quasar | 427fed8301402b5d8191e704cb71032af5ef857f05b2b5f6849e3b427d642227

General

Target

49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exe
Size

3.1MB
MD5

49a926d15231ccd4a1e4b0e5a3424bc0
SHA1

688bb4c4a54dbdaaa71515b5aa2c6bf158885348
SHA256

427fed8301402b5d8191e704cb71032af5ef857f05b2b5f6849e3b427d642227
SHA512

751778acd65e6914bc0a7e43bd453ca15e4eb89569901ace74bcbb7fd255a8b86ca0c74e7b8f6052ae7be794f4e8b51b2681d867d74e6925719535a580709b54
SSDEEP

49152:PvJAd23law6wGPAllX3SSLNUpywNYB1JjmoGdRTHHB72eh2NT:Pved23law6wGPAllX3bLNUpywNYM

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.175:4782

fe80::f835:963e:fc2b:1329%18:4782

172.26.144.1:4782

fe80::9b7e:8bd8:a039:a023%44:4782

Mutex

d88f0ce9-c5a1-4c26-a21c-6528c04bd2a8

Attributes

encryption_key
43458FB2AA6463FFFA04B58A9920BCC9450BA233
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
javaSP
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2372-1-0x00000000000C0000-0x00000000003E4000-memory.dmp	family_quasar
C:\Windows\System32\SubDir\Client.exe	family_quasar
behavioral1/memory/2040-9-0x0000000001350000-0x0000000001674000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

2040 Client.exe

pid	process
2040	Client.exe

Drops file in System32 directory 2 IoCs

Processes:

49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\system32\SubDir\Client.exe	49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

804 schtasks.exe
2784 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exeClient.exe

description pid process

Token: SeDebugPrivilege 2372 49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exe
Token: SeDebugPrivilege 2040 Client.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Client.exe

pid process

2040 Client.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Client.exe

pid process

2040 Client.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

2040 Client.exe

pid	process
804	schtasks.exe
2784	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2372	49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2040	Client.exe

pid	process
2040	Client.exe

pid	process
2040	Client.exe

pid	process
2040	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exeClient.exe

description	pid	process	target process
PID 2372 wrote to memory of 804	2372	49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exe	schtasks.exe
PID 2372 wrote to memory of 804	2372	49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exe	schtasks.exe
PID 2372 wrote to memory of 804	2372	49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exe	schtasks.exe
PID 2372 wrote to memory of 2040	2372	49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exe	Client.exe
PID 2372 wrote to memory of 2040	2372	49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exe	Client.exe
PID 2372 wrote to memory of 2040	2372	49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exe	Client.exe
PID 2040 wrote to memory of 2784	2040	Client.exe	schtasks.exe
PID 2040 wrote to memory of 2784	2040	Client.exe	schtasks.exe
PID 2040 wrote to memory of 2784	2040	Client.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\49a926d15231ccd4a1e4b0e5a3424bc0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "javaSP" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:804

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "javaSP" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\SubDir\Client.exe

Filesize
3.1MB

MD5
49a926d15231ccd4a1e4b0e5a3424bc0

SHA1
688bb4c4a54dbdaaa71515b5aa2c6bf158885348

SHA256
427fed8301402b5d8191e704cb71032af5ef857f05b2b5f6849e3b427d642227

SHA512
751778acd65e6914bc0a7e43bd453ca15e4eb89569901ace74bcbb7fd255a8b86ca0c74e7b8f6052ae7be794f4e8b51b2681d867d74e6925719535a580709b54

Download Submit
memory/2040-9-0x0000000001350000-0x0000000001674000-memory.dmp

Filesize
3.1MB

Download
memory/2040-8-0x000007FEF4CA0000-0x000007FEF568C000-memory.dmp

Filesize
9.9MB

Download
memory/2040-10-0x000007FEF4CA0000-0x000007FEF568C000-memory.dmp

Filesize
9.9MB

Download
memory/2040-11-0x000007FEF4CA0000-0x000007FEF568C000-memory.dmp

Filesize
9.9MB

Download
memory/2040-12-0x000007FEF4CA0000-0x000007FEF568C000-memory.dmp

Filesize
9.9MB

Download
memory/2372-0-0x000007FEF4CA3000-0x000007FEF4CA4000-memory.dmp

Filesize
4KB

Download
memory/2372-1-0x00000000000C0000-0x00000000003E4000-memory.dmp

Filesize
3.1MB

Download
memory/2372-2-0x000007FEF4CA0000-0x000007FEF568C000-memory.dmp

Filesize
9.9MB

Download
memory/2372-7-0x000007FEF4CA0000-0x000007FEF568C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads