b53f873
SHA1 aaceb8a40f7274fa8232f28ef9c4ea9dec98e455
SHA512 c4f5eeae041f86fa08eb33782151bba681125f62086f223a5b194ebfdc908678a577683093db5fbd2773133cb2e4a405a4811c9ba98617f9d26ba25eb89538a5
SSDEEP 24576:3vdpIA4Wnh2ShqaNYjjjhPBl/lt6/l8ImBcIz34R:3vTI22SsaNYfdPBldt698dBcjR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 1.6MB
SHA256 0f556a71809111cb724c5eaadfbd28cce59ee0a1af56ec94463c53f231aaea9c
MD5 c11c865a79b383edfe4abc3cf274c81c
SHA1 1657db159d6f2b4923b749209c6131f88507765b
SHA512 bacf059fd7a275b2c37fb3f74390cd2295ba87b27821d94ae4f0ebd1992b75ea8582ff9ef0ffc2d64a5fcfc6b636b57a9b74343606c42111908bfce5a166e4ad
SSDEEP 24576:3vdpIA4Wnh2ShqaNYjjjhPBl/lt6/l8ImBcIz3491N3q1:3vTI22SsaNYfdPBldt698dBcjH0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 7de357f984b1be5d0af071a906365c51a470881404b48d70f61e8b43b03eb760
MD5 031fda2a7da25f006e4e68a88df6d11f
SHA1 fe734168578bba395bfeb668c4e59b309e521274
SHA512 f7b8f2c01aecfa80bc169df53d728c3f4585bc4e22763e3dd7cf9f2767f784c8f88f6e5f5d18d109afcf2670c321fda4b9b1566fd2a25feb25584b7b04cf92a0
SSDEEP 49152:3vTI22SsaNYfdPBldt698dBcjHez8kbR4LoGdJPTHHB72eh2NT:3vs22SsaNYfdPBldt6+dBcjHez8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 2.8MB
SHA256 4b89a6ef353bb8ca3424e1227bf405cf53e29c1a3e817dc1c9affe61ee531e7f
MD5 f449b51db507c7543fb74c55151238fd
SHA1 acdc6cf4058814b66c9ec94252aa4838b83d647c
SHA512 f11a8ad9995bc13a66450ee9c8bd13021f9e02163b10f69e25a3dcbe30cd29428fac28c56e1a0347890bfffa6c49c5a5c332114ec2ba14a2ff10a9c5a7e85c9d
SSDEEP 49152:3vTI22SsaNYfdPBldt698dBcjHez8kbR4LoGdJPU:3vs22SsaNYfdPBldt6+dBcjHez8ry
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/808-43-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/808-44-0x0000000001A10000-0x0000000001A20000-memory.dmp

Download

memory/808-45-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/808-49-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/1172-26-0x0000000001640000-0x0000000001650000-memory.dmp

Download

memory/1172-31-0x00007FF983B00000-0x00007FF9845C1000-memory.dmp

Download

memory/1172-22-0x00007FF983B00000-0x00007FF9845C1000-memory.dmp

Download

memory/1172-23-0x0000000001640000-0x0000000001650000-memory.dmp

Download

memory/1172-25-0x00007FF983B00000-0x00007FF9845C1000-memory.dmp

Download

memory/1936-11-0x000000001BB70000-0x000000001BBC0000-memory.dmp

Download

memory/1936-10-0x000000001B0F0000-0x000000001B100000-memory.dmp

Download

memory/1936-13-0x00007FF9839C0000-0x00007FF984481000-memory.dmp

Download

memory/1936-18-0x00007FF9839C0000-0x00007FF984481000-memory.dmp

Download

memory/1936-8-0x00007FF9839C0000-0x00007FF984481000-memory.dmp

Download

memory/1936-12-0x000000001BC80000-0x000000001BD32000-memory.dmp

Download

memory/2904-1-0x00007FF9839C0000-0x00007FF984481000-memory.dmp

Download

memory/2904-2-0x000000001B6B0000-0x000000001B6C0000-memory.dmp

Download

memory/2904-9-0x00007FF9839C0000-0x00007FF984481000-memory.dmp

Download

memory/2904-0-0x00000000005E0000-0x0000000000904000-memory.dmp

Download

memory/3232-34-0x000000001BB60000-0x000000001BB70000-memory.dmp

Download

memory/3232-40-0x00007FF983B00000-0x00007FF9845C1000-memory.dmp

Download

memory/3232-36-0x000000001BB60000-0x000000001BB70000-memory.dmp

Download

memory/3232-35-0x00007FF983B00000-0x00007FF9845C1000-memory.dmp

Download

memory/3232-33-0x00007FF983B00000-0x00007FF9845C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads