quasar | a2b66f9f80d2add5e7b13f9e75b6c964e53d7aa2e52065b469b83f7e7c31fa7c

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
28-04-2024 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2b66f9f80d2add5e7b13f9e75b6c964e53d7aa2e52065b469b83f7e7c31fa7c.exe
Size

3.1MB
MD5

e0537c132607a98cb4133bb066a74db2
SHA1

6a9b6335b9f091e0480fc7167b4d7304677ce08b
SHA256

a2b66f9f80d2add5e7b13f9e75b6c964e53d7aa2e52065b469b83f7e7c31fa7c
SHA512

eb4550090c17c2379455475f91fc637769ab72754fb30f1dd2228a0f18bec86e3eca46cee9f1201cfc3be8314b153633f22cced3cc2467d90d6b3b9d3e7bf65b
SSDEEP

49152:6vxt62XlaSFNWPjljiFa2RoUYIaPRJ6LbR3LoGdATHHB72eh2NT:6v762XlaSFNWPjljiFXRoUYIaPRJ6d

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.10.193:4455

Mutex

71f9480f-0626-42cf-aad4-d6f84c1c5e58

Attributes

encryption_key
C030D8F7F18781EB62BC0CFFC3F2B361D2649603
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
QClient
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3288-0-0x0000000000690000-0x00000000009B4000-memory.dmp	family_quasar

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3168 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a2b66f9f80d2add5e7b13f9e75b6c964e53d7aa2e52065b469b83f7e7c31fa7c.exe

description pid process

Token: SeDebugPrivilege 3288 a2b66f9f80d2add5e7b13f9e75b6c964e53d7aa2e52065b469b83f7e7c31fa7c.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a2b66f9f80d2add5e7b13f9e75b6c964e53d7aa2e52065b469b83f7e7c31fa7c.exe

pid process

3288 a2b66f9f80d2add5e7b13f9e75b6c964e53d7aa2e52065b469b83f7e7c31fa7c.exe

pid	process
3168	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	3288	a2b66f9f80d2add5e7b13f9e75b6c964e53d7aa2e52065b469b83f7e7c31fa7c.exe

pid	process
3288	a2b66f9f80d2add5e7b13f9e75b6c964e53d7aa2e52065b469b83f7e7c31fa7c.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

a2b66f9f80d2add5e7b13f9e75b6c964e53d7aa2e52065b469b83f7e7c31fa7c.exe

description	pid	process	target process
PID 3288 wrote to memory of 3168	3288	a2b66f9f80d2add5e7b13f9e75b6c964e53d7aa2e52065b469b83f7e7c31fa7c.exe	schtasks.exe
PID 3288 wrote to memory of 3168	3288	a2b66f9f80d2add5e7b13f9e75b6c964e53d7aa2e52065b469b83f7e7c31fa7c.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a2b66f9f80d2add5e7b13f9e75b6c964e53d7aa2e52065b469b83f7e7c31fa7c.exe
"C:\Users\Admin\AppData\Local\Temp\a2b66f9f80d2add5e7b13f9e75b6c964e53d7aa2e52065b469b83f7e7c31fa7c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "QClient" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3288-0-0x0000000000690000-0x00000000009B4000-memory.dmp

Filesize
3.1MB

Download
memory/3288-1-0x00007FFAC0890000-0x00007FFAC1352000-memory.dmp

Filesize
10.8MB

Download
memory/3288-2-0x0000000001340000-0x0000000001350000-memory.dmp

Filesize
64KB

Download
memory/3288-3-0x000000001BDF0000-0x000000001BE40000-memory.dmp

Filesize
320KB

Download
memory/3288-4-0x000000001BF00000-0x000000001BFB2000-memory.dmp

Filesize
712KB

Download
memory/3288-5-0x00007FFAC0890000-0x00007FFAC1352000-memory.dmp

Filesize
10.8MB

Download
memory/3288-6-0x0000000001340000-0x0000000001350000-memory.dmp

Filesize
64KB

Download