quasar | 46297c4c0a1e8dcbffcc89326acc44e75720a62569242a804be88ea915fe4c8e

General

Target

Client-built.exe
Size

3.3MB
MD5

eff096752ef1895d626f570a154c38a2
SHA1

ae2c737e15d12d830220bae198b72717422d70d4
SHA256

46297c4c0a1e8dcbffcc89326acc44e75720a62569242a804be88ea915fe4c8e
SHA512

1c0cba459290f89874adab22697c62d9ebe15f41c68b2efa0d004a9e12b1cd4676480e35a04a3dbe9e4cdec59cbc7a2f1e7b5b30da856bf16052c8f958c8a52d
SSDEEP

49152:rvBt62XlaSFNWPjljiFa2RoUYInlDkE2Hqk/+FWoGd++THHB72eh2NTfZqS:rvr62XlaSFNWPjljiFXRoUYInlDLEO

Score

10^/10

quasar office01 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office01

C2

198.7.62.204:4782

Mutex

02b9c972-8b55-4d55-b7c4-09a1f00ff400

Attributes

encryption_key
5BF0703F288C43118835CAF4D1A6879C29016FB3
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2456-0-0x0000000000240000-0x0000000000588000-memory.dmp	family_quasar
C:\Windows\System32\SubDir\Client.exe	family_quasar
behavioral1/memory/2576-9-0x00000000003D0000-0x0000000000718000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

2576 Client.exe

pid	process
2576	Client.exe

Drops file in System32 directory 5 IoCs

Processes:

Client.exeClient-built.exe

description	ioc	process
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File created	C:\Windows\system32\SubDir\Client.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir	Client-built.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2940 schtasks.exe
2680 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Client-built.exeClient.exe

description pid process

Token: SeDebugPrivilege 2456 Client-built.exe
Token: SeDebugPrivilege 2576 Client.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

2576 Client.exe

pid	process
2940	schtasks.exe
2680	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2456	Client-built.exe
Token: SeDebugPrivilege	2576	Client.exe

pid	process
2576	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Client-built.exeClient.exe

description	pid	process	target process
PID 2456 wrote to memory of 2940	2456	Client-built.exe	schtasks.exe
PID 2456 wrote to memory of 2940	2456	Client-built.exe	schtasks.exe
PID 2456 wrote to memory of 2940	2456	Client-built.exe	schtasks.exe
PID 2456 wrote to memory of 2576	2456	Client-built.exe	Client.exe
PID 2456 wrote to memory of 2576	2456	Client-built.exe	Client.exe
PID 2456 wrote to memory of 2576	2456	Client-built.exe	Client.exe
PID 2576 wrote to memory of 2680	2576	Client.exe	schtasks.exe
PID 2576 wrote to memory of 2680	2576	Client.exe	schtasks.exe
PID 2576 wrote to memory of 2680	2576	Client.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2940

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2680

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\SubDir\Client.exe
Filesize
3.3MB

MD5
eff096752ef1895d626f570a154c38a2

SHA1
ae2c737e15d12d830220bae198b72717422d70d4

SHA256
46297c4c0a1e8dcbffcc89326acc44e75720a62569242a804be88ea915fe4c8e

SHA512
1c0cba459290f89874adab22697c62d9ebe15f41c68b2efa0d004a9e12b1cd4676480e35a04a3dbe9e4cdec59cbc7a2f1e7b5b30da856bf16052c8f958c8a52d

Download Submit
memory/2456-0-0x0000000000240000-0x0000000000588000-memory.dmp

Filesize
3.3MB

Download
memory/2456-1-0x000007FEF6020000-0x000007FEF6A0C000-memory.dmp

Filesize
9.9MB

Download
memory/2456-2-0x000000001AAE0000-0x000000001AB60000-memory.dmp

Filesize
512KB

Download
memory/2456-8-0x000007FEF6020000-0x000007FEF6A0C000-memory.dmp

Filesize
9.9MB

Download
memory/2576-9-0x00000000003D0000-0x0000000000718000-memory.dmp

Filesize
3.3MB

Download
memory/2576-11-0x000000001B0A0000-0x000000001B120000-memory.dmp

Filesize
512KB

Download
memory/2576-10-0x000007FEF6020000-0x000007FEF6A0C000-memory.dmp

Filesize
9.9MB

Download
memory/2576-12-0x000007FEF6020000-0x000007FEF6A0C000-memory.dmp

Filesize
9.9MB

Download
memory/2576-13-0x000000001B0A0000-0x000000001B120000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads