quasar | 9b906e8b6e09cdb3ad9d100dcb77df6f30e0a88c1fb164ea491a9e6fdd823083

Resubmissions

29-05-2024 04:02

240529-el419aaf63 10

29-05-2024 03:57

240529-eh157aae65 10

Analysis

max time kernel
237s
max time network
236s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
29-05-2024 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

edd373e0c5b33b63857417fe30229b22
SHA1

fd1834882a6c411b97a51f2e1ddb57058465fdc3
SHA256

9b906e8b6e09cdb3ad9d100dcb77df6f30e0a88c1fb164ea491a9e6fdd823083
SHA512

80ffb0dfe71ca3bc6e7b414d2ba8924a99e481e36aadbc9a176571d121556637fa50621509886030959dd48e6419d0fe4f3c20ce56a304912c5259d8fd0dd9d5
SSDEEP

49152:+vSI22SsaNYfdPBldt698dBcjHdExk1v4LoG+8GQ0THHB72eh2NT:+v/22SsaNYfdPBldt6+dBcjHdExnG

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

10.0.0.5:55976

127.0.0.1:12995

Mutex

fd7766f9-01b8-4f7d-9510-71226643b102

Attributes

encryption_key
1A0BB6F7E6C51A39D122080A266E59E4C6D10FA8
install_name
Centixwareinstaller.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows 11 Dir
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3968-0-0x0000000000040000-0x0000000000364000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Centixwareinstaller.exe	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Centixwareinstaller.exe

pid process

4788 Centixwareinstaller.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1968 schtasks.exe
704 schtasks.exe
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

NETSTAT.EXE

pid process

4224 NETSTAT.EXE
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Centixwareinstaller.exe

pid process

4788 Centixwareinstaller.exe

pid	process
4788	Centixwareinstaller.exe

pid	process
1968	schtasks.exe
704	schtasks.exe

pid	process
4224	NETSTAT.EXE

pid	process
4788	Centixwareinstaller.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Client-built.exeCentixwareinstaller.exeNETSTAT.EXE

description	pid	process
Token: SeDebugPrivilege	3968	Client-built.exe
Token: SeDebugPrivilege	4788	Centixwareinstaller.exe
Token: SeDebugPrivilege	4224	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Centixwareinstaller.exe

pid process

4788 Centixwareinstaller.exe

pid	process
4788	Centixwareinstaller.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Client-built.exeCentixwareinstaller.execmd.exe

description	pid	process	target process
PID 3968 wrote to memory of 704	3968	Client-built.exe	schtasks.exe
PID 3968 wrote to memory of 704	3968	Client-built.exe	schtasks.exe
PID 3968 wrote to memory of 4788	3968	Client-built.exe	Centixwareinstaller.exe
PID 3968 wrote to memory of 4788	3968	Client-built.exe	Centixwareinstaller.exe
PID 4788 wrote to memory of 1968	4788	Centixwareinstaller.exe	schtasks.exe
PID 4788 wrote to memory of 1968	4788	Centixwareinstaller.exe	schtasks.exe
PID 1864 wrote to memory of 4224	1864	cmd.exe	NETSTAT.EXE
PID 1864 wrote to memory of 4224	1864	cmd.exe	NETSTAT.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows 11 Dir" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Centixwareinstaller.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:704

C:\Users\Admin\AppData\Roaming\SubDir\Centixwareinstaller.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Centixwareinstaller.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows 11 Dir" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Centixwareinstaller.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1968

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3420

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\system32\NETSTAT.EXE
netstat -a
2⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Centixwareinstaller.exe
Filesize
3.1MB

MD5
edd373e0c5b33b63857417fe30229b22

SHA1
fd1834882a6c411b97a51f2e1ddb57058465fdc3

SHA256
9b906e8b6e09cdb3ad9d100dcb77df6f30e0a88c1fb164ea491a9e6fdd823083

SHA512
80ffb0dfe71ca3bc6e7b414d2ba8924a99e481e36aadbc9a176571d121556637fa50621509886030959dd48e6419d0fe4f3c20ce56a304912c5259d8fd0dd9d5

Download Submit
memory/3968-1-0x00007FF8A2DD3000-0x00007FF8A2DD5000-memory.dmp

Filesize
8KB

Download
memory/3968-0-0x0000000000040000-0x0000000000364000-memory.dmp

Filesize
3.1MB

Download
memory/3968-2-0x00007FF8A2DD0000-0x00007FF8A3892000-memory.dmp

Filesize
10.8MB

Download
memory/3968-9-0x00007FF8A2DD0000-0x00007FF8A3892000-memory.dmp

Filesize
10.8MB

Download
memory/4788-10-0x00007FF8A2DD0000-0x00007FF8A3892000-memory.dmp

Filesize
10.8MB

Download
memory/4788-11-0x00007FF8A2DD0000-0x00007FF8A3892000-memory.dmp

Filesize
10.8MB

Download
memory/4788-12-0x000000001B720000-0x000000001B770000-memory.dmp

Filesize
320KB

Download
memory/4788-13-0x000000001C0B0000-0x000000001C162000-memory.dmp

Filesize
712KB

Download
memory/4788-14-0x000000001C7A0000-0x000000001CCC8000-memory.dmp

Filesize
5.2MB

Download
memory/4788-16-0x00007FF8A2DD0000-0x00007FF8A3892000-memory.dmp

Filesize
10.8MB

Download
memory/4788-17-0x00007FF8A2DD0000-0x00007FF8A3892000-memory.dmp

Filesize
10.8MB

Download