quasar | a0f8763b080019062ce5069410c1c08da8ccdced11281c4a5304cb19f720a722

Analysis

max time kernel
118s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 05:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
56f49ab9098894902fd8d190ca782630N.exe
Size 502KB
Sample240720-gfk3assdpb
SHA256 a0f8763b080019062ce5069410c1c08da8ccdced11281c4a5304cb19f720a722
MD5 56f49ab9098894902fd8d190ca782630
SHA1 f85571cf8fcf86e15773d55cc1049d3db7913272
SHA512 72a354339fd59f93951b7ae390c18aaf95d89280a75159b65c8c6e30f6fbf13ef9aa19814fddf41b515661735ff389a5def20e907630c94ed25fc6b0c35dc09d
SSDEEP 6144:BTEgdc0YvXAGbgiIN2RSBAOghZTPibuwcEVxb8F9cpa5UgC95JcTR3i:BTEgdfYnbgcNwleKE5Ug0fcdi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

6113042th1.vicp.fun:10535

Mutex

2fe2d448-9e49-4448-8140-da8820305e39

Attributes

encryption_key
4111EB4E3452F3046C6F5DFE90F84F08D3E1BB9C
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/3956-1-0x0000000000190000-0x0000000000214000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	56f49ab9098894902fd8d190ca782630N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	56f49ab9098894902fd8d190ca782630N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	56f49ab9098894902fd8d190ca782630N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	56f49ab9098894902fd8d190ca782630N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	56f49ab9098894902fd8d190ca782630N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
4628	PING.EXE
668	PING.EXE
4740	PING.EXE
2548	PING.EXE
1076	PING.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3956	56f49ab9098894902fd8d190ca782630N.exe
Token: SeDebugPrivilege	2408	56f49ab9098894902fd8d190ca782630N.exe
Token: SeDebugPrivilege	3624	56f49ab9098894902fd8d190ca782630N.exe
Token: SeDebugPrivilege	4368	56f49ab9098894902fd8d190ca782630N.exe
Token: SeDebugPrivilege	2932	56f49ab9098894902fd8d190ca782630N.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3956	56f49ab9098894902fd8d190ca782630N.exe
2408	56f49ab9098894902fd8d190ca782630N.exe
3624	56f49ab9098894902fd8d190ca782630N.exe
4368	56f49ab9098894902fd8d190ca782630N.exe
2932	56f49ab9098894902fd8d190ca782630N.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
3956	56f49ab9098894902fd8d190ca782630N.exe
2408	56f49ab9098894902fd8d190ca782630N.exe
3624	56f49ab9098894902fd8d190ca782630N.exe
4368	56f49ab9098894902fd8d190ca782630N.exe
2932	56f49ab9098894902fd8d190ca782630N.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 232	3956	56f49ab9098894902fd8d190ca782630N.exe	87
PID 3956 wrote to memory of 232	3956	56f49ab9098894902fd8d190ca782630N.exe	87
PID 232 wrote to memory of 3580	232	cmd.exe	89
PID 232 wrote to memory of 3580	232	cmd.exe	89
PID 232 wrote to memory of 4628	232	cmd.exe	90
PID 232 wrote to memory of 4628	232	cmd.exe	90
PID 232 wrote to memory of 2408	232	cmd.exe	97
PID 232 wrote to memory of 2408	232	cmd.exe	97
PID 2408 wrote to memory of 1620	2408	56f49ab9098894902fd8d190ca782630N.exe	104
PID 2408 wrote to memory of 1620	2408	56f49ab9098894902fd8d190ca782630N.exe	104
PID 1620 wrote to memory of 1592	1620	cmd.exe	106
PID 1620 wrote to memory of 1592	1620	cmd.exe	106
PID 1620 wrote to memory of 668	1620	cmd.exe	107
PID 1620 wrote to memory of 668	1620	cmd.exe	107
PID 1620 wrote to memory of 3624	1620	cmd.exe	108
PID 1620 wrote to memory of 3624	1620	cmd.exe	108
PID 3624 wrote to memory of 224	3624	56f49ab9098894902fd8d190ca782630N.exe	109
PID 3624 wrote to memory of 224	3624	56f49ab9098894902fd8d190ca782630N.exe	109
PID 224 wrote to memory of 5040	224	cmd.exe	111
PID 224 wrote to memory of 5040	224	cmd.exe	111
PID 224 wrote to memory of 4740	224	cmd.exe	112
PID 224 wrote to memory of 4740	224	cmd.exe	112
PID 224 wrote to memory of 4368	224	cmd.exe	121
PID 224 wrote to memory of 4368	224	cmd.exe	121
PID 4368 wrote to memory of 2252	4368	56f49ab9098894902fd8d190ca782630N.exe	122
PID 4368 wrote to memory of 2252	4368	56f49ab9098894902fd8d190ca782630N.exe	122
PID 2252 wrote to memory of 5000	2252	cmd.exe	124
PID 2252 wrote to memory of 5000	2252	cmd.exe	124
PID 2252 wrote to memory of 2548	2252	cmd.exe	125
PID 2252 wrote to memory of 2548	2252	cmd.exe	125
PID 2252 wrote to memory of 2932	2252	cmd.exe	126
PID 2252 wrote to memory of 2932	2252	cmd.exe	126
PID 2932 wrote to memory of 840	2932	56f49ab9098894902fd8d190ca782630N.exe	127
PID 2932 wrote to memory of 840	2932	56f49ab9098894902fd8d190ca782630N.exe	127
PID 840 wrote to memory of 3988	840	cmd.exe	129
PID 840 wrote to memory of 3988	840	cmd.exe	129
PID 840 wrote to memory of 1076	840	cmd.exe	130
PID 840 wrote to memory of 1076	840	cmd.exe	130

C:\Users\Admin\AppData\Local\Temp\56f49ab9098894902fd8d190ca782630N.exe
"C:\Users\Admin\AppData\Local\Temp\56f49ab9098894902fd8d190ca782630N.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E63frgMSJBW6.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3580
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - Runs ping.exe
    PID:4628
- - C:\Users\Admin\AppData\Local\Temp\56f49ab9098894902fd8d190ca782630N.exe
    "C:\Users\Admin\AppData\Local\Temp\56f49ab9098894902fd8d190ca782630N.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QrFzFWSPKm2k.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1620
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1592
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:668
    - - C:\Users\Admin\AppData\Local\Temp\56f49ab9098894902fd8d190ca782630N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\56f49ab9098894902fd8d190ca782630N.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3624
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Q5JF6ZVNEVbG.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:5040
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\56f49ab9098894902fd8d190ca782630N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\56f49ab9098894902fd8d190ca782630N.exe"
        7⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YXoCRe8ZEo8e.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:5000
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\56f49ab9098894902fd8d190ca782630N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\56f49ab9098894902fd8d190ca782630N.exe"
        9⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6pO4u9ngw57c.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:3988
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

56f49ab9098894902fd8d190ca782630N.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\56f49ab9098894902fd8d190ca782630N.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

6pO4u9ngw57c.bat

Path C:\Users\Admin\AppData\Local\Temp\6pO4u9ngw57c.bat
Size 230B
SHA256 4914474439f64c5b5686b3b39e1cca5cab539dcc6b6b12a850032e59b9304c21
MD5 077583871bca1d494238d16c5051a461
SHA1 7b32962a868241fe8f2a03a5575914780bac14f4
SHA512 69ade84cce9b8c4dd9fa844c4934814738277f2d85015a2aa43a8bc34c5c321c005e0b060aa71bbeacc2e4b12197f64f9f4607662a6d308be109b60e3b5afd66
MD5 SHA1 SHA512

Submit Download

E63frgMSJBW6.bat

Path C:\Users\Admin\AppData\Local\Temp\E63frgMSJBW6.bat
Size 230B
SHA256 2f0e7db606768805f65c001a63c1b7d5ddceeebfd9283b37c9be917905992814
MD5 a67bf9cc4d14df4dd2bfbcea0f3025d0
SHA1 9d9e7b7cfaba961a51dbcc08f0a9da025d10551c
SHA512 9331f141b13f6075d208f4cbe3daab32c814dba6ce6420080ebdb5b34c5faafb15364713086fc3d221d34a11cb94e8121c9ccf087c67e8608dcf00182b4c4b43
MD5 SHA1 SHA512

Submit Download

Q5JF6ZVNEVbG.bat

Path C:\Users\Admin\AppData\Local\Temp\Q5JF6ZVNEVbG.bat
Size 230B
SHA256 f617dbeaa7efe726390c9f5d12d972ce2a2b0017d12213c890cf619254798c63
MD5 3420c82afa2447c57e4655ac8efb8c39
SHA1 f444aa110af3a5723f2b97c62a93f8a7aee761f9
SHA512 b876f915a56bff5705b1ea9bf6e14d812134f94f1183fd27178a3c3a36c834789603be686b2c35eba07e25ab4f32d9976012d31bd3161b2d86fe9acdd47bdbeb
MD5 SHA1 SHA512

Submit Download

QrFzFWSPKm2k.bat

Path C:\Users\Admin\AppData\Local\Temp\QrFzFWSPKm2k.bat
Size 230B
SHA256 b267fcede9e6124805fe3e65ec6671404a99fb456b4cbece79f4e44563af9aa9
MD5 67844620d689b2f4bc4daabde30a8e76
SHA1 e0633cc013f988dbf1d1f8729f6332f8e11340dc
SHA512 e9ce71c63e1fc601e84bf52acd1ee00630141f7c7f682418263dd501b23d1858ec4ad0c54720b98ea6febc073c4afa41676631586ca0887ddaafb1c9207b8f6b
MD5 SHA1 SHA512

Submit Download

YXoCRe8ZEo8e.bat

Path C:\Users\Admin\AppData\Local\Temp\YXoCRe8ZEo8e.bat
Size 230B
SHA256 8951e88eacc87820f844e29f4835f64465cb05542f66246a02f32e7ca42edfeb
MD5 f4eeb0531e24aaee56eb3cc663734563
SHA1 8773ddf00442c18ecbf426078001e5c341f24872
SHA512 a90694a29c534edfb5d659e4d1377973f147d9f51d06673a3fed3751615c4e14f1b83462a38555d8028d4123aa3695962c687161d1a81452c3b86618c173bb72
MD5 SHA1 SHA512

Submit Download

memory/2408-12-0x00007FFCE1F40000-0x00007FFCE2A01000-memory.dmp

Download

memory/2408-13-0x00007FFCE1F40000-0x00007FFCE2A01000-memory.dmp

Download

memory/2408-14-0x00007FFCE1F40000-0x00007FFCE2A01000-memory.dmp

Download

memory/2408-15-0x00007FFCE1F40000-0x00007FFCE2A01000-memory.dmp

Download

memory/2408-20-0x00007FFCE1F40000-0x00007FFCE2A01000-memory.dmp

Download

memory/3956-9-0x00007FFCE2340000-0x00007FFCE2E01000-memory.dmp

Download

memory/3956-0-0x00007FFCE2343000-0x00007FFCE2345000-memory.dmp

Download

memory/3956-4-0x000000001B830000-0x000000001B8E2000-memory.dmp

Download

memory/3956-3-0x000000001B720000-0x000000001B770000-memory.dmp

Download

memory/3956-2-0x00007FFCE2340000-0x00007FFCE2E01000-memory.dmp

Download

memory/3956-1-0x0000000000190000-0x0000000000214000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads