quasar | 5568ae4c3fe1e93046d1820f46c54c6ac4f6c73198f53409df663206f6e5aa1e

General

Target

84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exe
Size

3.1MB
MD5

84d3d9634976a8fee93497d8c406adb0
SHA1

8e31205fc2aee87a3862fc6c33d11d318a003e79
SHA256

5568ae4c3fe1e93046d1820f46c54c6ac4f6c73198f53409df663206f6e5aa1e
SHA512

921b3fe58ce464627d86cd15b19ebbb63b6b158dec30afec905d1b4e4c3be6fd4a4f0b1eaf25fa8686008fa084805e6b05e0bfad3949ab8851c87928466a5979
SSDEEP

49152:LU03k0EHHtQMngQcR2+g1NTi7p7FJRHquOuCCUs51ST1i1jqXItCkcCMdWmcJ9:H3YXRcXc9iF/xZOuC/s5YxigtdWVJ9

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

10.0.2.15:4782

Mutex

8cc926a7-8fb2-4810-84b7-930934112047

Attributes

encryption_key
53E7CCC098EF671006BA6BEEF157EC7AF807CFD6
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4372-2-0x0000000000240000-0x00000000008E0000-memory.dmp	family_quasar
behavioral2/memory/4372-14-0x0000000000240000-0x00000000008E0000-memory.dmp	family_quasar
behavioral2/memory/2568-17-0x0000000000820000-0x0000000000EC0000-memory.dmp	family_quasar
behavioral2/memory/2568-19-0x0000000000820000-0x0000000000EC0000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

2568 Client.exe

pid	process
2568	Client.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs

Processes:

84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exeClient.exe

pid	process
4372	84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exe
4372	84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exe
2568	Client.exe
2568	Client.exe
2568	Client.exe
2568	Client.exe
2568	Client.exe
2568	Client.exe
2568	Client.exe
2568	Client.exe
2568	Client.exe
2568	Client.exe
2568	Client.exe
2568	Client.exe
2568	Client.exe
2568	Client.exe
2568	Client.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4120 schtasks.exe
5000 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exeClient.exe

description pid process

Token: SeDebugPrivilege 4372 84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exe
Token: SeDebugPrivilege 2568 Client.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exeClient.exe

pid process

4372 84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exe
2568 Client.exe
2568 Client.exe

pid	process
4120	schtasks.exe
5000	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	4372	84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2568	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exeClient.exe

description	pid	process	target process
PID 4372 wrote to memory of 4120	4372	84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exe	schtasks.exe
PID 4372 wrote to memory of 4120	4372	84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exe	schtasks.exe
PID 4372 wrote to memory of 4120	4372	84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exe	schtasks.exe
PID 4372 wrote to memory of 2568	4372	84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exe	Client.exe
PID 4372 wrote to memory of 2568	4372	84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exe	Client.exe
PID 4372 wrote to memory of 2568	4372	84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exe	Client.exe
PID 2568 wrote to memory of 5000	2568	Client.exe	schtasks.exe
PID 2568 wrote to memory of 5000	2568	Client.exe	schtasks.exe
PID 2568 wrote to memory of 5000	2568	Client.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\84d3d9634976a8fee93497d8c406adb0_NeikiAnalytics.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:4120

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
84d3d9634976a8fee93497d8c406adb0

SHA1
8e31205fc2aee87a3862fc6c33d11d318a003e79

SHA256
5568ae4c3fe1e93046d1820f46c54c6ac4f6c73198f53409df663206f6e5aa1e

SHA512
921b3fe58ce464627d86cd15b19ebbb63b6b158dec30afec905d1b4e4c3be6fd4a4f0b1eaf25fa8686008fa084805e6b05e0bfad3949ab8851c87928466a5979

Download Submit
memory/2568-17-0x0000000000820000-0x0000000000EC0000-memory.dmp

Filesize
6.6MB

Download
memory/2568-27-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/2568-26-0x0000000000820000-0x0000000000EC0000-memory.dmp

Filesize
6.6MB

Download
memory/2568-23-0x0000000008610000-0x00000000086C2000-memory.dmp

Filesize
712KB

Download
memory/2568-22-0x00000000083A0000-0x00000000083F0000-memory.dmp

Filesize
320KB

Download
memory/2568-21-0x0000000008810000-0x0000000008E28000-memory.dmp

Filesize
6.1MB

Download
memory/2568-20-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/2568-19-0x0000000000820000-0x0000000000EC0000-memory.dmp

Filesize
6.6MB

Download
memory/2568-13-0x0000000000820000-0x0000000000EC0000-memory.dmp

Filesize
6.6MB

Download
memory/2568-18-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/4372-5-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/4372-15-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/4372-14-0x0000000000240000-0x00000000008E0000-memory.dmp

Filesize
6.6MB

Download
memory/4372-6-0x0000000007460000-0x000000000746A000-memory.dmp

Filesize
40KB

Download
memory/4372-0-0x0000000000240000-0x00000000008E0000-memory.dmp

Filesize
6.6MB

Download
memory/4372-4-0x00000000074E0000-0x0000000007572000-memory.dmp

Filesize
584KB

Download
memory/4372-3-0x0000000007940000-0x0000000007EE4000-memory.dmp

Filesize
5.6MB

Download
memory/4372-2-0x0000000000240000-0x00000000008E0000-memory.dmp

Filesize
6.6MB

Download
memory/4372-1-0x000000007482E000-0x000000007482F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads