quasar | 16cec39516c027931e00d61402f36b2506498022a99e3091bbc318fd12766540

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 284KB
Sample240719-acpgzsweng
SHA256 16cec39516c027931e00d61402f36b2506498022a99e3091bbc318fd12766540
MD5 af67437f07e8cf4d2c492969bdfdece1
SHA1 3b4f09b6513370a4db605a75b25a96292bcb7259
SHA512 7ef7cabaa2d53ae3f18024e1aaf16b56c48495d83dbf2f674d47064314b8d2e316c81faf23bead927df4a45720c9d146cfb1d111a7fe0e8e839eae938c278f59
SSDEEP 3072:1pvbFf+VvD5h9ehOC3xBYtUaUMuSUe9FsrqhFtzd+YBNBHzP/4XzKbQJpEwbwuqm:/NyVCNAEl1OGrq5zTbQHHZS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	Client-built.exe

Executes dropped EXE 1 IoCs

pid	Process
2452	game.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\rrt.exe\game.exe	Client-built.exe
File opened for modification	C:\Program Files\rrt.exe\game.exe	Client-built.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1132	Client-built.exe
Token: SeDebugPrivilege	2452	game.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2452	game.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 2452	1132	Client-built.exe	89
PID 1132 wrote to memory of 2452	1132	Client-built.exe	89
PID 5052 wrote to memory of 4512	5052	msedge.exe	108
PID 5052 wrote to memory of 4512	5052	msedge.exe	108
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3336	5052	msedge.exe	109
PID 5052 wrote to memory of 3316	5052	msedge.exe	110
PID 5052 wrote to memory of 3316	5052	msedge.exe	110
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111
PID 5052 wrote to memory of 212	5052	msedge.exe	111

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Program Files\rrt.exe\game.exe
  "C:\Program Files\rrt.exe\game.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault22b3930chfd6bh43b3hb9c5h46a4b0336ee8
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa756446f8,0x7ffa75644708,0x7ffa75644718
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10502993253127681671,16224590517614505952,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,10502993253127681671,16224590517614505952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,10502993253127681671,16224590517614505952,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1404 /prefetch:8
  2⤵
  PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

game.exe

Path C:\Program Files\rrt.exe\game.exe
Size 284KB
SHA256 16cec39516c027931e00d61402f36b2506498022a99e3091bbc318fd12766540
MD5 af67437f07e8cf4d2c492969bdfdece1
SHA1 3b4f09b6513370a4db605a75b25a96292bcb7259
SHA512 7ef7cabaa2d53ae3f18024e1aaf16b56c48495d83dbf2f674d47064314b8d2e316c81faf23bead927df4a45720c9d146cfb1d111a7fe0e8e839eae938c278f59
SSDEEP 3072:1pvbFf+VvD5h9ehOC3xBYtUaUMuSUe9FsrqhFtzd+YBNBHzP/4XzKbQJpEwbwuqm:/NyVCNAEl1OGrq5zTbQHHZS
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24
MD5 54f1b76300ce15e44e5cc1a3947f5ca9
SHA1 c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7
SHA512 ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 19122aa1346b51b47d82beecc64fcbe9892eb85b5225591bca7fa5f378a7ecc6
MD5 d15a60594ef0beb77d6813469209e44f
SHA1 22f9614c5f492a49361487724ab5b40249489d60
SHA512 b67e7f9c1c6da57b7f7a72a9efe6dae61edb9c47a67059f7adb202689e3e090512ade245ec5e726cd6f8f2e978b2cf28921cbc498ef22ffaed774e0df969efcc
SSDEEP 96:n5GH18Ed4UwpvWMoiVmdeH7cG5yUWQyV+VDCAiEwb:n5Qd4UGWMXgOyrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b58833b506a4fbfb09ad15d915ff7d64f4291c7b20267340d0679bab6ac68049
MD5 626b72c758607b21d66edf6795293d21
SHA1 27707cb588e647280a692c72d310cb2d7e29f263
SHA512 b0503c1848b489a9f695490159d1d30c36f13bb88c3b2de57dc61972cfa64e47268bf070ef090f182c87c3a7a6309e4524de8dad1c6e13bcb89625953fac2507
SSDEEP 192:koCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupGiTe2RUZsFKD:E9iIxuERzA83h09RZxYbDhKD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1132-3-0x000000001C770000-0x000000001C80C000-memory.dmp

Download

memory/1132-6-0x00007FFA79ED0000-0x00007FFA7A871000-memory.dmp

Download

memory/1132-5-0x000000001C870000-0x000000001C8D2000-memory.dmp

Download

memory/1132-20-0x00007FFA79ED0000-0x00007FFA7A871000-memory.dmp

Download

memory/1132-4-0x00007FFA79ED0000-0x00007FFA7A871000-memory.dmp

Download

memory/1132-0-0x00007FFA7A185000-0x00007FFA7A186000-memory.dmp

Download

memory/1132-2-0x000000001C200000-0x000000001C6CE000-memory.dmp

Download

memory/1132-1-0x00007FFA79ED0000-0x00007FFA7A871000-memory.dmp

Download

memory/2452-22-0x00007FFA79ED0000-0x00007FFA7A871000-memory.dmp

Download

memory/2452-27-0x000000001C710000-0x000000001C718000-memory.dmp

Download

memory/2452-28-0x00007FFA79ED0000-0x00007FFA7A871000-memory.dmp

Download

memory/2452-26-0x00007FFA79ED0000-0x00007FFA7A871000-memory.dmp

Download

memory/2452-24-0x00007FFA79ED0000-0x00007FFA7A871000-memory.dmp

Download

memory/2452-23-0x00007FFA79ED0000-0x00007FFA7A871000-memory.dmp

Download

memory/2452-21-0x00007FFA79ED0000-0x00007FFA7A871000-memory.dmp

Download

memory/2452-78-0x00007FFA79ED0000-0x00007FFA7A871000-memory.dmp

Download