quasar | 3462988bac3c4590a31be348acd1a494cd6c66759cd794685f05a89e602b49bd

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
disneyclient.exe
Size 3.6MB
Sample240329-vl18csda9t
SHA256 3462988bac3c4590a31be348acd1a494cd6c66759cd794685f05a89e602b49bd
MD5 cef7d0722f455b8875fa1859a2533f14
SHA1 b1c45fa8f4f36e314099b32f64f1f72304a836ac
SHA512 7a36a74b8fda00e5959f9951a837c99fe1945e8782fd3ff2a2ed24351424a49bd90841ac7056e85b17f8a7723590aa8a8581106bedcbc2cdf5d72f00e80b9f00
SSDEEP 98304:4ZsVXA1ZKfbldHiU+FoLgk88IrBPwgLl4:UseGjnztgL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar rat spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

51.178.39.226:4782
51.178.39.226:6606

Mutex

3dbbdd7b-5d37-4992-809f-8e9a09dc9e8a

Attributes

encryption_key
0114248F10A48FFAB2A971FCD42D277259B1A6C4
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
vdst
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/1172-8-0x0000000000400000-0x0000000000728000-memory.dmp	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
404	Client.exe
544	Client.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2592 set thread context of 1172	2592	disneyclient.exe	100
PID 404 set thread context of 544	404	Client.exe	107

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2888	schtasks.exe
4008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2592	disneyclient.exe
2592	disneyclient.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2592	disneyclient.exe
Token: SeDebugPrivilege	1172	disneyclient.exe
Token: SeDebugPrivilege	544	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
544	Client.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 4440	2592	disneyclient.exe	99
PID 2592 wrote to memory of 4440	2592	disneyclient.exe	99
PID 2592 wrote to memory of 4440	2592	disneyclient.exe	99
PID 2592 wrote to memory of 1172	2592	disneyclient.exe	100
PID 2592 wrote to memory of 1172	2592	disneyclient.exe	100
PID 2592 wrote to memory of 1172	2592	disneyclient.exe	100
PID 2592 wrote to memory of 1172	2592	disneyclient.exe	100
PID 2592 wrote to memory of 1172	2592	disneyclient.exe	100
PID 2592 wrote to memory of 1172	2592	disneyclient.exe	100
PID 2592 wrote to memory of 1172	2592	disneyclient.exe	100
PID 2592 wrote to memory of 1172	2592	disneyclient.exe	100
PID 1172 wrote to memory of 2888	1172	disneyclient.exe	102
PID 1172 wrote to memory of 2888	1172	disneyclient.exe	102
PID 1172 wrote to memory of 2888	1172	disneyclient.exe	102
PID 1172 wrote to memory of 404	1172	disneyclient.exe	104
PID 1172 wrote to memory of 404	1172	disneyclient.exe	104
PID 1172 wrote to memory of 404	1172	disneyclient.exe	104
PID 404 wrote to memory of 544	404	Client.exe	107
PID 404 wrote to memory of 544	404	Client.exe	107
PID 404 wrote to memory of 544	404	Client.exe	107
PID 404 wrote to memory of 544	404	Client.exe	107
PID 404 wrote to memory of 544	404	Client.exe	107
PID 404 wrote to memory of 544	404	Client.exe	107
PID 404 wrote to memory of 544	404	Client.exe	107
PID 404 wrote to memory of 544	404	Client.exe	107
PID 544 wrote to memory of 4008	544	Client.exe	108
PID 544 wrote to memory of 4008	544	Client.exe	108
PID 544 wrote to memory of 4008	544	Client.exe	108

C:\Users\Admin\AppData\Local\Temp\disneyclient.exe
"C:\Users\Admin\AppData\Local\Temp\disneyclient.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\disneyclient.exe
  "C:\Users\Admin\AppData\Local\Temp\disneyclient.exe"
  2⤵
  PID:4440
- C:\Users\Admin\AppData\Local\Temp\disneyclient.exe
  "C:\Users\Admin\AppData\Local\Temp\disneyclient.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "vdst" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2888
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:404
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:544
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "vdst" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

disneyclient.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\disneyclient.exe.log
Size 507B
SHA256 f0ac8b87c0b912a61a6dccec0cdad19216e0bc5af222481dd05526aa53578049
MD5 87d67d730bdeba5a26a2d0ce374c52b3
SHA1 409f6c69cbdc1f2d00f1217010ab6e58451e512b
SHA512 4a3e786d1f09482bad4481add0b37909bf465346d87a51593a333a49bff4a7d5ff1eb15db46db0125e993acfce411839c639f00beff39e727a02802e09552601
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.6MB
SHA256 3462988bac3c4590a31be348acd1a494cd6c66759cd794685f05a89e602b49bd
MD5 cef7d0722f455b8875fa1859a2533f14
SHA1 b1c45fa8f4f36e314099b32f64f1f72304a836ac
SHA512 7a36a74b8fda00e5959f9951a837c99fe1945e8782fd3ff2a2ed24351424a49bd90841ac7056e85b17f8a7723590aa8a8581106bedcbc2cdf5d72f00e80b9f00
SSDEEP 98304:4ZsVXA1ZKfbldHiU+FoLgk88IrBPwgLl4:UseGjnztgL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-27-0x0000000074AB0000-0x0000000075260000-memory.dmp

Download

memory/404-22-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/404-20-0x0000000074AB0000-0x0000000075260000-memory.dmp

Download

memory/544-32-0x0000000074AB0000-0x0000000075260000-memory.dmp

Download

memory/544-31-0x0000000006FF0000-0x00000000070A2000-memory.dmp

Download

memory/544-30-0x0000000006D80000-0x0000000006DD0000-memory.dmp

Download

memory/544-29-0x0000000007160000-0x0000000007778000-memory.dmp

Download

memory/544-28-0x0000000005B50000-0x0000000005B60000-memory.dmp

Download

memory/544-25-0x0000000074AB0000-0x0000000075260000-memory.dmp

Download

memory/1172-13-0x0000000005BD0000-0x0000000005BE0000-memory.dmp

Download

memory/1172-21-0x0000000074AB0000-0x0000000075260000-memory.dmp

Download

memory/1172-14-0x0000000005D20000-0x0000000005D2A000-memory.dmp

Download

memory/1172-8-0x0000000000400000-0x0000000000728000-memory.dmp

Download

memory/1172-11-0x0000000074AB0000-0x0000000075260000-memory.dmp

Download

memory/2592-7-0x0000000005A40000-0x0000000005A48000-memory.dmp

Download

memory/2592-12-0x0000000074AB0000-0x0000000075260000-memory.dmp

Download

memory/2592-0-0x0000000074AB0000-0x0000000075260000-memory.dmp

Download

memory/2592-6-0x0000000005890000-0x00000000058A0000-memory.dmp

Download

memory/2592-5-0x00000000059C0000-0x00000000059CC000-memory.dmp

Download

memory/2592-4-0x0000000005600000-0x0000000005692000-memory.dmp

Download

memory/2592-3-0x0000000005560000-0x00000000055FC000-memory.dmp

Download

memory/2592-2-0x0000000005A70000-0x0000000006014000-memory.dmp

Download

memory/2592-1-0x00000000007B0000-0x0000000000B52000-memory.dmp

Download