quasar | 08f02ffe7eeff88badfd144cf74b3b3fbd7319b1c31f6f72b7aeda5613020bbc

Analysis

max time kernel
32s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 16:47

Target

Client.exe
Size

3.1MB
MD5

f4d2c8d8d68a3498b8c35174f5f30aa8
SHA1

c0122df8b964874689ef0b22846719af39c02713
SHA256

08f02ffe7eeff88badfd144cf74b3b3fbd7319b1c31f6f72b7aeda5613020bbc
SHA512

14bbc1dfda168567392cac4311279ea9271d531f143fe5e5c015d509829dff4312ea45b413111a507f0f1baa8037ec6c98a0be09a38dd6f5f22e90768fb3ae8b
SSDEEP

49152:agwNiXIBaIGNydScbKPLhtJ6IX2cCDXsch9HHBE2VhGNT:Hci4BjScb+FtoIX2R

Score

10^/10

Family

quasar

Attributes

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2492-1-0x0000000000490000-0x00000000007B8000-memory.dmp	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Client.exe

description pid process target process

PID 2492 created 2892 2492 Client.exe TrustedInstaller.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Client.exe

pid process

2492 Client.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Client.exe

description pid process

Token: SeDebugPrivilege 2492 Client.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

Client.exe

description pid process target process

PID 2492 wrote to memory of 2028 2492 Client.exe Client.exe
PID 2492 wrote to memory of 2028 2492 Client.exe Client.exe

description	pid	process	target process
PID 2492 created 2892	2492	Client.exe	TrustedInstaller.exe

pid	process
2492	Client.exe

description	pid	process
Token: SeDebugPrivilege	2492	Client.exe

description	pid	process	target process
PID 2492 wrote to memory of 2028	2492	Client.exe	Client.exe
PID 2492 wrote to memory of 2028	2492	Client.exe	Client.exe

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:2892

C:\Users\Admin\AppData\Local\Temp\Client.exe
C:\Users\Admin\AppData\Local\Temp\Client.exe
2⤵
PID:2028

memory/2492-0-0x00007FFDB2F23000-0x00007FFDB2F25000-memory.dmp

Filesize
8KB

Download
memory/2492-1-0x0000000000490000-0x00000000007B8000-memory.dmp

Filesize
3.2MB

Download