quasar | 57a15954866d64a8aa8cf6fd68b07b3ded8d42e66390d5dbbc0e1e135faf4246

Analysis

max time kernel
135s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BuiltFile-COOL.exe
Size 3.1MB
Sample240704-2jb9satarm
SHA256 57a15954866d64a8aa8cf6fd68b07b3ded8d42e66390d5dbbc0e1e135faf4246
MD5 21c00a3945381e149c463658ccddd9c4
SHA1 1dcc1b47e71a77873433e8a032f1997a82371847
SHA512 86c705b8362d35136e7b8791e44bf570dcf7e7bf9931c7c98e243b96d1f8158e0fc2b041936c2f12a4ebd711748276bc77b23d36e895cb74b92772fb9de5429c
SSDEEP 49152:KI6WGoyH0I6ZUI9IzyXfpVxXQjhoGQ+akTHHB72eh2NTkS4:KI9Gdl6ZUI9UefFgt8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

147.185.221.20:15467
147.185.221.20:38852

Mutex

f0b11cef-e5ee-4de4-8050-d0e2b1ed200b

Attributes

encryption_key
72276B19006F382DD49891C281A8AE57773E9723
install_name
Update.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Update
subdirectory
Keys

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/800-1-0x0000000000300000-0x0000000000624000-memory.dmp	family_quasar
behavioral2/files/0x000800000002361d-7.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2260	Update.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\Keys\Update.exe	BuiltFile-COOL.exe
File opened for modification	C:\Windows\system32\Keys\Update.exe	BuiltFile-COOL.exe
File opened for modification	C:\Windows\system32\Keys	BuiltFile-COOL.exe
File opened for modification	C:\Windows\system32\Keys\Update.exe	Update.exe
File opened for modification	C:\Windows\system32\Keys	Update.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	msinfo32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3292	schtasks.exe
2168	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	800	BuiltFile-COOL.exe
Token: SeDebugPrivilege	2260	Update.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2260	Update.exe
2260	Update.exe
2260	Update.exe
2260	Update.exe
2260	Update.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2260	Update.exe
2260	Update.exe
2260	Update.exe
2260	Update.exe
2260	Update.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2260	Update.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 3292	800	BuiltFile-COOL.exe	91
PID 800 wrote to memory of 3292	800	BuiltFile-COOL.exe	91
PID 800 wrote to memory of 2260	800	BuiltFile-COOL.exe	93
PID 800 wrote to memory of 2260	800	BuiltFile-COOL.exe	93
PID 2260 wrote to memory of 2168	2260	Update.exe	94
PID 2260 wrote to memory of 2168	2260	Update.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BuiltFile-COOL.exe
"C:\Users\Admin\AppData\Local\Temp\BuiltFile-COOL.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Windows\system32\Keys\Update.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3292
- C:\Windows\system32\Keys\Update.exe
  "C:\Windows\system32\Keys\Update.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Windows\system32\Keys\Update.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4324,i,17705702031385645742,8200011525621908985,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:8
1⤵
PID:4552

C:\Windows\system32\msinfo32.exe
"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\UndoSearch.nfo"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Update.exe

Path C:\Windows\system32\Keys\Update.exe
Size 3.1MB
SHA256 57a15954866d64a8aa8cf6fd68b07b3ded8d42e66390d5dbbc0e1e135faf4246
MD5 21c00a3945381e149c463658ccddd9c4
SHA1 1dcc1b47e71a77873433e8a032f1997a82371847
SHA512 86c705b8362d35136e7b8791e44bf570dcf7e7bf9931c7c98e243b96d1f8158e0fc2b041936c2f12a4ebd711748276bc77b23d36e895cb74b92772fb9de5429c
SSDEEP 49152:KI6WGoyH0I6ZUI9IzyXfpVxXQjhoGQ+akTHHB72eh2NTkS4:KI9Gdl6ZUI9UefFgt8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/800-0-0x00007FF940463000-0x00007FF940465000-memory.dmp

Download

memory/800-1-0x0000000000300000-0x0000000000624000-memory.dmp

Download

memory/800-2-0x00007FF940460000-0x00007FF940F21000-memory.dmp

Download

memory/800-9-0x00007FF940460000-0x00007FF940F21000-memory.dmp

Download

memory/2260-10-0x00007FF940460000-0x00007FF940F21000-memory.dmp

Download

memory/2260-11-0x00007FF940460000-0x00007FF940F21000-memory.dmp

Download

memory/2260-12-0x000000001C410000-0x000000001C460000-memory.dmp

Download

memory/2260-13-0x000000001C520000-0x000000001C5D2000-memory.dmp

Download

memory/2260-14-0x00007FF940460000-0x00007FF940F21000-memory.dmp

Download

memory/2260-15-0x000000001C480000-0x000000001C492000-memory.dmp

Download

memory/2260-16-0x000000001C4E0000-0x000000001C51C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads