quasar | 8a7cfe4a79b49501f486288fe3c87138305119b04f126a8a9e8408f3d8e3771c

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e46a4d586b41c48125c7f5f44e5f23e2.exe
Size 3.1MB
Sample240607-dtewnagh2t
SHA256 8a7cfe4a79b49501f486288fe3c87138305119b04f126a8a9e8408f3d8e3771c
MD5 e46a4d586b41c48125c7f5f44e5f23e2
SHA1 b0ea55d5932426e0722167989691f11e08980ee0
SHA512 68c999533b8e3e5f2ede4f1b69838c99530b67f6f3da9ebd3c5641de72bcbfeae0b06e52811c602fbf52a85a4726109e8aab3d97fd1181dce34548106b12978b
SSDEEP 49152:jvpG42pda6D+/PjlLOlg6yQipVy8vE780k/mkEoGdiyTHHB72eh2NT:jvY42pda6D+/PjlLOlZyQipVy8Gv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

10.9.33.1:25377
SteveLean-47385.portmap.host:47385

Mutex

603e73f4-1a5c-4a9d-96e3-7ee1f44390dd

Attributes

encryption_key
5C96F3FC23C24141669D950745FC3357502CE24B
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/1188-1-0x0000000000320000-0x0000000000644000-memory.dmp	family_quasar
behavioral2/files/0x0008000000023270-4.dat	family_quasar

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 4 IoCs

pid	Process
4164	Client.exe
3484	Client.exe
4776	Client.exe
2756	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
4904	PING.EXE
4332	PING.EXE
2392	PING.EXE
4240	PING.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1188	e46a4d586b41c48125c7f5f44e5f23e2.exe
Token: SeDebugPrivilege	4164	Client.exe
Token: SeDebugPrivilege	3484	Client.exe
Token: SeDebugPrivilege	4776	Client.exe
Token: SeDebugPrivilege	2756	Client.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4164	Client.exe
3484	Client.exe
4776	Client.exe
2756	Client.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4164	Client.exe
3484	Client.exe
4776	Client.exe
2756	Client.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 4164	1188	e46a4d586b41c48125c7f5f44e5f23e2.exe	89
PID 1188 wrote to memory of 4164	1188	e46a4d586b41c48125c7f5f44e5f23e2.exe	89
PID 4164 wrote to memory of 4940	4164	Client.exe	98
PID 4164 wrote to memory of 4940	4164	Client.exe	98
PID 4940 wrote to memory of 2212	4940	cmd.exe	100
PID 4940 wrote to memory of 2212	4940	cmd.exe	100
PID 4940 wrote to memory of 4904	4940	cmd.exe	101
PID 4940 wrote to memory of 4904	4940	cmd.exe	101
PID 4940 wrote to memory of 3484	4940	cmd.exe	102
PID 4940 wrote to memory of 3484	4940	cmd.exe	102
PID 3484 wrote to memory of 4432	3484	Client.exe	104
PID 3484 wrote to memory of 4432	3484	Client.exe	104
PID 4432 wrote to memory of 2028	4432	cmd.exe	106
PID 4432 wrote to memory of 2028	4432	cmd.exe	106
PID 4432 wrote to memory of 4332	4432	cmd.exe	107
PID 4432 wrote to memory of 4332	4432	cmd.exe	107
PID 4432 wrote to memory of 4776	4432	cmd.exe	108
PID 4432 wrote to memory of 4776	4432	cmd.exe	108
PID 4776 wrote to memory of 4976	4776	Client.exe	109
PID 4776 wrote to memory of 4976	4776	Client.exe	109
PID 4976 wrote to memory of 4876	4976	cmd.exe	111
PID 4976 wrote to memory of 4876	4976	cmd.exe	111
PID 4976 wrote to memory of 2392	4976	cmd.exe	112
PID 4976 wrote to memory of 2392	4976	cmd.exe	112
PID 4976 wrote to memory of 2756	4976	cmd.exe	113
PID 4976 wrote to memory of 2756	4976	cmd.exe	113
PID 2756 wrote to memory of 4620	2756	Client.exe	114
PID 2756 wrote to memory of 4620	2756	Client.exe	114
PID 4620 wrote to memory of 964	4620	cmd.exe	116
PID 4620 wrote to memory of 964	4620	cmd.exe	116
PID 4620 wrote to memory of 4240	4620	cmd.exe	117
PID 4620 wrote to memory of 4240	4620	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\e46a4d586b41c48125c7f5f44e5f23e2.exe
"C:\Users\Admin\AppData\Local\Temp\e46a4d586b41c48125c7f5f44e5f23e2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E4eNovlW8Dg9.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2212
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:4904
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AbaxfDx53Pn0.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4432
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2028
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:4332
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a0RCcttJPwmA.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4876
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:2392
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mW8kNImLNwAV.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:964
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

AbaxfDx53Pn0.bat

Path C:\Users\Admin\AppData\Local\Temp\AbaxfDx53Pn0.bat
Size 207B
SHA256 fe1acd802f27f32a194f8e1719bf3d2bfb54c3c4ae2ab23da50bf14b420e789b
MD5 ec858e0ee2cf15917dc18a6bd69ad029
SHA1 0df89a0ce6170286b7d4d0098fb4ded730ec86ce
SHA512 4bdc2394a0f9b01f78135334ead0b05455cf7ebc251ab1a7b5e55c98efd857d7c7b9d1604cfe70d6a68ebdd06b37a155a4c69edd8f14bab0c1465d3203a92e35
MD5 SHA1 SHA512

Submit Download

E4eNovlW8Dg9.bat

Path C:\Users\Admin\AppData\Local\Temp\E4eNovlW8Dg9.bat
Size 207B
SHA256 8f3a7fe9da55579809fe1742ba2b9c6e1473cfeeece781e3b3d2307156c0fb53
MD5 859bb675b58661042dc893f5c677329e
SHA1 c358c877980798eb3f9133c57249cb1075b81fed
SHA512 76eb681b77cd90405c5c3e4c91a84f319a6279e97eb976e14dafdad7e638b35dd97ce2cb07d8edafe0f5524a50fea80f802ce50119a024416e2962fad59b27e2
MD5 SHA1 SHA512

Submit Download

a0RCcttJPwmA.bat

Path C:\Users\Admin\AppData\Local\Temp\a0RCcttJPwmA.bat
Size 207B
SHA256 e624b611ef449cbbef246c5efa55b16e05681f164953310389dea06a96380eaf
MD5 f7ee63b9989aef72425300b4cd7a3562
SHA1 d1485c1ad73f1f194c7632d62f7691eb940f7e20
SHA512 5508f65894c3ba076df7372e9831f92bd820807c4f139c0c7b169817f30e57db0f536318718c228197fb9aa935b4b2c9ad7dfff1d33d7a10a9117bb2ddf2c05b
MD5 SHA1 SHA512

Submit Download

mW8kNImLNwAV.bat

Path C:\Users\Admin\AppData\Local\Temp\mW8kNImLNwAV.bat
Size 207B
SHA256 5be4801014a979c8f3fca1dcfe49bc1ed7104f2629a6101e1f0938750d085ce6
MD5 165849ca885a82d159b7e15d8c0a4f51
SHA1 f7768b16fba3a1dfffd44ef388b61aeb99082c4e
SHA512 6b6a242b618057112ab4ca11ef78a349c45521dcbec09d009960e6208622f5df98ef70d84c7b8d764bf5481ae585a7cb01748d1020e5a116f09b5ae06d69c032
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 8a7cfe4a79b49501f486288fe3c87138305119b04f126a8a9e8408f3d8e3771c
MD5 e46a4d586b41c48125c7f5f44e5f23e2
SHA1 b0ea55d5932426e0722167989691f11e08980ee0
SHA512 68c999533b8e3e5f2ede4f1b69838c99530b67f6f3da9ebd3c5641de72bcbfeae0b06e52811c602fbf52a85a4726109e8aab3d97fd1181dce34548106b12978b
SSDEEP 49152:jvpG42pda6D+/PjlLOlg6yQipVy8vE780k/mkEoGdiyTHHB72eh2NT:jvY42pda6D+/PjlLOlZyQipVy8Gv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1188-1-0x0000000000320000-0x0000000000644000-memory.dmp

Download

memory/1188-2-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Download

memory/1188-0-0x00007FF8A2363000-0x00007FF8A2365000-memory.dmp

Download

memory/1188-9-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Download

memory/4164-8-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Download

memory/4164-18-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Download

memory/4164-13-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Download

memory/4164-12-0x000000001BE40000-0x000000001BEF2000-memory.dmp

Download

memory/4164-11-0x000000001BD30000-0x000000001BD80000-memory.dmp

Download

memory/4164-10-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads