quasar | 31d1488e6d5e80fd6d1aba0b73f3ff7ca69d65f649298358acff26aceffdca57

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 15:22

Target

Quasar.exe
Size

1.2MB
MD5

061e986ef7b1a4c883f0da79f96537c0
SHA1

1ec4496a6dd4e0eae05cff977ae6d0fcb77dd022
SHA256

31d1488e6d5e80fd6d1aba0b73f3ff7ca69d65f649298358acff26aceffdca57
SHA512

cd68ed61957b3aaed5eba72a44c81adf04712710355ab742f23d34725801efe82cc57a37390ae61bf32f4d4fae12c5165642c32076faa5005af634febff9ed91
SSDEEP

12288:NJqRU1HYLsYebQNVBBBYiL9l/bFfpBBBBBBBBBBBBk5:vtYBBBYiLvzFfpBBBBBBBBBBBBk5

Score

10^/10

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2228-1-0x0000000000B50000-0x0000000000C8C000-memory.dmp	family_quasar

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Quasar.exe

description pid process

Token: SeDebugPrivilege 2228 Quasar.exe

description	pid	process
Token: SeDebugPrivilege	2228	Quasar.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Quasar.exe

description	pid	process	target process
PID 2228 wrote to memory of 1280	2228	Quasar.exe	WerFault.exe
PID 2228 wrote to memory of 1280	2228	Quasar.exe	WerFault.exe
PID 2228 wrote to memory of 1280	2228	Quasar.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2228 -s 584
2⤵
PID:1280

memory/2228-0-0x000007FEF5793000-0x000007FEF5794000-memory.dmp

Filesize
4KB

Download
memory/2228-1-0x0000000000B50000-0x0000000000C8C000-memory.dmp

Filesize
1.2MB

Download
memory/2228-2-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2228-3-0x000007FEF5793000-0x000007FEF5794000-memory.dmp

Filesize
4KB

Download
memory/2228-4-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download