quasar | 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/08/2024, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c682f5b5000cd003e76530706955a72.exe
Size 3.1MB
Sample240804-pdq5jaygne
SHA256 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522
MD5 9c682f5b5000cd003e76530706955a72
SHA1 1a69da76e05d114a317342dae3e9c7b10f107d43
SHA512 33bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f
SSDEEP 49152:CvIt62XlaSFNWPjljiFa2RoUYIqC41JoLoGdX/THHB72eh2NT:CvE62XlaSFNWPjljiFXRoUYIqC9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

51.222.21.20:4782

Mutex

374acc94-a8cd-45c6-bc31-752e0f83541d

Attributes

encryption_key
5B2A5F50FABB3F6748116D7077D95758D0DFFC77
install_name
svchost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svchost
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/408-1-0x0000000000AB0000-0x0000000000DD4000-memory.dmp	family_quasar
behavioral2/files/0x000a000000023462-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2720	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4344	schtasks.exe
5096	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	408	9c682f5b5000cd003e76530706955a72.exe
Token: SeDebugPrivilege	2720	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 4344	408	9c682f5b5000cd003e76530706955a72.exe	86
PID 408 wrote to memory of 4344	408	9c682f5b5000cd003e76530706955a72.exe	86
PID 408 wrote to memory of 2720	408	9c682f5b5000cd003e76530706955a72.exe	88
PID 408 wrote to memory of 2720	408	9c682f5b5000cd003e76530706955a72.exe	88
PID 2720 wrote to memory of 5096	2720	svchost.exe	89
PID 2720 wrote to memory of 5096	2720	svchost.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9c682f5b5000cd003e76530706955a72.exe
"C:\Users\Admin\AppData\Local\Temp\9c682f5b5000cd003e76530706955a72.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4344
- C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
Size 3.1MB
SHA256 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522
MD5 9c682f5b5000cd003e76530706955a72
SHA1 1a69da76e05d114a317342dae3e9c7b10f107d43
SHA512 33bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f
SSDEEP 49152:CvIt62XlaSFNWPjljiFa2RoUYIqC41JoLoGdX/THHB72eh2NT:CvE62XlaSFNWPjljiFXRoUYIqC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/408-0-0x00007FF810C13000-0x00007FF810C15000-memory.dmp

Download

memory/408-1-0x0000000000AB0000-0x0000000000DD4000-memory.dmp

Download

memory/408-2-0x00007FF810C10000-0x00007FF8116D1000-memory.dmp

Download

memory/408-9-0x00007FF810C10000-0x00007FF8116D1000-memory.dmp

Download

memory/2720-10-0x00007FF810C10000-0x00007FF8116D1000-memory.dmp

Download

memory/2720-11-0x000000001D450000-0x000000001D4A0000-memory.dmp

Download

memory/2720-12-0x000000001D560000-0x000000001D612000-memory.dmp

Download

memory/2720-13-0x00007FF810C10000-0x00007FF8116D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads