quasar | 0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79

General

Target

0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exe
Size

3.3MB
MD5

88daabfadfec7379a7b25ff1602dd7bd
SHA1

65c3f35d7150df340ca797a2662437933178c9b5
SHA256

0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79
SHA512

7a205e62c3608fcad774dea6384ae7da904a2ba090b9b6f30454bd23eab9f54a1dbaffd72c3534c554c468a5efaa90d75f659e74fdba3ee8581cbb9356c68aa2
SSDEEP

49152:7vBt62XlaSFNWPjljiFa2RoUYI1bxNESEgk/iSLoGdDTHHB72eh2NT:7vr62XlaSFNWPjljiFXRoUYIJxbc

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.12.185:4782

Mutex

15144cdb-7c06-478d-9be3-8228cfe2eee6

Attributes

encryption_key
5FCAB94261E1E836E0ECC532E93B636646535E65
install_name
Conhost.exe
log_directory
Scex
reconnect_delay
3000
startup_key
Google Chrome
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2036-0-0x0000000000C20000-0x0000000000F68000-memory.dmp	family_quasar
C:\Windows\System32\SubDir\Conhost.exe	family_quasar
behavioral1/memory/2224-9-0x00000000011A0000-0x00000000014E8000-memory.dmp	family_quasar

Detects Windows executables referencing non-Windows User-Agents 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2036-0-0x0000000000C20000-0x0000000000F68000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
C:\Windows\System32\SubDir\Conhost.exe	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2224-9-0x00000000011A0000-0x00000000014E8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2036-0-0x0000000000C20000-0x0000000000F68000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
C:\Windows\System32\SubDir\Conhost.exe	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2224-9-0x00000000011A0000-0x00000000014E8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing common artifacts observed in infostealers 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2036-0-0x0000000000C20000-0x0000000000F68000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer
C:\Windows\System32\SubDir\Conhost.exe	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral1/memory/2224-9-0x00000000011A0000-0x00000000014E8000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer

Executes dropped EXE 1 IoCs

Processes:

Conhost.exe

pid process

2224 Conhost.exe

pid	process
2224	Conhost.exe

Drops file in System32 directory 5 IoCs

Processes:

0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exeConhost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\SubDir	0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exe
File opened for modification	C:\Windows\system32\SubDir\Conhost.exe	Conhost.exe
File opened for modification	C:\Windows\system32\SubDir	Conhost.exe
File created	C:\Windows\system32\SubDir\Conhost.exe	0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exe
File opened for modification	C:\Windows\system32\SubDir\Conhost.exe	0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2432 schtasks.exe
2572 schtasks.exe

pid	process
2432	schtasks.exe
2572	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exeConhost.exe

description	pid	process
Token: SeDebugPrivilege	2036	0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exe
Token: SeDebugPrivilege	2224	Conhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Conhost.exe

pid process

2224 Conhost.exe

pid	process
2224	Conhost.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exeConhost.exe

description	pid	process	target process
PID 2036 wrote to memory of 2432	2036	0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exe	schtasks.exe
PID 2036 wrote to memory of 2432	2036	0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exe	schtasks.exe
PID 2036 wrote to memory of 2432	2036	0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exe	schtasks.exe
PID 2036 wrote to memory of 2224	2036	0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exe	Conhost.exe
PID 2036 wrote to memory of 2224	2036	0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exe	Conhost.exe
PID 2036 wrote to memory of 2224	2036	0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exe	Conhost.exe
PID 2224 wrote to memory of 2572	2224	Conhost.exe	schtasks.exe
PID 2224 wrote to memory of 2572	2224	Conhost.exe	schtasks.exe
PID 2224 wrote to memory of 2572	2224	Conhost.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exe
"C:\Users\Admin\AppData\Local\Temp\0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Google Chrome" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Conhost.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2432

C:\Windows\system32\SubDir\Conhost.exe
"C:\Windows\system32\SubDir\Conhost.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Google Chrome" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Conhost.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\SubDir\Conhost.exe
Filesize
3.3MB

MD5
88daabfadfec7379a7b25ff1602dd7bd

SHA1
65c3f35d7150df340ca797a2662437933178c9b5

SHA256
0268b6f80286ff64286d42529c76f9e744932ca5a650b7e9ef2c3c0afc01af79

SHA512
7a205e62c3608fcad774dea6384ae7da904a2ba090b9b6f30454bd23eab9f54a1dbaffd72c3534c554c468a5efaa90d75f659e74fdba3ee8581cbb9356c68aa2

Download Submit
memory/2036-0-0x0000000000C20000-0x0000000000F68000-memory.dmp

Filesize
3.3MB

Download
memory/2036-1-0x000007FEF5260000-0x000007FEF5C4C000-memory.dmp

Filesize
9.9MB

Download
memory/2036-2-0x0000000000B10000-0x0000000000B90000-memory.dmp

Filesize
512KB

Download
memory/2036-8-0x000007FEF5260000-0x000007FEF5C4C000-memory.dmp

Filesize
9.9MB

Download
memory/2224-10-0x000007FEF5260000-0x000007FEF5C4C000-memory.dmp

Filesize
9.9MB

Download
memory/2224-11-0x000000001B070000-0x000000001B0F0000-memory.dmp

Filesize
512KB

Download
memory/2224-9-0x00000000011A0000-0x00000000014E8000-memory.dmp

Filesize
3.3MB

Download
memory/2224-12-0x000007FEF5260000-0x000007FEF5C4C000-memory.dmp

Filesize
9.9MB

Download
memory/2224-13-0x000000001B070000-0x000000001B0F0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads