Malware Analysis Report

2024-10-23 21:29

Sample ID 240417-rcgwksah85
Target 2e98ad011bffb395d3fe21d54a06d2843f264ad313219f0c3607b6cfe414a180
SHA256 2e98ad011bffb395d3fe21d54a06d2843f264ad313219f0c3607b6cfe414a180
Tags
office04 quasar spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2e98ad011bffb395d3fe21d54a06d2843f264ad313219f0c3607b6cfe414a180

Threat Level: Known bad

The file 2e98ad011bffb395d3fe21d54a06d2843f264ad313219f0c3607b6cfe414a180 was found to be: Known bad.

Malicious Activity Summary

office04 quasar spyware trojan

Quasar family

Quasar payload

Quasar RAT

Looks up external IP address via web service

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-17 14:02

Signatures

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-17 14:02

Reported

2024-04-17 14:05

Platform

win7-20240220-en

Max time kernel

134s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe C:\Windows\SysWOW64\cmd.exe
PID 1992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe C:\Windows\SysWOW64\cmd.exe
PID 1992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe C:\Windows\SysWOW64\cmd.exe
PID 1992 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe C:\Windows\SysWOW64\cmd.exe
PID 2532 wrote to memory of 2636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2532 wrote to memory of 2636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2532 wrote to memory of 2636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2532 wrote to memory of 2636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2532 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2532 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2532 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2532 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2532 wrote to memory of 2464 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe
PID 2532 wrote to memory of 2464 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe
PID 2532 wrote to memory of 2464 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe
PID 2532 wrote to memory of 2464 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe
PID 2464 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe C:\Windows\SysWOW64\cmd.exe
PID 2464 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe C:\Windows\SysWOW64\cmd.exe
PID 2464 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe C:\Windows\SysWOW64\cmd.exe
PID 2464 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe C:\Windows\SysWOW64\cmd.exe
PID 1276 wrote to memory of 860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1276 wrote to memory of 860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1276 wrote to memory of 860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1276 wrote to memory of 860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1276 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1276 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1276 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1276 wrote to memory of 1368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1276 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe
PID 1276 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe
PID 1276 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe
PID 1276 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe

Processes

C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe

"C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\h0w1scQY7aTl.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe

"C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\aMySqBG8buAo.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe

"C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 qutz.duckdns.org udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 qutz.duckdns.org udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 qutz.duckdns.org udp
CO 186.169.55.162:4782 qutz.duckdns.org tcp
CO 186.169.55.162:4782 qutz.duckdns.org tcp
CO 186.169.55.162:4782 qutz.duckdns.org tcp
US 8.8.8.8:53 qutz.duckdns.org udp
CO 186.169.55.162:4782 qutz.duckdns.org tcp
CO 186.169.55.162:4782 qutz.duckdns.org tcp

Files

memory/1992-0-0x00000000010F0000-0x000000000114E000-memory.dmp

memory/1992-1-0x0000000074010000-0x00000000746FE000-memory.dmp

memory/1992-2-0x0000000000EC0000-0x0000000000F00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\h0w1scQY7aTl.bat

MD5 fde2584ff84009e9031c936c766749eb
SHA1 b53a0846e87e45c7078683abc959acc95556cb28
SHA256 51f224906be4df96d0689cd24ec126d7ad40e4186bdb478591207095388333a1
SHA512 a419100bf95288fe029a4875022be294cd8785f9f485a9c201757111765cd5f4b061623c2ede161b28c27aa937ee271faa7eab4370b94f35d5296a28042eaf26

memory/1992-12-0x0000000074010000-0x00000000746FE000-memory.dmp

memory/2464-14-0x0000000073FC0000-0x00000000746AE000-memory.dmp

memory/2464-13-0x0000000000110000-0x000000000016E000-memory.dmp

memory/2464-15-0x0000000004A10000-0x0000000004A50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\aMySqBG8buAo.bat

MD5 8c12c473599ecf4ae0ed801922ef8f7c
SHA1 31d410edc8608793dda7ad46190bcad427241864
SHA256 ceeabc3148454d850c43e4bbdee4d9b982673e8bdc9563f42d37fadca72f24bf
SHA512 067b6ddd74614ef032788e776dd4f7b264c71283d012181d38a0883976b224135521f8b51bdcf1b86cab1f059f608ce33a80f9f206eb10881e93cea2beb63045

memory/2464-25-0x0000000073FC0000-0x00000000746AE000-memory.dmp

memory/2344-26-0x0000000000AA0000-0x0000000000AFE000-memory.dmp

memory/2344-28-0x0000000004AD0000-0x0000000004B10000-memory.dmp

memory/2344-27-0x0000000074010000-0x00000000746FE000-memory.dmp

memory/2344-29-0x0000000074010000-0x00000000746FE000-memory.dmp

memory/2344-30-0x0000000004AD0000-0x0000000004B10000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-17 14:02

Reported

2024-04-17 14:06

Platform

win10v2004-20240412-en

Max time kernel

145s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe

"C:\Users\Admin\AppData\Local\Temp\38632595e5ebb1ec4ed87327df02ffaf844e49559c2e881cb801f6c1e5026b7d.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 248.81.21.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 qutz.duckdns.org udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
CO 186.169.55.162:4782 qutz.duckdns.org tcp
CO 186.169.55.162:4782 qutz.duckdns.org tcp
CO 186.169.55.162:4782 qutz.duckdns.org tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 qutz.duckdns.org udp
CO 186.169.55.162:4782 qutz.duckdns.org tcp
CO 186.169.55.162:4782 qutz.duckdns.org tcp
US 8.8.8.8:53 90.65.42.20.in-addr.arpa udp

Files

memory/2040-0-0x0000000075040000-0x00000000757F0000-memory.dmp

memory/2040-1-0x0000000000B00000-0x0000000000B5E000-memory.dmp

memory/2040-2-0x0000000005B20000-0x00000000060C4000-memory.dmp

memory/2040-3-0x0000000005570000-0x0000000005602000-memory.dmp

memory/2040-4-0x0000000005640000-0x0000000005650000-memory.dmp

memory/2040-5-0x0000000005950000-0x00000000059B6000-memory.dmp

memory/2040-6-0x0000000005B00000-0x0000000005B12000-memory.dmp

memory/2040-7-0x0000000006AF0000-0x0000000006B2C000-memory.dmp

memory/2040-8-0x0000000075040000-0x00000000757F0000-memory.dmp

memory/2040-9-0x0000000005640000-0x0000000005650000-memory.dmp

memory/2040-10-0x0000000006CB0000-0x0000000006CBA000-memory.dmp