quasar | f29748e0276f3b13632486a93f94e392685d622473034d68eb126a46092808d7

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Uni.bat
Size 5.1MB
Sample240328-wp954sce7s
SHA256 f29748e0276f3b13632486a93f94e392685d622473034d68eb126a46092808d7
MD5 df1d2204bbade8548fe767fb9f280abb
SHA1 974942c51f356813932f863194e0ed6f077be9d5
SHA512 8a4074c753a43aa49f632e4121bc65ba0fc8cca2e449ef0f243c8653648cc1cf6b811d0d31ef6fb4ecad5223e15ebda2aab0395a6240123dbe485433e6ffe6ad
SSDEEP 24576:Bs9eG59KmJBu9G/zENTtHzhNQjd/V/DtYZPBZYWXZIHRSBqefgE3yuPy6Q3oUtM/:/ZG776sU/T4aRfrhQwsxZrN8v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

140.238.91.110:42425

Mutex

276d9dc6-b19c-4958-8ac3-89586bd3b515

Attributes

encryption_key
ABCF70C37D1A79A01712038122D1532DF20DF72A
install_name
Client.exe
log_directory
Error Logs
reconnect_delay
3000
startup_key
WOS64
subdirectory
Windows

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0003000000000735-62206.dat	family_quasar
behavioral2/memory/4356-62208-0x0000000000B30000-0x0000000000E54000-memory.dmp	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
4356	x.exe
3736	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2056	schtasks.exe
3396	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	x.exe
Token: SeDebugPrivilege	3736	Client.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3736	Client.exe
3736	Client.exe
3736	Client.exe
3736	Client.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3736	Client.exe
3736	Client.exe
3736	Client.exe
3736	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3736	Client.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2924	2424	cmd.exe	99
PID 2424 wrote to memory of 2924	2424	cmd.exe	99
PID 2424 wrote to memory of 4576	2424	cmd.exe	100
PID 2424 wrote to memory of 4576	2424	cmd.exe	100
PID 2424 wrote to memory of 4356	2424	cmd.exe	101
PID 2424 wrote to memory of 4356	2424	cmd.exe	101
PID 4356 wrote to memory of 2056	4356	x.exe	102
PID 4356 wrote to memory of 2056	4356	x.exe	102
PID 4356 wrote to memory of 3736	4356	x.exe	104
PID 4356 wrote to memory of 3736	4356	x.exe	104
PID 3736 wrote to memory of 3396	3736	Client.exe	105
PID 3736 wrote to memory of 3396	3736	Client.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\system32\findstr.exe
  findstr /e "'v" "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
  2⤵
  PID:2924
- C:\Windows\system32\cscript.exe
  cscript //nologo C:\Users\Admin\AppData\Local\Temp\x.vbs
  2⤵
  PID:4576
- C:\Users\Admin\AppData\Local\Temp\x.exe
  C:\Users\Admin\AppData\Local\Temp\x.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "WOS64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2056
- - C:\Users\Admin\AppData\Roaming\Windows\Client.exe
    "C:\Users\Admin\AppData\Roaming\Windows\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WOS64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\Client.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4KB
SHA256 2442eaf0a040803d0fee1d442bceb2fc1eb3416bad79c8a61b404fe1422926f3
MD5 ca4d71a5ceab3803a705508d783ce463
SHA1 8ab6f57819183fb9f9053d00a273fa4d3be9749b
SHA512 83387599e7124c6560439802d2965c5b6f2ffcc256b01cb6cd3e3d1f817adc97ad8356e06380a17fa689331b61fa1cc1216d22219ff2eff504628ff923a13bc1
SSDEEP 96:R9C0m9Wq6pprE23qnxmw8TWQZjhRQRSau1fM10IDUWH42:PC0cWqAx3qxmw8TWqhFauhM10no1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4.3MB
SHA256 ca666dfbe64fa6faf86675e3a4399bd91662913a0aff990822a098e8a5c78bec
MD5 50191b3c941be1619ef9074bceedb7b8
SHA1 1afcc22d0d3fe486abc6f43b8ead45c7897831b2
SHA512 6cc405cbd28035f13c28d99dcd31389a5c39c512aee31cabe94b414fdd641156942e20149a22e14c03b6ca1df7accdee79c96e0a426e4c6688489b236ba4a4b6
SSDEEP 24576:fs5uW59mit12JyK+zs5aCRPzF2ks3tfNhxrdABfNJcyr9831Ci82CXccjearCWkO:llyKM3nOE87QuAiNmxp9I
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 3.1MB
SHA256 fc49b4827d7ad34dece937cd01a3ad2efb1d963f516b6e87d2f4ffdf1b095894
MD5 302bdaa403a7cd29118ff464e6bb232d
SHA1 f1e6176c65b178d15dacc4dfbda76fe876827b5e
SHA512 cf65c2310c4aed4293a2ad27abc5473393d12ad6384fd41155ec6876ddad8ad5f03dd701c83239a08f534d12be119c89b82ae39eafb4d93aed593095dd71020d
SSDEEP 49152:Gvht62XlaSFNWPjljiFa2RoUYIGoRJ62bR3LoGdtWTHHB72eh2NT:GvL62XlaSFNWPjljiFXRoUYIGoRJ6w9
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.vbs

Path C:\Users\Admin\AppData\Local\Temp\x.vbs
Size 380B
SHA256 cf8268d158bb819ef158ff6ccbed64d5e379148a0adb1f73a082a01d56d0286b
MD5 ec9a2fb69a379d913a4e0a953cd3b97c
SHA1 a0303ed9f787c042071a1286bba43a5bbdd0679e
SHA512 fef8e24a680991046bd7dacd6079c7e48c3031fe46caae722ea93797ee16c052073ba97959e992ea71ac7ab72fbcedaa5cf4a410657aac4c10ad24de6935e9d6
MD5 SHA1 SHA512

Submit Download

memory/3736-62222-0x000000001C410000-0x000000001C422000-memory.dmp

Download

memory/3736-62218-0x00007FFBAB910000-0x00007FFBAC3D1000-memory.dmp

Download

memory/3736-62219-0x000000001B900000-0x000000001B910000-memory.dmp

Download

memory/3736-62220-0x000000001C440000-0x000000001C490000-memory.dmp

Download

memory/3736-62221-0x000000001C550000-0x000000001C602000-memory.dmp

Download

memory/3736-62223-0x000000001C4D0000-0x000000001C50C000-memory.dmp

Download

memory/3736-62224-0x00007FFBAB910000-0x00007FFBAC3D1000-memory.dmp

Download

memory/3736-62225-0x000000001B900000-0x000000001B910000-memory.dmp

Download

memory/4356-62209-0x00007FFBAB910000-0x00007FFBAC3D1000-memory.dmp

Download

memory/4356-62210-0x000000001BB50000-0x000000001BB60000-memory.dmp

Download

memory/4356-62217-0x00007FFBAB910000-0x00007FFBAC3D1000-memory.dmp

Download

memory/4356-62208-0x0000000000B30000-0x0000000000E54000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads