quasar | e8495cf162901ea41b563416d6bae7314fc326153909fc4dc2fbf3789bb4ddce

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
49416c6ff8ab8acdb58cc76313b37e40N.exe
Size 7.3MB
Sample240726-ya2xastbph
SHA256 e8495cf162901ea41b563416d6bae7314fc326153909fc4dc2fbf3789bb4ddce
MD5 49416c6ff8ab8acdb58cc76313b37e40
SHA1 6ef696eebbe4044a1042ecf05da6165b866f7c7f
SHA512 bce5705d168ae73910503d588b282ab9f4a133e06df9ba0abfff26d570e5eca12c333d9918adc35f4ff3320eeebf8508807ecf8b686058bab6fab8301641cb33
SSDEEP 98304:YvA22SsaNYfdPBldt6+dBcjHzwRJ6q3uJn/ML1u+GgQMn4c7/u4k4m97os4s4kB2:G17jKf3cML1u+GgV77/kZoWt7SovTTGj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

HuntyLeCrack-34455.portmap.host:34455

Mutex

c0bb0db4-b3db-4375-8023-6295f7dafdfb

Attributes

encryption_key
1F0B9B038FAD9F718417CAD9EA9E69943C71D876
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Updater
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023419-13.dat	family_quasar
behavioral2/memory/2120-26-0x0000000000310000-0x0000000000634000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	49416c6ff8ab8acdb58cc76313b37e40N.exe

Executes dropped EXE 3 IoCs

pid	Process
2120	fffffffffffffffff.exe
2940	AmnesiaLauncher.exe
2912	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2356	schtasks.exe
1508	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2120	fffffffffffffffff.exe
Token: SeDebugPrivilege	2912	Client.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	Client.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2912	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2912	Client.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 2120	3548	49416c6ff8ab8acdb58cc76313b37e40N.exe	86
PID 3548 wrote to memory of 2120	3548	49416c6ff8ab8acdb58cc76313b37e40N.exe	86
PID 3548 wrote to memory of 2940	3548	49416c6ff8ab8acdb58cc76313b37e40N.exe	87
PID 3548 wrote to memory of 2940	3548	49416c6ff8ab8acdb58cc76313b37e40N.exe	87
PID 2120 wrote to memory of 1508	2120	fffffffffffffffff.exe	88
PID 2120 wrote to memory of 1508	2120	fffffffffffffffff.exe	88
PID 2120 wrote to memory of 2912	2120	fffffffffffffffff.exe	90
PID 2120 wrote to memory of 2912	2120	fffffffffffffffff.exe	90
PID 2912 wrote to memory of 2356	2912	Client.exe	93
PID 2912 wrote to memory of 2356	2912	Client.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\49416c6ff8ab8acdb58cc76313b37e40N.exe
"C:\Users\Admin\AppData\Local\Temp\49416c6ff8ab8acdb58cc76313b37e40N.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Users\Admin\AppData\Local\Temp\fffffffffffffffff.exe
  "C:\Users\Admin\AppData\Local\Temp\fffffffffffffffff.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1508
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2356
- C:\Users\Admin\AppData\Local\Temp\AmnesiaLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\AmnesiaLauncher.exe"
  2⤵
  - Executes dropped EXE
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AmnesiaLauncher.exe

Path C:\Users\Admin\AppData\Local\Temp\AmnesiaLauncher.exe
Size 4.1MB
SHA256 217b4e628d2db46bb50f1941bba79aa5378355af4e5cb8528dbd6ab0abf4b76c
MD5 b1d68c8dffde7d4ee2c4e09d7808ba2d
SHA1 62b97cb799f10275f8f4841d83000063d9c5303b
SHA512 5251e03b296474218e0edf994daeebf9e576753c36c5b9625ebcaf47a98a96c4e8a05a27c0c6b494c07226195789d094b9182d8d52ace6f0672e30b97dcb9d22
SSDEEP 98304:/n/ML1u+GgQMn4c7/u4k4m97os4s4kBRiyEovTxpP2tTZ:3ML1u+GgV77/kZoWt7SovTTG
MD5 SHA1 SHA512 SSDEEP

Submit Download

fffffffffffffffff.exe

Path C:\Users\Admin\AppData\Local\Temp\fffffffffffffffff.exe
Size 3.1MB
SHA256 b8eb6c2256ef38fae8ff396c96ef5445f2923adf6405d45af0853784d868f594
MD5 a1bb0514110c44ab67f2c2b5fd47a145
SHA1 8410bb16a31dd24bdc8249abde00e256bdb06ff1
SHA512 bd7c0523ffac927e8bc7bb69834da65c02715ee3bb9f705b14e05e07443e4a6d5cc238d0224ed9bf913a42fde9dd7a845348cda6721b579957eaa539a57ecfdd
SSDEEP 98304:nvA22SsaNYfdPBldt6+dBcjHzwRJ6q3u:v17jKf3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2120-38-0x00007FFCC36C0000-0x00007FFCC4181000-memory.dmp

Download

memory/2120-31-0x00007FFCC36C0000-0x00007FFCC4181000-memory.dmp

Download

memory/2120-26-0x0000000000310000-0x0000000000634000-memory.dmp

Download

memory/2120-24-0x00007FFCC36C3000-0x00007FFCC36C5000-memory.dmp

Download

memory/2912-40-0x000000001CE20000-0x000000001CED2000-memory.dmp

Download

memory/2912-39-0x000000001CD10000-0x000000001CD60000-memory.dmp

Download

memory/3548-4-0x00007FFCC6330000-0x00007FFCC6CD1000-memory.dmp

Download

memory/3548-7-0x000000001C210000-0x000000001C25C000-memory.dmp

Download

memory/3548-6-0x0000000000F60000-0x0000000000F68000-memory.dmp

Download

memory/3548-5-0x000000001C0B0000-0x000000001C14C000-memory.dmp

Download

memory/3548-30-0x00007FFCC6330000-0x00007FFCC6CD1000-memory.dmp

Download

memory/3548-0-0x00007FFCC65E5000-0x00007FFCC65E6000-memory.dmp

Download

memory/3548-3-0x000000001BB10000-0x000000001BFDE000-memory.dmp

Download

memory/3548-2-0x00007FFCC6330000-0x00007FFCC6CD1000-memory.dmp

Download

memory/3548-1-0x000000001B590000-0x000000001B636000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads