quasar | 31b494be325fc9c97031135886454b1370e5e3608c757f74784c6b6fb2fb5c99

General

Target

qauasariscrypted.exe
Size

6.4MB
MD5

eb0beafcb365cd20eb00ff9e19b73232
SHA1

1a4470109418e1110588d52851e320ecefcba7de
SHA256

31b494be325fc9c97031135886454b1370e5e3608c757f74784c6b6fb2fb5c99
SHA512

8dff151e81b5ce3c4f51b1f24a6e7654c3008d81b6652e6d2f7fabc42d341e9db703b12f83ccf9471514498af3c1763ef97f132ad36302de8ccd984fbf52d52f
SSDEEP

98304:DpgFmZKkYcZ4YSQrKF78eHm8Xdt6Zz55JJ9enfr:uFmZOcZtrKFFHm8t0NJJo

Score

10^/10

quasar office04 persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

185.196.10.233:4782

Mutex

b0fcdfbd-bdd4-4a5d-8ab1-7217539d4db6

Attributes

encryption_key
0EC03133971030F6D05E6D59F71626F6543BBE65
install_name
gfdgfdg.exe
log_directory
Logs
reconnect_delay
3000
startup_key
fgfdhdgg
subdirectory
gfgfgf

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/1196-16-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/1196-18-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/1196-21-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\qauasariscrypted = "\"C:\\Users\\Admin\\qauasariscrypted.exe\""	qauasariscrypted.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2952 set thread context of 1196	2952	qauasariscrypted.exe	32

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2928	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2928	2952	qauasariscrypted.exe	29
PID 2952 wrote to memory of 2928	2952	qauasariscrypted.exe	29
PID 2952 wrote to memory of 2928	2952	qauasariscrypted.exe	29
PID 2952 wrote to memory of 2544	2952	qauasariscrypted.exe	31
PID 2952 wrote to memory of 2544	2952	qauasariscrypted.exe	31
PID 2952 wrote to memory of 2544	2952	qauasariscrypted.exe	31
PID 2952 wrote to memory of 2544	2952	qauasariscrypted.exe	31
PID 2952 wrote to memory of 1196	2952	qauasariscrypted.exe	32
PID 2952 wrote to memory of 1196	2952	qauasariscrypted.exe	32
PID 2952 wrote to memory of 1196	2952	qauasariscrypted.exe	32
PID 2952 wrote to memory of 1196	2952	qauasariscrypted.exe	32
PID 2952 wrote to memory of 1196	2952	qauasariscrypted.exe	32
PID 2952 wrote to memory of 1196	2952	qauasariscrypted.exe	32
PID 2952 wrote to memory of 1196	2952	qauasariscrypted.exe	32
PID 2952 wrote to memory of 1196	2952	qauasariscrypted.exe	32
PID 2952 wrote to memory of 1196	2952	qauasariscrypted.exe	32

C:\Users\Admin\AppData\Local\Temp\qauasariscrypted.exe
"C:\Users\Admin\AppData\Local\Temp\qauasariscrypted.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:2544
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-14-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1196-21-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1196-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1196-18-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1196-16-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1196-15-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2928-9-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/2928-13-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2928-11-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/2928-10-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/2928-8-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2928-4-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2928-7-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/2928-5-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2928-6-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads