quasar | 06dbcee1c5c8b50c3a3c47660d0bdbb52181861bbc9edede1d8b1674e82d074e

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ghfhhminfudk.exe
Size 665KB
Sample240318-yes5yshc8y
SHA256 06dbcee1c5c8b50c3a3c47660d0bdbb52181861bbc9edede1d8b1674e82d074e
MD5 06366656ad8ddb302958398f10d38e7b
SHA1 47d24c5030044907eae07d6d17be4d34dc333cc1
SHA512 6970ba9b1cff501e27bb10602f858031d5acb6abc01311542d42c84eadcaf96e4407b859c7b3e590528c92ed2ec847b4550a1bcc2bac9110034ae32a900cd356
SSDEEP 12288:B2JWk6kzIwPzcK7XputA0Ch8/0ectACPqiSbRv/HgM3IdIf+:BDkzIwYkLh8cFtACPqiYpoM3Id2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar zgrat office04 rat spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

gjhfhgdg.insane.wang:3634

Mutex

5943d26f-e34d-4af2-bb6f-9aa3b1840ec8

Attributes

encryption_key
997411AC284CD97048B61F90B41B906864F1171B
install_name
dfsdff.exe
log_directory
Logs
reconnect_delay
3000
startup_key
windows defender process
subdirectory
fsfsf

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/3364-5-0x0000029161570000-0x0000029161672000-memory.dmp	family_zgrat_v1

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023246-16.dat	family_quasar
behavioral2/memory/1012-18-0x0000000000A60000-0x0000000000D84000-memory.dmp	family_quasar
behavioral2/files/0x000700000002324d-23.dat	family_quasar
behavioral2/files/0x000700000002324d-24.dat	family_quasar
behavioral2/files/0x000700000002324d-25.dat	family_quasar

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
1012	sskcezqvhx.exe
2712	dfsdff.exe
1076	hgjfhdgh.exe
2948	hgjfhdgh.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 496 set thread context of 3364	496	ghfhhminfudk.exe	89
PID 1076 set thread context of 2948	1076	hgjfhdgh.exe	118
PID 2948 set thread context of 776	2948	hgjfhdgh.exe	135

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3696	schtasks.exe
3568	schtasks.exe
4656	schtasks.exe
4960	schtasks.exe
3452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3364	vbc.exe
3364	vbc.exe
3364	vbc.exe
3364	vbc.exe
3364	vbc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3364	vbc.exe
Token: SeDebugPrivilege	1012	sskcezqvhx.exe
Token: SeDebugPrivilege	2712	dfsdff.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 496 wrote to memory of 3364	496	ghfhhminfudk.exe	89
PID 496 wrote to memory of 3364	496	ghfhhminfudk.exe	89
PID 496 wrote to memory of 3364	496	ghfhhminfudk.exe	89
PID 496 wrote to memory of 3364	496	ghfhhminfudk.exe	89
PID 496 wrote to memory of 3364	496	ghfhhminfudk.exe	89
PID 496 wrote to memory of 3364	496	ghfhhminfudk.exe	89
PID 496 wrote to memory of 2848	496	ghfhhminfudk.exe	90
PID 496 wrote to memory of 2848	496	ghfhhminfudk.exe	90
PID 496 wrote to memory of 2284	496	ghfhhminfudk.exe	91
PID 496 wrote to memory of 2284	496	ghfhhminfudk.exe	91
PID 496 wrote to memory of 1880	496	ghfhhminfudk.exe	92
PID 496 wrote to memory of 1880	496	ghfhhminfudk.exe	92
PID 2284 wrote to memory of 3696	2284	cmd.exe	96
PID 2284 wrote to memory of 3696	2284	cmd.exe	96
PID 3364 wrote to memory of 1012	3364	vbc.exe	108
PID 3364 wrote to memory of 1012	3364	vbc.exe	108
PID 1012 wrote to memory of 3568	1012	sskcezqvhx.exe	109
PID 1012 wrote to memory of 3568	1012	sskcezqvhx.exe	109
PID 1012 wrote to memory of 2712	1012	sskcezqvhx.exe	111
PID 1012 wrote to memory of 2712	1012	sskcezqvhx.exe	111
PID 2712 wrote to memory of 4656	2712	dfsdff.exe	112
PID 2712 wrote to memory of 4656	2712	dfsdff.exe	112
PID 1076 wrote to memory of 2948	1076	hgjfhdgh.exe	118
PID 1076 wrote to memory of 2948	1076	hgjfhdgh.exe	118
PID 1076 wrote to memory of 2948	1076	hgjfhdgh.exe	118
PID 1076 wrote to memory of 2948	1076	hgjfhdgh.exe	118
PID 1076 wrote to memory of 2948	1076	hgjfhdgh.exe	118
PID 1076 wrote to memory of 2948	1076	hgjfhdgh.exe	118
PID 1076 wrote to memory of 3228	1076	hgjfhdgh.exe	119
PID 1076 wrote to memory of 3228	1076	hgjfhdgh.exe	119
PID 1076 wrote to memory of 4012	1076	hgjfhdgh.exe	120
PID 1076 wrote to memory of 4012	1076	hgjfhdgh.exe	120
PID 1076 wrote to memory of 4132	1076	hgjfhdgh.exe	122
PID 1076 wrote to memory of 4132	1076	hgjfhdgh.exe	122
PID 4012 wrote to memory of 4960	4012	cmd.exe	125
PID 4012 wrote to memory of 4960	4012	cmd.exe	125
PID 2948 wrote to memory of 776	2948	hgjfhdgh.exe	135
PID 2948 wrote to memory of 776	2948	hgjfhdgh.exe	135
PID 2948 wrote to memory of 776	2948	hgjfhdgh.exe	135
PID 2948 wrote to memory of 776	2948	hgjfhdgh.exe	135
PID 2948 wrote to memory of 776	2948	hgjfhdgh.exe	135
PID 2948 wrote to memory of 776	2948	hgjfhdgh.exe	135
PID 2948 wrote to memory of 2332	2948	hgjfhdgh.exe	136
PID 2948 wrote to memory of 2332	2948	hgjfhdgh.exe	136
PID 2948 wrote to memory of 3992	2948	hgjfhdgh.exe	137
PID 2948 wrote to memory of 3992	2948	hgjfhdgh.exe	137
PID 2948 wrote to memory of 4640	2948	hgjfhdgh.exe	139
PID 2948 wrote to memory of 4640	2948	hgjfhdgh.exe	139
PID 3992 wrote to memory of 3452	3992	cmd.exe	142
PID 3992 wrote to memory of 3452	3992	cmd.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ghfhhminfudk.exe
"C:\Users\Admin\AppData\Local\Temp\ghfhhminfudk.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Users\Admin\AppData\Local\Temp\sskcezqvhx.exe
    "C:\Users\Admin\AppData\Local\Temp\sskcezqvhx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "windows defender process" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\fsfsf\dfsdff.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:3568
  - - C:\Users\Admin\AppData\Roaming\fsfsf\dfsdff.exe
      "C:\Users\Admin\AppData\Roaming\fsfsf\dfsdff.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "windows defender process" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\fsfsf\dfsdff.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:4656
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\hgjfhdgh"
  2⤵
  PID:2848
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:3696
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\ghfhhminfudk.exe" "C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe"
  2⤵
  PID:1880

C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe
C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  2⤵
  PID:2948
- C:\Windows\system32\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\hgjfhdgh"
  2⤵
  PID:3228
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:4960
- C:\Windows\system32\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe" "C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe"
  2⤵
  PID:4132

C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe
C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  2⤵
  PID:776
- C:\Windows\system32\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\hgjfhdgh"
  2⤵
  PID:2332
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:3452
- C:\Windows\system32\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe" "C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe"
  2⤵
  PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hgjfhdgh.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\hgjfhdgh.exe.log
Size 859B
SHA256 685f70bf685f654651dcd0acc495b6f52f02f73cc3ca8b3d2c8433aac9ba144d
MD5 e204f3d12abd1691ce1f149399441188
SHA1 798042095539abfe857e456fca4e1035f67d29bf
SHA512 804c5ea57a59f86fd0c34479be4c479230bff79093548e8461758829928969da565c211ccc9cb9befa0fef15f0400a5b1f17d5ddf88aef6ff01b67a191176b9f
MD5 SHA1 SHA512

Submit Download

vbc.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\vbc.exe.log
Size 621B
SHA256 2c09c3a4a8926cac0a5abb3cd34c92c78ec66d87e0e225a04f26e02d6630bdeb
MD5 8ac365dc282788c15f8acf7d54b6f633
SHA1 06ba77cb09a2c33bf03f6506f47fe7fbb396ae1a
SHA512 73a80236ab1b2fd69384ea047667d784e0b4ce4064a57ee6c6e23ee61e58fad37346c42792cf4d9cbcfe52e3f7c72ef5eada6fa025a262adf57a4b80123e4a14
MD5 SHA1 SHA512

Submit Download

sskcezqvhx.exe

Path C:\Users\Admin\AppData\Local\Temp\sskcezqvhx.exe
Size 3.1MB
SHA256 a841a1fe8b81516cb7d07d1bf57d663a26ce360e61f2f90c9dc046e9280bd318
MD5 f0e2c9077145df06fc292d0d7583c5e5
SHA1 7c6182b7d61fe8a12670021f8499326b83e1e3f4
SHA512 a5a64a73d8d310974849998d7288d763b63397c67d7c4a1cf4102d7bf588b3891af8e7ed6d1322e6e3c35ca258bd06a8d7aa23bda551372ead819fa90126f701
SSDEEP 49152:7vmI22SsaNYfdPBldt698dBcjHcHxNESEOk/irLoGdfrTHHB72eh2NT:7vr22SsaNYfdPBldt6+dBcjHIxF3
MD5 SHA1 SHA512 SSDEEP

Submit Download

dfsdff.exe

Path C:\Users\Admin\AppData\Roaming\fsfsf\dfsdff.exe
Size 256KB
SHA256 be182b8f141920fd521ae04fb4c00f1aca1df0af51e3f6288ab0b8009d330493
MD5 90e0e07b6cce342ab84ba9a0b4f84340
SHA1 41b7f3b2e8642015c434b292fe8a11827aec24aa
SHA512 b9bfab2174a7b396d8072bd516ef6e18dd44ee6932143b471ef641cbb5f58a10bbd1e389f6bd9df9af52ae3f07b408cfd452f080d4eb2c50acf18915085919e1
SSDEEP 6144:mcvgMzKM4ofzT+g5y3DZDDFh3kwJjOGPxf3YK:tvgMzKMZmg5y3Dx59tOGPxfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

dfsdff.exe

Path C:\Users\Admin\AppData\Roaming\fsfsf\dfsdff.exe
Size 384KB
SHA256 71338f5a0a61b759c66663d04dc3c395b56b70c2ca5f95ba0be0f622954e826d
MD5 e1426046faffc586b4057ccde02f4c31
SHA1 7c98e71a61517f2705eec261b62194714540acda
SHA512 08b92659356eef50a934f79ece72e7e3f6c9fd88fd42a4850c1a06e2800124e14722e27ea2f1fb15359953452fff082b5c07c156b68d54caa81342c775640fd3
SSDEEP 6144:mcvgMzKM4ofzT+g5y3DZDDFh3kwJjOGPxf3YWLCazTYJBCnLuT6:tvgMzKMZmg5y3Dx59tOGPxf5CA
MD5 SHA1 SHA512 SSDEEP

Submit Download

dfsdff.exe

Path C:\Users\Admin\AppData\Roaming\fsfsf\dfsdff.exe
Size 320KB
SHA256 a92ee6b1c2b5699bf9cb639c77b73460a870d18a980aaaf22abb848d76a857cf
MD5 457c12e35ad3fa164a7acf0a932b20a5
SHA1 039fc0aa27c125c9d7b1d3837ea2a746db2ae75a
SHA512 63a09e7cb2175ee153516ed162b58076de857e1637f444080d4c20cc7bf49c7a292f3531483c975b9c391c9aaec3e293b9415137f9af6dd87d7c7aa0993ce95b
SSDEEP 6144:mcvgMzKM4ofzT+g5y3DZDDFh3kwJjOGPxf3YWLCazG:tvgMzKMZmg5y3Dx59tOGPxf5CZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hgjfhdgh.exe

Path C:\Users\Admin\AppData\Roaming\hgjfhdgh\hgjfhdgh.exe
Size 665KB
SHA256 06dbcee1c5c8b50c3a3c47660d0bdbb52181861bbc9edede1d8b1674e82d074e
MD5 06366656ad8ddb302958398f10d38e7b
SHA1 47d24c5030044907eae07d6d17be4d34dc333cc1
SHA512 6970ba9b1cff501e27bb10602f858031d5acb6abc01311542d42c84eadcaf96e4407b859c7b3e590528c92ed2ec847b4550a1bcc2bac9110034ae32a900cd356
SSDEEP 12288:B2JWk6kzIwPzcK7XputA0Ch8/0ectACPqiSbRv/HgM3IdIf+:BDkzIwYkLh8cFtACPqiYpoM3Id2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/496-1-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/496-0-0x00000000001F0000-0x000000000029A000-memory.dmp

Download

memory/496-7-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/496-2-0x000000001B030000-0x000000001B040000-memory.dmp

Download

memory/776-58-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/776-63-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/776-62-0x000002EA3EDA0000-0x000002EA3EDB0000-memory.dmp

Download

memory/776-60-0x000002EA3EDA0000-0x000002EA3EDB0000-memory.dmp

Download

memory/776-61-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/1012-18-0x0000000000A60000-0x0000000000D84000-memory.dmp

Download

memory/1012-19-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/1012-20-0x000000001B840000-0x000000001B850000-memory.dmp

Download

memory/1012-27-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/1076-47-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/1076-42-0x0000000001270000-0x0000000001280000-memory.dmp

Download

memory/1076-41-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/2712-31-0x000000001BCA0000-0x000000001BCF0000-memory.dmp

Download

memory/2712-32-0x000000001BDB0000-0x000000001BE62000-memory.dmp

Download

memory/2712-30-0x0000000000F30000-0x0000000000F40000-memory.dmp

Download

memory/2712-44-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/2712-37-0x000000001B270000-0x000000001B282000-memory.dmp

Download

memory/2712-38-0x000000001BD30000-0x000000001BD6C000-memory.dmp

Download

memory/2712-29-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/2948-55-0x0000000002E90000-0x0000000002EA0000-memory.dmp

Download

memory/2948-54-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/2948-46-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/2948-59-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/2948-48-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/2948-49-0x0000026AFA490000-0x0000026AFA4A0000-memory.dmp

Download

memory/2948-51-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/3364-33-0x0000029148CB0000-0x0000029148CC0000-memory.dmp

Download

memory/3364-13-0x0000029148CB0000-0x0000029148CC0000-memory.dmp

Download

memory/3364-34-0x0000029148CB0000-0x0000029148CC0000-memory.dmp

Download

memory/3364-12-0x0000029148CB0000-0x0000029148CC0000-memory.dmp

Download

memory/3364-11-0x0000029148D30000-0x0000029148D7C000-memory.dmp

Download

memory/3364-28-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/3364-10-0x0000029161670000-0x00000291616C6000-memory.dmp

Download

memory/3364-6-0x00007FFCA9E00000-0x00007FFCAA8C1000-memory.dmp

Download

memory/3364-5-0x0000029161570000-0x0000029161672000-memory.dmp

Download

memory/3364-3-0x0000000140000000-0x00000001400A2000-memory.dmp

Download