quasar | 93da3e400e792d52b0274418924463d3828da1d17712746781dc003fffdb70ec

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 06:03

Target

5626576397b25c9f30078366b11396a0_NeikiAnalytics.exe
Size

279KB
MD5

5626576397b25c9f30078366b11396a0
SHA1

384ce5194afef71c5b02ff334c04261c7a247e94
SHA256

93da3e400e792d52b0274418924463d3828da1d17712746781dc003fffdb70ec
SHA512

fc84bf3872d300f8069a89169b0c875d9f43ff602f01605189b84a28f1323638b74484826cbe7d4d59dbad7c69d8c48ae04a70352a9f846d7456fa5a7e602c4d
SSDEEP

6144:vaaXMzUmOZoqfzV6/F+lDfbt1o+1E6CVQQQQQQQQ:CachqrG0lDo+1c

Score

10^/10

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/224-1-0x0000000000660000-0x00000000006AC000-memory.dmp	family_quasar

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5626576397b25c9f30078366b11396a0_NeikiAnalytics.exe

description pid process

Token: SeDebugPrivilege 224 5626576397b25c9f30078366b11396a0_NeikiAnalytics.exe

flow	ioc
11	api.ipify.org

description	pid	process
Token: SeDebugPrivilege	224	5626576397b25c9f30078366b11396a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\5626576397b25c9f30078366b11396a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5626576397b25c9f30078366b11396a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4400,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
1⤵
PID:3232

memory/224-0-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

Filesize
4KB

Download
memory/224-1-0x0000000000660000-0x00000000006AC000-memory.dmp

Filesize
304KB

Download
memory/224-2-0x00000000056C0000-0x0000000005C64000-memory.dmp

Filesize
5.6MB

Download
memory/224-3-0x0000000005110000-0x00000000051A2000-memory.dmp

Filesize
584KB

Download
memory/224-4-0x0000000005060000-0x00000000050C6000-memory.dmp

Filesize
408KB

Download
memory/224-5-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/224-6-0x0000000005EF0000-0x0000000005F02000-memory.dmp

Filesize
72KB

Download
memory/224-7-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

Filesize
4KB

Download
memory/224-8-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/224-9-0x0000000006470000-0x000000000647A000-memory.dmp

Filesize
40KB

Download