quasar | 9b906e8b6e09cdb3ad9d100dcb77df6f30e0a88c1fb164ea491a9e6fdd823083

Resubmissions

29-05-2024 04:02

240529-el419aaf63 10

29-05-2024 03:57

240529-eh157aae65 10

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

edd373e0c5b33b63857417fe30229b22
SHA1

fd1834882a6c411b97a51f2e1ddb57058465fdc3
SHA256

9b906e8b6e09cdb3ad9d100dcb77df6f30e0a88c1fb164ea491a9e6fdd823083
SHA512

80ffb0dfe71ca3bc6e7b414d2ba8924a99e481e36aadbc9a176571d121556637fa50621509886030959dd48e6419d0fe4f3c20ce56a304912c5259d8fd0dd9d5
SSDEEP

49152:+vSI22SsaNYfdPBldt698dBcjHdExk1v4LoG+8GQ0THHB72eh2NT:+v/22SsaNYfdPBldt6+dBcjHdExnG

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

10.0.0.5:55976

127.0.0.1:12995

Mutex

fd7766f9-01b8-4f7d-9510-71226643b102

Attributes

encryption_key
1A0BB6F7E6C51A39D122080A266E59E4C6D10FA8
install_name
Centixwareinstaller.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows 11 Dir
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2796-1-0x0000000001220000-0x0000000001544000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Centixwareinstaller.exe	family_quasar
behavioral1/memory/2716-10-0x00000000001D0000-0x00000000004F4000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Centixwareinstaller.exe

pid process

2716 Centixwareinstaller.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1756 schtasks.exe
2652 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Client-built.exeCentixwareinstaller.exe

description pid process

Token: SeDebugPrivilege 2796 Client-built.exe
Token: SeDebugPrivilege 2716 Centixwareinstaller.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Centixwareinstaller.exe

pid process

2716 Centixwareinstaller.exe

pid	process
2716	Centixwareinstaller.exe

pid	process
1756	schtasks.exe
2652	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2796	Client-built.exe
Token: SeDebugPrivilege	2716	Centixwareinstaller.exe

pid	process
2716	Centixwareinstaller.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Client-built.exeCentixwareinstaller.exe

description	pid	process	target process
PID 2796 wrote to memory of 1756	2796	Client-built.exe	schtasks.exe
PID 2796 wrote to memory of 1756	2796	Client-built.exe	schtasks.exe
PID 2796 wrote to memory of 1756	2796	Client-built.exe	schtasks.exe
PID 2796 wrote to memory of 2716	2796	Client-built.exe	Centixwareinstaller.exe
PID 2796 wrote to memory of 2716	2796	Client-built.exe	Centixwareinstaller.exe
PID 2796 wrote to memory of 2716	2796	Client-built.exe	Centixwareinstaller.exe
PID 2716 wrote to memory of 2652	2716	Centixwareinstaller.exe	schtasks.exe
PID 2716 wrote to memory of 2652	2716	Centixwareinstaller.exe	schtasks.exe
PID 2716 wrote to memory of 2652	2716	Centixwareinstaller.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Windows 11 Dir" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Centixwareinstaller.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1756

C:\Users\Admin\AppData\Roaming\SubDir\Centixwareinstaller.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Centixwareinstaller.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Windows 11 Dir" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Centixwareinstaller.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Centixwareinstaller.exe

Filesize
3.1MB

MD5
edd373e0c5b33b63857417fe30229b22

SHA1
fd1834882a6c411b97a51f2e1ddb57058465fdc3

SHA256
9b906e8b6e09cdb3ad9d100dcb77df6f30e0a88c1fb164ea491a9e6fdd823083

SHA512
80ffb0dfe71ca3bc6e7b414d2ba8924a99e481e36aadbc9a176571d121556637fa50621509886030959dd48e6419d0fe4f3c20ce56a304912c5259d8fd0dd9d5

Download Submit
memory/2716-8-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download
memory/2716-10-0x00000000001D0000-0x00000000004F4000-memory.dmp

Filesize
3.1MB

Download
memory/2716-11-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download
memory/2716-12-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download
memory/2796-0-0x000007FEF5833000-0x000007FEF5834000-memory.dmp

Filesize
4KB

Download
memory/2796-1-0x0000000001220000-0x0000000001544000-memory.dmp

Filesize
3.1MB

Download
memory/2796-2-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download
memory/2796-9-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download