quasar | 8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f

Analysis

max time kernel
142s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
02/04/2024, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe
Size 2.0MB
Sample240402-h535vabc86
SHA256 8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f
MD5 6c070805d0f04cc04cbabcf5c1e243df
SHA1 b4668ac9d9d4b64a4d9b9c3615a2bccebf408b75
SHA512 80914cbbd3fe3bd94f1ad48a92f0adb75291817cd2993e428df9da306bbf305773d64188b79c60a0ade1383b7f7c2f87af29bbef4e7a6f2695cee602fca5da39
SSDEEP 12288:ZCxv4m9vTKp5CU+b1GQ7wywPRQVZOZsNoo/zbMXQTGcCsqB9SNOuAxAEUV9l+:O5TKeU+wQ7wyuRaZEuG3q2IV9l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar zgrat office04 rat spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

45.88.186.209:4782

Mutex

e70efcae-9ec5-4682-aa19-15651d4d8cc8

Attributes

encryption_key
4EF1547B5DB5058DCCEB6A60D48A54C35026D8D5
install_name
gfhgfgjgf.exe
log_directory
dfdfsf
reconnect_delay
3000
startup_key
hgfhjjhgj
subdirectory
ghghghfg

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/1876-4-0x000002145B470000-0x000002145B574000-memory.dmp	family_zgrat_v1

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000400000002a754-16.dat	family_quasar
behavioral2/memory/3468-19-0x00000000006D0000-0x00000000009F4000-memory.dmp	family_quasar

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
3468	duepth.exe
1044	gfhgfgjgf.exe
648	ghghghdg.exe
4812	ghghghdg.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1904 set thread context of 1876	1904	8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe	77
PID 648 set thread context of 4788	648	ghghghdg.exe	93
PID 4812 set thread context of 1964	4812	ghghghdg.exe	102

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4820	schtasks.exe
1972	schtasks.exe
2992	schtasks.exe
3760	schtasks.exe
4008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1876	vbc.exe
1876	vbc.exe
1876	vbc.exe
1876	vbc.exe
1876	vbc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	vbc.exe
Token: SeDebugPrivilege	3468	duepth.exe
Token: SeDebugPrivilege	1044	gfhgfgjgf.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1876	1904	8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe	77
PID 1904 wrote to memory of 1876	1904	8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe	77
PID 1904 wrote to memory of 1876	1904	8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe	77
PID 1904 wrote to memory of 1876	1904	8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe	77
PID 1904 wrote to memory of 1876	1904	8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe	77
PID 1904 wrote to memory of 1876	1904	8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe	77
PID 1904 wrote to memory of 1020	1904	8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe	78
PID 1904 wrote to memory of 1020	1904	8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe	78
PID 1904 wrote to memory of 4756	1904	8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe	79
PID 1904 wrote to memory of 4756	1904	8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe	79
PID 1904 wrote to memory of 4876	1904	8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe	80
PID 1904 wrote to memory of 4876	1904	8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe	80
PID 4756 wrote to memory of 4820	4756	cmd.exe	84
PID 4756 wrote to memory of 4820	4756	cmd.exe	84
PID 1876 wrote to memory of 3468	1876	vbc.exe	86
PID 1876 wrote to memory of 3468	1876	vbc.exe	86
PID 3468 wrote to memory of 1972	3468	duepth.exe	87
PID 3468 wrote to memory of 1972	3468	duepth.exe	87
PID 3468 wrote to memory of 1044	3468	duepth.exe	89
PID 3468 wrote to memory of 1044	3468	duepth.exe	89
PID 1044 wrote to memory of 2992	1044	gfhgfgjgf.exe	90
PID 1044 wrote to memory of 2992	1044	gfhgfgjgf.exe	90
PID 648 wrote to memory of 4788	648	ghghghdg.exe	93
PID 648 wrote to memory of 4788	648	ghghghdg.exe	93
PID 648 wrote to memory of 4788	648	ghghghdg.exe	93
PID 648 wrote to memory of 4788	648	ghghghdg.exe	93
PID 648 wrote to memory of 4788	648	ghghghdg.exe	93
PID 648 wrote to memory of 4788	648	ghghghdg.exe	93
PID 648 wrote to memory of 252	648	ghghghdg.exe	94
PID 648 wrote to memory of 252	648	ghghghdg.exe	94
PID 648 wrote to memory of 4092	648	ghghghdg.exe	95
PID 648 wrote to memory of 4092	648	ghghghdg.exe	95
PID 648 wrote to memory of 4704	648	ghghghdg.exe	97
PID 648 wrote to memory of 4704	648	ghghghdg.exe	97
PID 4092 wrote to memory of 3760	4092	cmd.exe	100
PID 4092 wrote to memory of 3760	4092	cmd.exe	100
PID 4812 wrote to memory of 1964	4812	ghghghdg.exe	102
PID 4812 wrote to memory of 1964	4812	ghghghdg.exe	102
PID 4812 wrote to memory of 1964	4812	ghghghdg.exe	102
PID 4812 wrote to memory of 1964	4812	ghghghdg.exe	102
PID 4812 wrote to memory of 1964	4812	ghghghdg.exe	102
PID 4812 wrote to memory of 1964	4812	ghghghdg.exe	102
PID 4812 wrote to memory of 3180	4812	ghghghdg.exe	103
PID 4812 wrote to memory of 3180	4812	ghghghdg.exe	103
PID 4812 wrote to memory of 4816	4812	ghghghdg.exe	104
PID 4812 wrote to memory of 4816	4812	ghghghdg.exe	104
PID 4812 wrote to memory of 3176	4812	ghghghdg.exe	105
PID 4812 wrote to memory of 3176	4812	ghghghdg.exe	105
PID 4816 wrote to memory of 4008	4816	cmd.exe	109
PID 4816 wrote to memory of 4008	4816	cmd.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe
"C:\Users\Admin\AppData\Local\Temp\8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Users\Admin\AppData\Local\Temp\duepth.exe
    "C:\Users\Admin\AppData\Local\Temp\duepth.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "hgfhjjhgj" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:1972
  - - C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe
      "C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1044
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "hgfhjjhgj" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:2992
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\ghghghdg"
  2⤵
  PID:1020
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:4820
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f.exe" "C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe"
  2⤵
  PID:4876

C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe
C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  2⤵
  PID:4788
- C:\Windows\system32\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\ghghghdg"
  2⤵
  PID:252
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:3760
- C:\Windows\system32\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe" "C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe"
  2⤵
  PID:4704

C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe
C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  2⤵
  PID:1964
- C:\Windows\system32\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\ghghghdg"
  2⤵
  PID:3180
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:4008
- C:\Windows\system32\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe" "C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe"
  2⤵
  PID:3176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ghghghdg.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ghghghdg.exe.log
Size 859B
SHA256 a6f7d3892a001df1aafe2eaf221a3b09a4fdad23ad642a62b9cc50fd25f9415f
MD5 b80ab36515c0740685e38a5cd01e292a
SHA1 ebea40ce14021888f2c869576ad62b98b7c73c8a
SHA512 a9ad31c000c2264f8a9b7bac6bc60edd7ecf0d1c946a4bb3e57d824283c6b65e59344e834bcbf563586211078ddb895af13e4c697bea2c4a907982bbc5fbd4a0
MD5 SHA1 SHA512

Submit Download

vbc.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\vbc.exe.log
Size 621B
SHA256 099681df52f46b8b55ff6054d9478e7c217c7711a6d6b7f582beb726264397ec
MD5 e78b7b65aca191c73caec56c1ad26a2b
SHA1 517274ac71b1427586ec48fd7d4628c789d64daa
SHA512 1b46e9dd005511d3e44bb11b55dbceea650f23dc1c1f46154ad7b37ecbb344f0c86175d370d9a6e4355428427b77201a7675a64b74bee8fd5eb5384f53ab1335
MD5 SHA1 SHA512

Submit Download

duepth.exe

Path C:\Users\Admin\AppData\Local\Temp\duepth.exe
Size 3.1MB
SHA256 996e8d1afc74090b75f936ca57b1570de64dff0dbcdbffa411f9f6ed814fc43f
MD5 96f1a72749b4abe9f92e364dcd059dcb
SHA1 0480af36fc245942261e67428f4a8b8910d861fd
SHA512 2386a5cebb41059293972879880142a087e18a1253c2d9c6b2eb28c5b1179410cf507a2dd6f3f166c99c1f780f15e6bcfbde228eac36616269158a04b9a06abe
SSDEEP 49152:Cvkt62XlaSFNWPjljiFa2RoUYIbD0G2LoGdiPTHHB72eh2NT:Cv462XlaSFNWPjljiFXRoUYIbD0G4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghghghdg.exe

Path C:\Users\Admin\AppData\Roaming\ghghghdg\ghghghdg.exe
Size 2.0MB
SHA256 8d007eefc7a40e5db7c83d900b3522e68782cd8d8d7b02768c774412b847ce6f
MD5 6c070805d0f04cc04cbabcf5c1e243df
SHA1 b4668ac9d9d4b64a4d9b9c3615a2bccebf408b75
SHA512 80914cbbd3fe3bd94f1ad48a92f0adb75291817cd2993e428df9da306bbf305773d64188b79c60a0ade1383b7f7c2f87af29bbef4e7a6f2695cee602fca5da39
SSDEEP 12288:ZCxv4m9vTKp5CU+b1GQ7wywPRQVZOZsNoo/zbMXQTGcCsqB9SNOuAxAEUV9l+:O5TKeU+wQ7wyuRaZEuG3q2IV9l
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/648-49-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/648-47-0x00000000019D0000-0x00000000019E0000-memory.dmp

Download

memory/648-44-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/1044-27-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/1044-40-0x000000001B960000-0x000000001B970000-memory.dmp

Download

memory/1044-39-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/1044-34-0x000000001BFC0000-0x000000001BFFC000-memory.dmp

Download

memory/1044-33-0x000000001BF60000-0x000000001BF72000-memory.dmp

Download

memory/1044-30-0x000000001C020000-0x000000001C0D2000-memory.dmp

Download

memory/1044-29-0x0000000002CE0000-0x0000000002D30000-memory.dmp

Download

memory/1044-28-0x000000001B960000-0x000000001B970000-memory.dmp

Download

memory/1876-38-0x0000021441370000-0x0000021441380000-memory.dmp

Download

memory/1876-37-0x0000021441370000-0x0000021441380000-memory.dmp

Download

memory/1876-1-0x0000000140000000-0x00000001400A2000-memory.dmp

Download

memory/1876-4-0x000002145B470000-0x000002145B574000-memory.dmp

Download

memory/1876-5-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/1876-10-0x0000021442C00000-0x0000021442C56000-memory.dmp

Download

memory/1876-13-0x0000021441370000-0x0000021441380000-memory.dmp

Download

memory/1876-35-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/1876-36-0x0000021441370000-0x0000021441380000-memory.dmp

Download

memory/1876-6-0x0000021441370000-0x0000021441380000-memory.dmp

Download

memory/1876-12-0x0000021441370000-0x0000021441380000-memory.dmp

Download

memory/1876-11-0x000002145B570000-0x000002145B5BC000-memory.dmp

Download

memory/1904-3-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/1904-7-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/1904-0-0x0000000000760000-0x000000000080A000-memory.dmp

Download

memory/1964-59-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/1964-63-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/1964-62-0x00000128D66F0000-0x00000128D6700000-memory.dmp

Download

memory/1964-61-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/3468-26-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/3468-19-0x00000000006D0000-0x00000000009F4000-memory.dmp

Download

memory/3468-18-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/3468-20-0x0000000002C50000-0x0000000002C60000-memory.dmp

Download

memory/4788-45-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/4788-52-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/4788-50-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/4788-46-0x000001B4F0640000-0x000001B4F0650000-memory.dmp

Download

memory/4812-55-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download

memory/4812-56-0x000000001B6E0000-0x000000001B6F0000-memory.dmp

Download

memory/4812-60-0x00007FFEE05A0000-0x00007FFEE1062000-memory.dmp

Download