quasar | 43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e | Triage

Analysis

max time kernel
1667s
max time network
1153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 17:50

Sharing

Report Analysis Logs

General

Target

Quasar.exe
Size

1.2MB
MD5

12ebf922aa80d13f8887e4c8c5e7be83
SHA1

7f87a80513e13efd45175e8f2511c2cd17ff51e8
SHA256

43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e
SHA512

fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275
SSDEEP

12288:IwPs012cBBBYiL9l/bFfpBBBBBBBBBBBBcA:jBBBYiLvzFfpBBBBBBBBBBBBcA

Score

10^/10

quasar spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/64-1-0x0000012705380000-0x00000127054B8000-memory.dmp	family_quasar

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Quasar.exe

description pid process

Token: SeDebugPrivilege 64 Quasar.exe

C:\Users\Admin\AppData\Local\Temp\Quasar.exe
"C:\Users\Admin\AppData\Local\Temp\Quasar.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:64

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/64-0-0x00007FFAE00E3000-0x00007FFAE00E5000-memory.dmp

Filesize
8KB

Download
memory/64-1-0x0000012705380000-0x00000127054B8000-memory.dmp

Filesize
1.2MB

Download
memory/64-2-0x00007FFAE00E0000-0x00007FFAE0BA1000-memory.dmp

Filesize
10.8MB

Download
memory/64-3-0x00007FFAE00E0000-0x00007FFAE0BA1000-memory.dmp

Filesize
10.8MB

Download