quasar | 43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e | Triage

Analysis

max time kernel
315s
max time network
1591s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18-05-2024 17:49

Sharing

Report Analysis Logs

General

Target

Quasar.exe
Size

1.2MB
MD5

12ebf922aa80d13f8887e4c8c5e7be83
SHA1

7f87a80513e13efd45175e8f2511c2cd17ff51e8
SHA256

43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e
SHA512

fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275
SSDEEP

12288:IwPs012cBBBYiL9l/bFfpBBBBBBBBBBBBcA:jBBBYiLvzFfpBBBBBBBBBBBBcA

Score

10^/10

quasar spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1684-1-0x00000203CC0F0000-0x00000203CC228000-memory.dmp	family_quasar

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Quasar.exe

description pid process

Token: SeDebugPrivilege 1684 Quasar.exe

C:\Users\Admin\AppData\Local\Temp\Quasar.exe
"C:\Users\Admin\AppData\Local\Temp\Quasar.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-0-0x00007FF8C1D43000-0x00007FF8C1D44000-memory.dmp

Filesize
4KB

Download
memory/1684-1-0x00000203CC0F0000-0x00000203CC228000-memory.dmp

Filesize
1.2MB

Download
memory/1684-2-0x00007FF8C1D40000-0x00007FF8C272C000-memory.dmp

Filesize
9.9MB

Download