quasar | 411f8ed8c49738fa38a56ed8f991d556227d13602e83186e66ae1c4f821c940b

Analysis

max time kernel
299s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mono.Cecil.Mdb.dll
Size 42KB
Sample240503-3ffngage8z
SHA256 411f8ed8c49738fa38a56ed8f991d556227d13602e83186e66ae1c4f821c940b
MD5 1c6aca0f1b1fa1661fc1e43c79334f7c
SHA1 ec0f591a6d12e1ea7dc8714ec7e5ad7a04ef455d
SHA512 1c59e939d108f15881d29fe4ced4e5fa4a4476394b58b6eb464da77192cb8fe9221b7cd780af4596914d4cce7c3fc53f1bb567f944c58829de8efbe1fd87be76
SSDEEP 768:Ar5EYZep98C87KHeBUZwrEzsEAnbF+em50KktmM4CRIcZwMRTIzMAtpw:Ar59g98C87KHeBUb5AnZG+zdwMRTzAtS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

98.239.92.121:4782
192.168.1.12:4782

Mutex

15238486-bf41-43e5-9f35-44a0f5145609

Attributes

encryption_key
43F524566962F46500ADB67A91EE294B50862AB9
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023bcc-98.dat	family_quasar
behavioral2/memory/4436-131-0x0000000000210000-0x0000000000534000-memory.dmp	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
4436	test.exe
3324	Client.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1620	schtasks.exe
4248	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133592524457831216"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3556	chrome.exe
3556	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe
2252	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeDebugPrivilege	4436	test.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeDebugPrivilege	3324	Client.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3324	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 2584	3556	chrome.exe	98
PID 3556 wrote to memory of 2584	3556	chrome.exe	98
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4764	3556	chrome.exe	99
PID 3556 wrote to memory of 4304	3556	chrome.exe	100
PID 3556 wrote to memory of 4304	3556	chrome.exe	100
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101
PID 3556 wrote to memory of 4452	3556	chrome.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Mono.Cecil.Mdb.dll,#1
1⤵
PID:2208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd82eacc40,0x7ffd82eacc4c,0x7ffd82eacc58
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1968,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1844,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2156,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4492,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4580,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4824,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4672,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4944,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3848,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3688,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3540,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4788,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4636,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5452,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:1888
- C:\Users\Admin\Downloads\test.exe
  "C:\Users\Admin\Downloads\test.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4436
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1620
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3324
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5584,i,5013930847469008482,17226847835295941698,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2252

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9f82ff42-700c-4611-ba71-b0d15a3ea8e5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9f82ff42-700c-4611-ba71-b0d15a3ea8e5.tmp
Size 9KB
SHA256 6b8e9dbcdeb13ac41b0d894e1cd027bce80cf33718d3983fcbcf56b5b186ab1b
MD5 50a3e5b9c2f33956b15ee42a6883deb7
SHA1 a693181274261b805ac0743b30a075eb979c7f17
SHA512 8e0e9ca391ab21d2035bcb5fb520473330fffb2c99ad0f05280b4f2c2375420a34bc5e3b50a6fa32625716427e1c913a0e031330f24519b0a8bb42a9b19809d8
SSDEEP 192:5PoNB4PueJhZHV+Fctks+lkwoZPo6yIsnVdg4:5PoDKhGWkpIr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d8dc931fa6b317b5bacdd8b91a7b8980c3d2c4ede286bb54345abe976110eef7
MD5 4d2f4d929802c8a337aef512031fafae
SHA1 bf66abb3763f0b0026f86039f49afd49d8d3fe06
SHA512 a38a7619112c77c6898b5d3b8f72c260bea0c49e43b5405249dd82da346eccfe85ccfe300e33bb96dc6a5f05338d32d798017dd4ecb85c39096ddfdbad32572d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 a63a42c21bace8842fbf13ade593917b7c9e7ec75aebfecd4d9874a46bf58062
MD5 28176ef97c7d6a1e2819df1afddf4bd9
SHA1 b7b57107bd59e963811a36d9162fc604a5b40eb1
SHA512 47b9751e68064ab28f21bdac5afbec104116dd123852326fc89a7f52d07c7ce8a907a97b5f80fa29e30cfcfa32339cfb747001ac170ba816288fdc484f8877b6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7c54f4878f9192be8e91d0375025350a0c8fd637e19d6234f5c2be84f1950a0e
MD5 1ed15c66e3c7400c0308e5e7f84c9594
SHA1 07ed6a518b83c54446a185162483685d8eb4a33f
SHA512 796268423250d1384c6fbb310e753b951d7ebcd29f0d244515f58a7237aac8a610425f00bdc015ec77ebebc43044134ad312c78fd5737f82a699a860f250a2fb
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 ed9d8833823bb067d227af600670de51ac1386e1bf039629c4b611d62aaa840c
MD5 59133a7966a85416f003904cca57fb59
SHA1 ab1c58382fd4dda79d2fbcd83d99d03bccb250d2
SHA512 132ea459c53800f45269c5af0b10edc4a831fa66f101cbfeb06cd11d17ae1e5b1b202a50638809efaec6503e3c890a3bcc3a2fa48ef71ac67ffd2e8ce203fcef
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 a03ef27979acd8eb6387f89e87252665e77288b28f4a9a6cc80d4401380e5991
MD5 63f3b367cce92da6f1e6a09d366f319a
SHA1 1ee6dd2e45b8d61ddca19af91c9115edd6438a9e
SHA512 81d4b7ffa37b27819d06c8411aa84d9b93a112ceb851b9ec0ff92440da3e73302852d3aa7475cd0473c54024ee24dc287701672fc62fbaa4199b2434174a93b1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 c2db47b4ff0a374be8214b024ab0aad2c860c29f460025c4c535edd8f8e1f77f
MD5 34c80cdc116675a69fd7bb448542d188
SHA1 8fb3ff6145b2084c0accc384c6ed67e7f72ba0f4
SHA512 217ecb411a55fa99c03eed246261c82235be8c8bb33bdf4a8b4eb3af61fb93c12a33cdba4b493ee482e7982f68912da1e6fb9ceba82464b826859f82bb50f27c
SSDEEP 192:5PoNB4PbeJhZHV+Fctk4+lkwMZPo6yIsnVdg4:5PoDRhGWkFsr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 9fd86b71eb26859609ff20c981b69a49d53283836b1fcb7317f31136511ae256
MD5 87b9fc6770f9e2e1f48312f8d44c35f0
SHA1 a1fbcad05504ea8e0fdecb868bcc5292a4d72da6
SHA512 8df754c3d4aa49723b6fe3300a29e2736a5e25066cdb67009e6bd7614ff3f950113cc3a829709911c0bdaa6c3450d82423a6356c9168b6f856ea943304a11057
SSDEEP 192:5PWNB4P7ejZHV+FRIM+lkwCZPo6yIsnVdg4:5PWDhhGRKir4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 36b4b6c5e0eb8091c1ab49bbe795594964a48ad49c6cae7e342780acb5b7b2da
MD5 1c0d4a5a3864587508e47edd9791831b
SHA1 36ab5b93da50eb4421dfb4c223733d6f4870a896
SHA512 dd5197a855f1379406c784b89f053945cdb7587b15beacd5cdc8e7a4b5f278e915f67539909ccb8713f454c4918afded7a19a24f23471ae33ed3b842cae7ed15
SSDEEP 192:5PoNB4PIeJhZHV+Fctks+lkwoZPo6yIsnVdg4:5PoDQhGWkpIr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 8bf408dff895ef2b4a8503c513bd26cece4dc15bb8ddc051b021415505bb4071
MD5 824fa1e2d245dc64f9ec75de4595566f
SHA1 22797975364a66251dcd5a112660f60ac8759412
SHA512 38444df302e00a6a44d6bae4a96d990f5016fff8eab266d993d95d833565cb28bd2f33cfabae63a3192d2d89a68c6d093877b089621e480857cac295a1005466
SSDEEP 192:5PoNB4PBeJhZHV+Fctks+lkwoZPo6yIsnVdg4:5PoDPhGWkpIr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 b0562244be190fd74b93834b44d9c2b6c201cfb4ee3981f0c90ac8c59ed75f35
MD5 05800b1e0474eae2e8ee81572454a809
SHA1 a8b961cf3f46fc6ddef381d51cb0ec4c9a7b42d4
SHA512 570fe4ef715fadd086f1103553935ce54c53e64e88c805a8523b1838a03e1474d93ac312ee29fef1556da9c5dafd526e642c4af6fd8b6c1162bb40e90aa4002b
SSDEEP 192:5PoNB4P4eJhZHV+Fctks+lkwoZPo6yIsnVdg4:5PoDQhGWkpIr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 2cc305a7db268323f71044db66249f55e719bd6cf34e1c67fac86ee9a110c019
MD5 0f1bf98692015b062e63e292763385e6
SHA1 be4d86c1631e5b6798204346952da577b3ed6c68
SHA512 0ec06afee6d2d653561e9f3abcd4e7b23e8e3cab18eb76783b07f88e6be2baa8e7bd8c982211279221876fe4b55aef75f534f2b97ddc35643816f6f3e0f64cc1
SSDEEP 192:5PoNB4PMeJhZHV+Fctks+lkwoZPo6yIsnVdg4:5PoDQhGWkpIr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 92d8075f13060d8e5d891fa8ac65ae850dd7e3dfdf2a4f3fc6421d98e5731022
MD5 12406d1c7c65d4d1bf64128a7a3a2256
SHA1 1d7f9ed33f4605ed957803b3b822cbf8d5feb23e
SHA512 190d5d05b3a90348ae5cf3ed22c53445cfe01005e1161673dee1456117c390dc63fd1a1f883ed0afb3f6163740944883cd7c638140bddff3c0ad218bd9250cae
SSDEEP 192:5PoNB4PmeJhZHV+Fctks+lkwoZPo6yIsnVdg4:5PoDChGWkpIr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 61115269b797a294565167a8710bd1a9f936c05bc6cb3835d60e48ba806a20cd
MD5 a6fc260c166801e073143d7a80609955
SHA1 06f54fb46fbbd9f370d1f14f48acd23a63c8de9c
SHA512 93165d6a150e2516a5971654c2f2fa9f2bd3ffd0802779df91046ea16bf5c4144f610ec10ca85ec9fc505adc6477e9e0e17d7a72ec8114a975da91618360ed69
SSDEEP 192:5PoNB4PteJhZHV+Fctks+lkwoZPo6yIsnVdg4:5PoD7hGWkpIr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 8d3b3fbb843d2204ef692c3cdc18785ec4e5b39b309526a6d6cd247e82f5e94f
MD5 feab48bf8b4cae6ea6eb71210fe83735
SHA1 34203cf09b7daf4bbecffc9e36d5273a6d77d3ad
SHA512 324081a54b6e89852231dcb98093cfce88624a4a9653a4e69d90bdd5e13752fdb38430b8d864c7f24c7ad26b535962d739d03c8f2a8a21e2f9ff1bb2f81633f6
SSDEEP 192:5PoNB4PyeJhZHV+Fctka+lkwCZPo6yIsnVdg4:5PoDShGWkjir4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 f15190f54e60be56b9a9c1615321b97814694da7a530205abed5b18aaa0825d7
MD5 7141f6b351308976a1600c4ff62775b5
SHA1 9890e8e66f38a33576a7840422f4ec55cdf0f3d6
SHA512 8482a48b64fd99b4d981fc92b98aac9aec8a00df31c6f930f179216882968dfe190092be446cb76e214f2f3fa32e0502b581ad60de0856b7dbfbef171a440d54
SSDEEP 192:5PoNB4PbeJhZHV+Fctk4+lkwMZPo6yIsnVdg4:5PoDxhGWkFsr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 921fd557a44ce9794f747c3269a6cdc348682eec670e71d5acd8c7b50c91a844
MD5 ab9707e308a76d7898ff3ac06fd2c2dc
SHA1 0c86d1108070f64c05718d98e433dba918d6ea0b
SHA512 65350d3497d58e7c60645f8143d352a6f80e6dc5cd1da9eeee34fba01ebd5631248f77ed5c6312efe2a2818f635ba1c74348bf6c31280a5d3a7dcf9f34d60cbb
SSDEEP 192:5PoNB4PDeJhZHV+Fctks+lkwoZPo6yIsnVdg4:5PoD5hGWkpIr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 520d563c479d8eef30021e70301e2f23dd95c001ae67b7697582803dc7fbafb1
MD5 98553dd6a42c26ab99707c06b2d2ae5b
SHA1 832e47571c362f2bdf94daeae66098cbb6eb7de2
SHA512 e96e62d8310dcfe14c492c32bb57a7415a6eba7189c1a4e6cfd9e83e3e8e1fb52c4ef1b2b0caf631578c88c62717fe1f0d63aa33afc7019a3a6ce4e2081fb9eb
SSDEEP 192:5PoNB4P7eJhZHV+Fctks+lkwoZPo6yIsnVdg4:5PoDBhGWkpIr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 ea4ab53eff26cb835849fe2e8be104319713c8a8c12db401c6df020743c6530e
MD5 5f3de09d8a0522efdee126c88e0962a5
SHA1 5af5acd1fd46b4ff579938de0e55d950a04a5df6
SHA512 77ecd7bdea571a7259e7a8eeb0339d85cc8825360bc66cae94857cfedc552087412bb80f44d35aff3265540b42f73c868c4ba6657a530d485ed5ac2422680823
SSDEEP 192:5PoNB4PveJhZHV+Fctks+lkwoZPo6yIsnVdg4:5PoDdhGWkpIr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 83050edaf4b334b9b8e288f2fb2d5dff2378d5c9b4f6bf594b9f5068842998c9
MD5 5f049e5277a4bae97e4f281c3bf4dabc
SHA1 a0aa7dc72a023f5ba2222be91ce260d0bacf05ca
SHA512 1a6e7db037f8ddfc4289fe516c4ad3ad9b102a89c9eac4be0f50688239213370e7835e4d28188a21942f9158bed7e65856416af13b41fee17c0b8b442c02f2bb
SSDEEP 192:5PoNB4PxeJhZHV+Fctks+lkwoZPo6yIsnVdg4:5PoDjhGWkpIr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 9ec321b69299942c0bf08082c47ecd1ddece3763781aabba1c25700f52d8875d
MD5 2a6a3ebc4680dbf0b736763d34bf5986
SHA1 fc9ee3e6f2f0d93a2113979e09f3616db9a2c124
SHA512 53a0831af96a3cb71f7da2d8690117cf76511409e4075758eab71ab4a542850a5295a4632d49f9decfd7702398d6a5145282f456c72a61dd367c55e5f37e2931
SSDEEP 384:HzBB7pLhLcEvvSXVu1kXqKf/pUZNCgVLH2HfPPyrUUWHGk3hnih:H9B7pLhLZnAVu1kXqKf/pUZNCgVLH2Hc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 152KB
SHA256 6c9aac0f61f523b60c4ad1117741391522320b5cc74b3ef8794067cf4af563d5
MD5 4faae697e753ba27b6e0ca5cd98ea51b
SHA1 130152941999f3dd23697641ba540dbb05cf6de7
SHA512 47593fde564717583fc7e7c159d1ec9efc06e63efdede1a75669a99244c0e0c982b784c9c0718ec50be48319c5bcc224e5309eab321709c56fe6943b711b1887
SSDEEP 3072:vAruSzczlFSHmbTr+Pxvzztu2m9t5iWUEp82vQ0QaD9W3aPs:v4uSozbumPriI2mMWU8H9W3aPs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 152KB
SHA256 495cdd6d65d42f9756d22ea02d3a9aa49d9373dd18583d4530fd90f9b7e6d952
MD5 d541e53b7051956dd2904bf24ce39ba1
SHA1 e554cf119a2303eebf8ab3e55db3691c68206005
SHA512 4d64a7abff97666362ecde53f277a2388640be8f57f0529ff6027dc6ab140f9cc68a4189cf7da6820075816b5ce303fe2ed1eb73a259289f936bdac14fac4f00
SSDEEP 3072:oAruSzczlFSHmbTr+Pxvzztu2m9t5iWUEp82vQ0QaD9W3aPs:o4uSozbumPriI2mMWU8H9W3aPs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 955528.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 955528.crdownload
Size 3.1MB
SHA256 05a36bafce14b5f23f9a1a92d97e1a795eb2f79ee76c57c81a5dcc9b6e709467
MD5 23659f75083c817326e723f93dc82605
SHA1 d85f9e6b63b051c82708a71f96892aa26e89f0a3
SHA512 e96420c18c2366e3d46feea23186775d9de37d6b0b0770ec03b51fb86a8abf2b931757069b6030880dd7bf905a207386b9ba996fd1fe5c5b5a792149e0f8c128
SSDEEP 49152:fv+lL26AaNeWgPhlmVqvMQ7XSKnYRJ6VbR3LoGdqjTHHB72eh2NT:fvuL26AaNeWgPhlmVqkQ7XSKnYRJ6n
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3324-141-0x000000001C1A0000-0x000000001C252000-memory.dmp

Download

memory/3324-140-0x000000001C090000-0x000000001C0E0000-memory.dmp

Download

memory/4436-130-0x00007FFD7E033000-0x00007FFD7E035000-memory.dmp

Download

memory/4436-139-0x00007FFD7E030000-0x00007FFD7EAF1000-memory.dmp

Download

memory/4436-132-0x00007FFD7E030000-0x00007FFD7EAF1000-memory.dmp

Download

memory/4436-131-0x0000000000210000-0x0000000000534000-memory.dmp

Download