quasar | 968f80b313d7b5735455963fbc8423ab85c6ac4f20ee516257442e3a04b47a57

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 21:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe
Size 175KB
Sample240523-zzmpcagf72
SHA256 968f80b313d7b5735455963fbc8423ab85c6ac4f20ee516257442e3a04b47a57
MD5 86f8ab131d760b36b3606c3297c907c3
SHA1 5ca6c76dc0c411384408ad093bcd321ed0c01603
SHA512 32df021c92ad01eed2a79e3310e9364c210eb701d040a3cf783102aa5f0b68989d75502b49a159a9f6a7bd859b1373a7db2f59ba8a281cbce028d9dca27fea7d
SSDEEP 3072:iHBOqsKPjqj7hGGM+lmsolAIrRuw+mqv9j1MWLQ:ihODGl+lDAA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

45.81.150.172:4782

Mutex

11baa5a5-5e9e-4125-84cc-37d234d4726b

Attributes

encryption_key
5F9E03EC6830CA20E37DC97AEE1BB847C8BF19CD
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023388-13.dat	family_quasar
behavioral2/memory/4816-31-0x00000000008C0000-0x0000000000BE4000-memory.dmp	family_quasar

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023388-13.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4816-31-0x00000000008C0000-0x0000000000BE4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023388-13.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4816-31-0x00000000008C0000-0x0000000000BE4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing common artifacts observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023388-13.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/memory/4816-31-0x00000000008C0000-0x0000000000BE4000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer

Detects executables packed with 9Rays.Net Spices.Net Obfuscator. 1 IoCs

resource	yara_rule
behavioral2/memory/2896-3-0x0000000002200000-0x000000000220A000-memory.dmp	INDICATOR_EXE_Packed_Spices

Executes dropped EXE 4 IoCs

pid	Process
4816	productlist.exe
4880	productlist.exe
808	Client.exe
4508	Client.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 1572	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	89

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3508	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4648	schtasks.exe
4848	schtasks.exe
3956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe
2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe
2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe
2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe
2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe
2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe
3508	powershell.exe
3508	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe
Token: SeDebugPrivilege	4816	productlist.exe
Token: SeDebugPrivilege	4880	productlist.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	4508	Client.exe
Token: SeDebugPrivilege	808	Client.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4508	Client.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4508	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4508	Client.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 5044	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	86
PID 2896 wrote to memory of 5044	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	86
PID 2896 wrote to memory of 5044	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	86
PID 2896 wrote to memory of 3040	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	87
PID 2896 wrote to memory of 3040	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	87
PID 2896 wrote to memory of 3040	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	87
PID 2896 wrote to memory of 2332	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	88
PID 2896 wrote to memory of 2332	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	88
PID 2896 wrote to memory of 2332	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	88
PID 2896 wrote to memory of 1572	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	89
PID 2896 wrote to memory of 1572	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	89
PID 2896 wrote to memory of 1572	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	89
PID 2896 wrote to memory of 1572	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	89
PID 2896 wrote to memory of 1572	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	89
PID 2896 wrote to memory of 1572	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	89
PID 2896 wrote to memory of 1572	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	89
PID 2896 wrote to memory of 1572	2896	2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe	89
PID 1572 wrote to memory of 3508	1572	MSBuild.exe	90
PID 1572 wrote to memory of 3508	1572	MSBuild.exe	90
PID 1572 wrote to memory of 3508	1572	MSBuild.exe	90
PID 1572 wrote to memory of 4816	1572	MSBuild.exe	92
PID 1572 wrote to memory of 4816	1572	MSBuild.exe	92
PID 1572 wrote to memory of 4880	1572	MSBuild.exe	93
PID 1572 wrote to memory of 4880	1572	MSBuild.exe	93
PID 4816 wrote to memory of 4648	4816	productlist.exe	94
PID 4816 wrote to memory of 4648	4816	productlist.exe	94
PID 4880 wrote to memory of 4848	4880	productlist.exe	96
PID 4880 wrote to memory of 4848	4880	productlist.exe	96
PID 4816 wrote to memory of 808	4816	productlist.exe	100
PID 4816 wrote to memory of 808	4816	productlist.exe	100
PID 4880 wrote to memory of 4508	4880	productlist.exe	101
PID 4880 wrote to memory of 4508	4880	productlist.exe	101
PID 4508 wrote to memory of 3956	4508	Client.exe	102
PID 4508 wrote to memory of 3956	4508	Client.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_86f8ab131d760b36b3606c3297c907c3_hiddentear.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:5044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2332
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAZgB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAZABuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHgAdABiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAawBqACMAPgA="
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- - C:\Users\Admin\AppData\Local\Temp\productlist.exe
    "C:\Users\Admin\AppData\Local\Temp\productlist.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:4648
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:808
- - C:\Users\Admin\AppData\Local\Temp\productlist.exe
    "C:\Users\Admin\AppData\Local\Temp\productlist.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:4848
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4508
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

productlist.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\productlist.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_pjgls0rn.zlj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pjgls0rn.zlj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

productlist.exe

Path C:\Users\Admin\AppData\Local\Temp\productlist.exe
Size 3.1MB
SHA256 6a12c7874c6c44b2b68fa013de4480f01f917e7d87605207fcccbc469f7df46a
MD5 5145c1da6a61679e1518fabf15bcd9b2
SHA1 9f804a68e5d2f62cafd782840165382118af4468
SHA512 192f4f3ed78fd31e2a068ed648d53e031a0d667f5a43854225922896ff5bf02c3e0f614b70e975f893edb40d4d9ae109d2a354e6dd07f6a1e0e5b4ae21acc466
SSDEEP 49152:SvbI22SsaNYfdPBldt698dBcjHzb/pBxWLoGdVTHHB72eh2NT:Svk22SsaNYfdPBldt6+dBcjHn/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1572-4-0x0000000000400000-0x0000000000742000-memory.dmp

Download

memory/1572-7-0x0000000000400000-0x0000000000742000-memory.dmp

Download

memory/2896-0-0x00007FFFD4533000-0x00007FFFD4535000-memory.dmp

Download

memory/2896-2-0x00007FFFD4530000-0x00007FFFD4FF1000-memory.dmp

Download

memory/2896-3-0x0000000002200000-0x000000000220A000-memory.dmp

Download

memory/2896-8-0x00007FFFD4530000-0x00007FFFD4FF1000-memory.dmp

Download

memory/2896-1-0x0000000000090000-0x00000000000C2000-memory.dmp

Download

memory/3508-33-0x0000000004F00000-0x0000000004F22000-memory.dmp

Download

memory/3508-73-0x0000000006E90000-0x0000000006F33000-memory.dmp

Download

memory/3508-40-0x0000000005850000-0x00000000058B6000-memory.dmp

Download

memory/3508-39-0x0000000005020000-0x0000000005086000-memory.dmp

Download

memory/3508-30-0x00000000028F0000-0x0000000002926000-memory.dmp

Download

memory/3508-46-0x00000000059C0000-0x0000000005D14000-memory.dmp

Download

memory/3508-82-0x0000000007470000-0x0000000007478000-memory.dmp

Download

memory/3508-18-0x0000000073DDE000-0x0000000073DDF000-memory.dmp

Download

memory/3508-56-0x0000000005EB0000-0x0000000005ECE000-memory.dmp

Download

memory/3508-57-0x0000000005EF0000-0x0000000005F3C000-memory.dmp

Download

memory/3508-81-0x0000000007520000-0x000000000753A000-memory.dmp

Download

memory/3508-80-0x0000000007440000-0x0000000007454000-memory.dmp

Download

memory/3508-62-0x0000000074800000-0x000000007484C000-memory.dmp

Download

memory/3508-32-0x0000000005120000-0x0000000005748000-memory.dmp

Download

memory/3508-72-0x0000000006470000-0x000000000648E000-memory.dmp

Download

memory/3508-61-0x0000000006E50000-0x0000000006E82000-memory.dmp

Download

memory/3508-74-0x0000000007830000-0x0000000007EAA000-memory.dmp

Download

memory/3508-75-0x00000000071F0000-0x000000000720A000-memory.dmp

Download

memory/3508-76-0x0000000007260000-0x000000000726A000-memory.dmp

Download

memory/3508-77-0x0000000007480000-0x0000000007516000-memory.dmp

Download

memory/3508-78-0x00000000073F0000-0x0000000007401000-memory.dmp

Download

memory/3508-79-0x0000000007430000-0x000000000743E000-memory.dmp

Download

memory/4508-60-0x000000001CBC0000-0x000000001CC72000-memory.dmp

Download

memory/4508-59-0x000000001CAB0000-0x000000001CB00000-memory.dmp

Download

memory/4816-31-0x00000000008C0000-0x0000000000BE4000-memory.dmp

Download