quasar | 0b8e8225111efea9e4e4e01643809771eb48d0dbe705d7367f2c895a994025b7

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2024, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
imgonee.bat
Size 5.1MB
Sample240330-tpjxtahe5s
SHA256 0b8e8225111efea9e4e4e01643809771eb48d0dbe705d7367f2c895a994025b7
MD5 a5ddbe1c3a741240cd31ee183e80f68e
SHA1 2983a2b2724986668046dc0339e48a3f7a27f886
SHA512 a354439302b98f633df642332bf5066daa486c18ecd7395188524635cd84172bb0d21b6d610bed40377e3c1ce7f9f6366de61682b0b4eea707a8c10c8c7dd830
SSDEEP 24576:gScksZhAsxYu9bEUt4Qa1CFQa5Z4tp5ljbjvGr2BBgfretKRxMp+hrQB0eJM2a8f:XSbESV0MFJnEOd/4uxk7GmOcl1t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

character-acquisitions.gl.at.ply.gg:36301

Mutex

8fd646dd-074f-49c8-b9f2-bcf0e89df49c

Attributes

encryption_key
F7BE6911D802AD8DE6563F293DF4A974E285DE23
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
icloudservices
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023240-62216.dat	family_quasar
behavioral2/memory/2124-62218-0x00000000002B0000-0x00000000005D4000-memory.dmp	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
2124	x.exe
4976	Client.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File created	C:\Windows\system32\SubDir\Client.exe	x.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	x.exe
File opened for modification	C:\Windows\system32\SubDir	x.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3716	schtasks.exe
2020	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	x.exe
Token: SeDebugPrivilege	4976	Client.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4976	Client.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4976	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4976	Client.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 1868	4288	cmd.exe	98
PID 4288 wrote to memory of 1868	4288	cmd.exe	98
PID 4288 wrote to memory of 3332	4288	cmd.exe	99
PID 4288 wrote to memory of 3332	4288	cmd.exe	99
PID 4288 wrote to memory of 2124	4288	cmd.exe	100
PID 4288 wrote to memory of 2124	4288	cmd.exe	100
PID 2124 wrote to memory of 2020	2124	x.exe	101
PID 2124 wrote to memory of 2020	2124	x.exe	101
PID 2124 wrote to memory of 4976	2124	x.exe	103
PID 2124 wrote to memory of 4976	2124	x.exe	103
PID 4976 wrote to memory of 3716	4976	Client.exe	104
PID 4976 wrote to memory of 3716	4976	Client.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\imgonee.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\system32\findstr.exe
  findstr /e "'v" "C:\Users\Admin\AppData\Local\Temp\imgonee.bat"
  2⤵
  PID:1868
- C:\Windows\system32\cscript.exe
  cscript //nologo C:\Users\Admin\AppData\Local\Temp\x.vbs
  2⤵
  PID:3332
- C:\Users\Admin\AppData\Local\Temp\x.exe
  C:\Users\Admin\AppData\Local\Temp\x.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "icloudservices" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2020
- - C:\Windows\system32\SubDir\Client.exe
    "C:\Windows\system32\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "icloudservices" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4KB
SHA256 3c37be69c66a6eaa998e84d839ec909d7c063e33bf0f37a148dfb8026c641803
MD5 5e7433944b930a5d455e8105cfc50e5b
SHA1 613c4b5cd7c00a48057d0c26ecbc4546257f9369
SHA512 08f3a7b8ff5b75aff5dee4cc97d37bff6dc4128a926b90106f788cfeb639ff52f7ab584b0ccd8039d9c164754f8d26e7053ef5d3ec49b0f6f30f86be327a7309
SSDEEP 96:R9xEzhSorq6pprE23qnxmw8TWQZjhRQRSau1fM10IDUWH42:PCzdrqAx3qxmw8TWqhFauhM10no1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4.3MB
SHA256 e501020678d2b5ca340d786d9a33cac346a90fc77f8fdccd44ef6cb8675f5895
MD5 a1bb141cd81ab003f85fd4a68b501bb5
SHA1 9b8036e5551a097bf1f43de1c94291a137392898
SHA512 3d07ce7ec792fbd1b61c4955f9bb5ea5b7052cd911f9aa7ac41939ddb198d03f461a904ac543ba8de096ef46cacbf66d13747e5efe0b8fbe6703f7233dac4fc8
SSDEEP 24576:yqoMk5BEANs2JPGz8Bm58qd2Rbsm5aK4VJhlfrHLqvCZ9YNEGXCNOJdAVixXE5I4:B2PGzehZ88Zx7kOdEI0SFr8Rf
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 3.1MB
SHA256 6c3bf8d6d422e4f1633137f80edd54f810420680d180dd8fcd4b7533816d332a
MD5 c4ceeb2f70dc5c3542cf4915779973b2
SHA1 0677cc9fb62cad062058bed025a9126aa72870b1
SHA512 61c33830ede8c6c71ebb15c8b26c49b8138437ea44a8306c1a225ac0814805f66634893b3c690a7bf4dcda4e22163eafd37182458d497dc2a3edb932ef5ee46a
SSDEEP 49152:uvOI22SsaNYfdPBldt698dBcjHWqAqSVgoG38THHB72eh2NT:uvj22SsaNYfdPBldt6+dBcjHWFqS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.vbs

Path C:\Users\Admin\AppData\Local\Temp\x.vbs
Size 380B
SHA256 cf8268d158bb819ef158ff6ccbed64d5e379148a0adb1f73a082a01d56d0286b
MD5 ec9a2fb69a379d913a4e0a953cd3b97c
SHA1 a0303ed9f787c042071a1286bba43a5bbdd0679e
SHA512 fef8e24a680991046bd7dacd6079c7e48c3031fe46caae722ea93797ee16c052073ba97959e992ea71ac7ab72fbcedaa5cf4a410657aac4c10ad24de6935e9d6
MD5 SHA1 SHA512

Submit Download

memory/2124-62220-0x0000000000E10000-0x0000000000E20000-memory.dmp

Download

memory/2124-62219-0x00007FF9B4DA0000-0x00007FF9B5861000-memory.dmp

Download

memory/2124-62218-0x00000000002B0000-0x00000000005D4000-memory.dmp

Download

memory/2124-62227-0x00007FF9B4DA0000-0x00007FF9B5861000-memory.dmp

Download

memory/4976-62228-0x00007FF9B4DA0000-0x00007FF9B5861000-memory.dmp

Download

memory/4976-62229-0x0000000003130000-0x0000000003140000-memory.dmp

Download

memory/4976-62230-0x000000001C8A0000-0x000000001C8F0000-memory.dmp

Download

memory/4976-62231-0x000000001C9B0000-0x000000001CA62000-memory.dmp

Download

memory/4976-62232-0x00007FF9B4DA0000-0x00007FF9B5861000-memory.dmp

Download

memory/4976-62233-0x0000000003130000-0x0000000003140000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads