quasar | 5d381749978407c5259a4da354166ee8a9fb5e934c920d69305f8db93a6c529c

Resubmissions

15/08/2024, 21:32

240815-1dvy9swarg10

15/08/2024, 21:30

240815-1csshszenp10

Analysis

max time kernel
10s
max time network
13s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2024, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample240815-1csshszenp
SHA256 5d381749978407c5259a4da354166ee8a9fb5e934c920d69305f8db93a6c529c
MD5 f4295363b8ae6c643d34ca268606bf7a
SHA1 7fa440bc1ecd3ff4cd6a0eda3c9394c7e1630cc0
SHA512 06b07fbaad625e9189d0a78cccb7f7087f40c1d3704e5673b367c07a0b81e1cf8d8405d4c1064d11b1dce85173b5b4a8d379a2d0f17d8f4570abc048b207b7f5
SSDEEP 49152:OvyI22SsaNYfdPBldt698dBcjH+CU1JLLoGd5THHB72eh2NT:Ovf22SsaNYfdPBldt6+dBcjH+Co
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

2601:601:480:5e0::ee14:4782

Mutex

367fc473-e902-4dc9-9702-0593f8980259

Attributes

encryption_key
E8CDDBBA590873BFD4CA899CC44B15C399BC1E2A
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3888-1-0x00000000008F0000-0x0000000000C14000-memory.dmp	family_quasar
behavioral2/files/0x000800000002347c-6.dat	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 1 IoCs

pid	Process
3700	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1960	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1960	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1800	schtasks.exe
4760	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3888	Client-built.exe
Token: SeDebugPrivilege	3700	Client.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 1800	3888	Client-built.exe	87
PID 3888 wrote to memory of 1800	3888	Client-built.exe	87
PID 3888 wrote to memory of 3700	3888	Client-built.exe	89
PID 3888 wrote to memory of 3700	3888	Client-built.exe	89
PID 3700 wrote to memory of 4760	3700	Client.exe	90
PID 3700 wrote to memory of 4760	3700	Client.exe	90
PID 3700 wrote to memory of 2380	3700	Client.exe	92
PID 3700 wrote to memory of 2380	3700	Client.exe	92
PID 2380 wrote to memory of 1564	2380	cmd.exe	94
PID 2380 wrote to memory of 1564	2380	cmd.exe	94
PID 2380 wrote to memory of 1960	2380	cmd.exe	95
PID 2380 wrote to memory of 1960	2380	cmd.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1800
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QqVZuaM8B4Uc.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1564
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QqVZuaM8B4Uc.bat

Path C:\Users\Admin\AppData\Local\Temp\QqVZuaM8B4Uc.bat
Size 207B
SHA256 1a64f89acfe53c7defdb1117a5820421abeac7b8240c6f205c351c138421384b
MD5 09e992e372657b394ff95580592be4eb
SHA1 fa4d09276a6da34963cf8668975fcb96b913ee2d
SHA512 529a6f2953b997f3db401192cc88986e49291010c65d428d4d7a6440fc6ee1f7ce3356295ab975a0e11ed8b626eca1b5ecee2e1de10bb9a89f9f7117592662a4
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 5d381749978407c5259a4da354166ee8a9fb5e934c920d69305f8db93a6c529c
MD5 f4295363b8ae6c643d34ca268606bf7a
SHA1 7fa440bc1ecd3ff4cd6a0eda3c9394c7e1630cc0
SHA512 06b07fbaad625e9189d0a78cccb7f7087f40c1d3704e5673b367c07a0b81e1cf8d8405d4c1064d11b1dce85173b5b4a8d379a2d0f17d8f4570abc048b207b7f5
SSDEEP 49152:OvyI22SsaNYfdPBldt698dBcjH+CU1JLLoGd5THHB72eh2NT:Ovf22SsaNYfdPBldt6+dBcjH+Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3700-9-0x00007FF850B80000-0x00007FF851641000-memory.dmp

Download

memory/3700-11-0x00007FF850B80000-0x00007FF851641000-memory.dmp

Download

memory/3700-12-0x000000001B560000-0x000000001B5B0000-memory.dmp

Download

memory/3700-13-0x000000001BDB0000-0x000000001BE62000-memory.dmp

Download

memory/3700-19-0x00007FF850B80000-0x00007FF851641000-memory.dmp

Download

memory/3888-0-0x00007FF850B83000-0x00007FF850B85000-memory.dmp

Download

memory/3888-1-0x00000000008F0000-0x0000000000C14000-memory.dmp

Download

memory/3888-2-0x00007FF850B80000-0x00007FF851641000-memory.dmp

Download

memory/3888-10-0x00007FF850B80000-0x00007FF851641000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads