quasar | 54d2d49ad4366ffc67625a32754dee1d802c2780de2fd8d1d3c9609c0f584781

Analysis

max time kernel
128s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
579ebb1309ad953fa0cb52c33b190baa.exe
Size 786KB
Sample240409-2k2aasag6y
SHA256 54d2d49ad4366ffc67625a32754dee1d802c2780de2fd8d1d3c9609c0f584781
MD5 579ebb1309ad953fa0cb52c33b190baa
SHA1 70ccb8c950d96a7e6c32d09c307227f271a627ba
SHA512 2b9d5413626358fae10013e2fd214ec5e66cf7c30665f896563a39f3564ef475cbda8de14cb6f9260d5f49b70a1967d1097c0f855e7985ebed78d2a0c25390d4
SSDEEP 24576:6O7r0f+STf0QcR9CTsPsOcs1kITzH9FHB2PpO:6gAf+YMQceTs1t1/TzdFh20
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

83.147.53.145:3700

Mutex

QSR_MUTEX_6WQThXDTXhAO4iLfWV

Attributes

encryption_key
rylGzNSu4oGtwQbffX0U
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/3988-46-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	579ebb1309ad953fa0cb52c33b190baa.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 2 IoCs

pid	Process
216	Client.exe
1976	Client.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3132 set thread context of 3988	3132	579ebb1309ad953fa0cb52c33b190baa.exe	103
PID 216 set thread context of 1976	216	Client.exe	111

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4776	schtasks.exe
5020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3132	579ebb1309ad953fa0cb52c33b190baa.exe
3964	powershell.exe
3964	powershell.exe
5012	powershell.exe
5012	powershell.exe
3132	579ebb1309ad953fa0cb52c33b190baa.exe
3132	579ebb1309ad953fa0cb52c33b190baa.exe
3132	579ebb1309ad953fa0cb52c33b190baa.exe
3132	579ebb1309ad953fa0cb52c33b190baa.exe
3964	powershell.exe
5012	powershell.exe
216	Client.exe
4748	powershell.exe
4624	powershell.exe
216	Client.exe
4748	powershell.exe
4624	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3132	579ebb1309ad953fa0cb52c33b190baa.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	3988	579ebb1309ad953fa0cb52c33b190baa.exe
Token: SeDebugPrivilege	216	Client.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	1976	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	Client.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 3964	3132	579ebb1309ad953fa0cb52c33b190baa.exe	96
PID 3132 wrote to memory of 3964	3132	579ebb1309ad953fa0cb52c33b190baa.exe	96
PID 3132 wrote to memory of 3964	3132	579ebb1309ad953fa0cb52c33b190baa.exe	96
PID 3132 wrote to memory of 5012	3132	579ebb1309ad953fa0cb52c33b190baa.exe	98
PID 3132 wrote to memory of 5012	3132	579ebb1309ad953fa0cb52c33b190baa.exe	98
PID 3132 wrote to memory of 5012	3132	579ebb1309ad953fa0cb52c33b190baa.exe	98
PID 3132 wrote to memory of 4776	3132	579ebb1309ad953fa0cb52c33b190baa.exe	100
PID 3132 wrote to memory of 4776	3132	579ebb1309ad953fa0cb52c33b190baa.exe	100
PID 3132 wrote to memory of 4776	3132	579ebb1309ad953fa0cb52c33b190baa.exe	100
PID 3132 wrote to memory of 3212	3132	579ebb1309ad953fa0cb52c33b190baa.exe	102
PID 3132 wrote to memory of 3212	3132	579ebb1309ad953fa0cb52c33b190baa.exe	102
PID 3132 wrote to memory of 3212	3132	579ebb1309ad953fa0cb52c33b190baa.exe	102
PID 3132 wrote to memory of 3988	3132	579ebb1309ad953fa0cb52c33b190baa.exe	103
PID 3132 wrote to memory of 3988	3132	579ebb1309ad953fa0cb52c33b190baa.exe	103
PID 3132 wrote to memory of 3988	3132	579ebb1309ad953fa0cb52c33b190baa.exe	103
PID 3132 wrote to memory of 3988	3132	579ebb1309ad953fa0cb52c33b190baa.exe	103
PID 3132 wrote to memory of 3988	3132	579ebb1309ad953fa0cb52c33b190baa.exe	103
PID 3132 wrote to memory of 3988	3132	579ebb1309ad953fa0cb52c33b190baa.exe	103
PID 3132 wrote to memory of 3988	3132	579ebb1309ad953fa0cb52c33b190baa.exe	103
PID 3132 wrote to memory of 3988	3132	579ebb1309ad953fa0cb52c33b190baa.exe	103
PID 3988 wrote to memory of 216	3988	579ebb1309ad953fa0cb52c33b190baa.exe	104
PID 3988 wrote to memory of 216	3988	579ebb1309ad953fa0cb52c33b190baa.exe	104
PID 3988 wrote to memory of 216	3988	579ebb1309ad953fa0cb52c33b190baa.exe	104
PID 216 wrote to memory of 4748	216	Client.exe	105
PID 216 wrote to memory of 4748	216	Client.exe	105
PID 216 wrote to memory of 4748	216	Client.exe	105
PID 216 wrote to memory of 4624	216	Client.exe	107
PID 216 wrote to memory of 4624	216	Client.exe	107
PID 216 wrote to memory of 4624	216	Client.exe	107
PID 216 wrote to memory of 5020	216	Client.exe	108
PID 216 wrote to memory of 5020	216	Client.exe	108
PID 216 wrote to memory of 5020	216	Client.exe	108
PID 216 wrote to memory of 1976	216	Client.exe	111
PID 216 wrote to memory of 1976	216	Client.exe	111
PID 216 wrote to memory of 1976	216	Client.exe	111
PID 216 wrote to memory of 1976	216	Client.exe	111
PID 216 wrote to memory of 1976	216	Client.exe	111
PID 216 wrote to memory of 1976	216	Client.exe	111
PID 216 wrote to memory of 1976	216	Client.exe	111
PID 216 wrote to memory of 1976	216	Client.exe	111

C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe
"C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3964
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YXiUvROAyTyYWN.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YXiUvROAyTyYWN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6561.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4776
- C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe
  "C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe"
  2⤵
  PID:3212
- C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe
  "C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:216
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4748
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YXiUvROAyTyYWN.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4624
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YXiUvROAyTyYWN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9CBD.tmp"
      4⤵
      Creates scheduled task(s)
      PID:5020
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

579ebb1309ad953fa0cb52c33b190baa.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\579ebb1309ad953fa0cb52c33b190baa.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 c0281e0db8d67007e1e51e94a391c2f7a3f746e94ef2646a05d0160bf9196fbc
MD5 cd48552ac250ebfe93447bc75ccfe442
SHA1 03b5823247ec794a61580a8115ee74fec241f28f
SHA512 a57d0f1b26d53ce67ad6fdcd683b8f2e4d4e1abfd455a33f765d1a18af77f0d47b1af37b8405e2d5b9658b706984587ded79e94172178f8fe279b0d9cdfe4295
SSDEEP 384:4sf+BO9i+R5QgIJtk0izJk+o9o1DTpK6seYLME/h03SoZGfYSg0jEDkeQ0gdItk6:VfJlakDejoVTpNgrKSZWKEDjCq3
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 e8354eb3d3ca747f53a7ed832fa4a7810413a93c379c25d6b4ddf9aeb6cafe87
MD5 a8dc1f6fa23f660eab56064627925ae5
SHA1 1f68e86745fe006912ac9a76ec10bfd251dcccc9
SHA512 ef049cbce2294b4cdab535245e7f9ec1d4e69b04736e9197bfeeb6179b13653bbf32bed29b1f2c3a9dc12e708e6b6041a60d4f3d41e5dc62d667bf6dd4eb1559
SSDEEP 384:Z6+BI91wXAC8CBUizJkCAThK6seY1aDGZcifE6V65Eoqk5q+nUekKkki0SO1:4R0Z8mjeCAThNndifxw5PqcUeiki0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_avvdzaap.n5z.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_avvdzaap.n5z.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmp6561.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6561.tmp
Size 1KB
SHA256 fefdc4e55a41f64c28ce0f2a206d7967130198dabc2066abe042cf52f17b5637
MD5 03ed54d29052e596b4598f41cacbe969
SHA1 0cf8a0e23862e6905ba6d71c82748846d267a9b4
SHA512 a04892a880d2cf3a805065e2857f8fbf3af1dd8a9f06ac5d247193c24953420de24bab1f24ef23516ca7ae9646cc8441f7522cb1a2b8575891a554fd420d29c2
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 786KB
SHA256 54d2d49ad4366ffc67625a32754dee1d802c2780de2fd8d1d3c9609c0f584781
MD5 579ebb1309ad953fa0cb52c33b190baa
SHA1 70ccb8c950d96a7e6c32d09c307227f271a627ba
SHA512 2b9d5413626358fae10013e2fd214ec5e66cf7c30665f896563a39f3564ef475cbda8de14cb6f9260d5f49b70a1967d1097c0f855e7985ebed78d2a0c25390d4
SSDEEP 24576:6O7r0f+STf0QcR9CTsPsOcs1kITzH9FHB2PpO:6gAf+YMQceTs1t1/TzdFh20
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-90-0x0000000005620000-0x0000000005630000-memory.dmp

Download

memory/216-137-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/216-89-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/1976-136-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/3132-8-0x0000000006670000-0x000000000670E000-memory.dmp

Download

memory/3132-3-0x0000000005280000-0x0000000005312000-memory.dmp

Download

memory/3132-2-0x0000000005830000-0x0000000005DD4000-memory.dmp

Download

memory/3132-1-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/3132-9-0x0000000008F80000-0x000000000901C000-memory.dmp

Download

memory/3132-20-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/3132-4-0x00000000051B0000-0x00000000051C0000-memory.dmp

Download

memory/3132-7-0x0000000006400000-0x000000000640C000-memory.dmp

Download

memory/3132-0-0x00000000008A0000-0x000000000096A000-memory.dmp

Download

memory/3132-6-0x0000000006860000-0x000000000687A000-memory.dmp

Download

memory/3132-49-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/3132-5-0x0000000005220000-0x000000000522A000-memory.dmp

Download

memory/3964-17-0x0000000005050000-0x0000000005678000-memory.dmp

Download

memory/3964-88-0x0000000002630000-0x0000000002640000-memory.dmp

Download

memory/3964-96-0x00000000074E0000-0x00000000074EE000-memory.dmp

Download

memory/3964-14-0x00000000049E0000-0x0000000004A16000-memory.dmp

Download

memory/3964-25-0x0000000005790000-0x00000000057F6000-memory.dmp

Download

memory/3964-94-0x0000000007530000-0x00000000075C6000-memory.dmp

Download

memory/3964-51-0x0000000005F80000-0x0000000005F9E000-memory.dmp

Download

memory/3964-52-0x0000000006030000-0x000000000607C000-memory.dmp

Download

memory/3964-105-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/3964-16-0x0000000002630000-0x0000000002640000-memory.dmp

Download

memory/3964-15-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/3964-26-0x0000000005950000-0x00000000059B6000-memory.dmp

Download

memory/3964-73-0x0000000075150000-0x000000007519C000-memory.dmp

Download

memory/3964-86-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/3964-18-0x0000000002630000-0x0000000002640000-memory.dmp

Download

memory/3964-23-0x00000000056F0000-0x0000000005712000-memory.dmp

Download

memory/3964-70-0x000000007EFD0000-0x000000007EFE0000-memory.dmp

Download

memory/3988-53-0x0000000005CF0000-0x0000000005D02000-memory.dmp

Download

memory/3988-87-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/3988-67-0x0000000006370000-0x00000000063AC000-memory.dmp

Download

memory/3988-46-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3988-48-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/3988-50-0x0000000004F80000-0x0000000004F90000-memory.dmp

Download

memory/4624-113-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/4624-123-0x0000000000B40000-0x0000000000B50000-memory.dmp

Download

memory/4748-140-0x000000007F800000-0x000000007F810000-memory.dmp

Download

memory/4748-108-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/4748-109-0x00000000045F0000-0x0000000004600000-memory.dmp

Download

memory/4748-139-0x0000000005C10000-0x0000000005C5C000-memory.dmp

Download

memory/4748-110-0x00000000045F0000-0x0000000004600000-memory.dmp

Download

memory/4748-112-0x00000000054B0000-0x0000000005804000-memory.dmp

Download

memory/5012-66-0x00000000071E0000-0x00000000071FE000-memory.dmp

Download

memory/5012-99-0x00000000078D0000-0x00000000078D8000-memory.dmp

Download

memory/5012-98-0x00000000078F0000-0x000000000790A000-memory.dmp

Download

memory/5012-97-0x00000000077F0000-0x0000000007804000-memory.dmp

Download

memory/5012-95-0x00000000077B0000-0x00000000077C1000-memory.dmp

Download

memory/5012-93-0x0000000007620000-0x000000000762A000-memory.dmp

Download

memory/5012-106-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/5012-92-0x00000000075B0000-0x00000000075CA000-memory.dmp

Download

memory/5012-91-0x0000000007BF0000-0x000000000826A000-memory.dmp

Download

memory/5012-69-0x0000000007450000-0x00000000074F3000-memory.dmp

Download

memory/5012-68-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Download

memory/5012-55-0x000000007EFB0000-0x000000007EFC0000-memory.dmp

Download

memory/5012-56-0x0000000075150000-0x000000007519C000-memory.dmp

Download

memory/5012-54-0x0000000007200000-0x0000000007232000-memory.dmp

Download

memory/5012-45-0x0000000005DB0000-0x0000000006104000-memory.dmp

Download

memory/5012-21-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Download

memory/5012-24-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Download

memory/5012-19-0x00000000748A0000-0x0000000075050000-memory.dmp

Download