Analysis Overview
SHA256
659f42a823f37790b2cbdbfc19d0755a3471bfcb0097cdf48e2f891df62f4819
Threat Level: Known bad
The file Client-built.exe was found to be: Known bad.
Malicious Activity Summary
Quasar payload
Quasar family
Quasar RAT
Executes dropped EXE
Drops file in System32 directory
Unsigned PE
Scheduled Task/Job: Scheduled Task
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Uses Task Scheduler COM API
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-18 22:00
Signatures
Quasar family
Quasar payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-18 22:00
Reported
2024-08-18 22:03
Platform
win10v2004-20240802-fr
Max time kernel
136s
Max time network
147s
Command Line
Signatures
Quasar RAT
Quasar payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\Windows\Windows Host Process.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\system32\Windows\Windows Host Process.exe | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
| File opened for modification | C:\Windows\system32\Windows\Windows Host Process.exe | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
| File opened for modification | C:\Windows\system32\Windows | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
| File opened for modification | C:\Windows\system32\Windows\Windows Host Process.exe | C:\Windows\system32\Windows\Windows Host Process.exe | N/A |
| File opened for modification | C:\Windows\system32\Windows | C:\Windows\system32\Windows\Windows Host Process.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\Windows\Windows Host Process.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\Windows\Windows Host Process.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3628 wrote to memory of 3480 | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | C:\Windows\SYSTEM32\schtasks.exe |
| PID 3628 wrote to memory of 3480 | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | C:\Windows\SYSTEM32\schtasks.exe |
| PID 3628 wrote to memory of 2356 | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | C:\Windows\system32\Windows\Windows Host Process.exe |
| PID 3628 wrote to memory of 2356 | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | C:\Windows\system32\Windows\Windows Host Process.exe |
| PID 2356 wrote to memory of 2792 | N/A | C:\Windows\system32\Windows\Windows Host Process.exe | C:\Windows\SYSTEM32\schtasks.exe |
| PID 2356 wrote to memory of 2792 | N/A | C:\Windows\system32\Windows\Windows Host Process.exe | C:\Windows\SYSTEM32\schtasks.exe |
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f
C:\Windows\system32\Windows\Windows Host Process.exe
"C:\Windows\system32\Windows\Windows Host Process.exe"
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 147.185.221.22:6712 | tcp | |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 147.185.221.22:6712 | tcp | |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 147.185.221.22:6712 | tcp | |
| US | 8.8.8.8:53 | 240.143.123.92.in-addr.arpa | udp |
| US | 147.185.221.22:6712 | tcp | |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 147.185.221.22:6712 | tcp | |
| US | 147.185.221.22:6712 | tcp |
Files
memory/3628-0-0x00007FF9F28B3000-0x00007FF9F28B5000-memory.dmp
memory/3628-1-0x0000000000E90000-0x00000000011E6000-memory.dmp
memory/3628-2-0x00007FF9F28B0000-0x00007FF9F3371000-memory.dmp
C:\Windows\System32\Windows\Windows Host Process.exe
| MD5 | 7ab6f43a992374ea2bc02b6870f92726 |
| SHA1 | 52277ea3799bc72c661a82d079184898239301db |
| SHA256 | 659f42a823f37790b2cbdbfc19d0755a3471bfcb0097cdf48e2f891df62f4819 |
| SHA512 | e9e98280a618966b3585c684d113ceee90a57e46ce02c64ab64c2a242f51e024c3c5f4f0313587afb9baf02960f6d6ebd939726dbab26680a4d8a6fcfc420a5e |
memory/2356-9-0x00007FF9F28B0000-0x00007FF9F3371000-memory.dmp
memory/3628-10-0x00007FF9F28B0000-0x00007FF9F3371000-memory.dmp
memory/2356-11-0x00007FF9F28B0000-0x00007FF9F3371000-memory.dmp
memory/2356-12-0x0000000001B30000-0x0000000001B80000-memory.dmp
memory/2356-13-0x000000001C050000-0x000000001C102000-memory.dmp
memory/2356-14-0x00007FF9F28B0000-0x00007FF9F3371000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2024-08-18 22:00
Reported
2024-08-18 22:03
Platform
win11-20240802-fr
Max time kernel
150s
Max time network
155s
Command Line
Signatures
Quasar RAT
Quasar payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\Windows\Windows Host Process.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\Windows\Windows Host Process.exe | C:\Windows\system32\Windows\Windows Host Process.exe | N/A |
| File opened for modification | C:\Windows\system32\Windows | C:\Windows\system32\Windows\Windows Host Process.exe | N/A |
| File created | C:\Windows\system32\Windows\Windows Host Process.exe | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
| File opened for modification | C:\Windows\system32\Windows\Windows Host Process.exe | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
| File opened for modification | C:\Windows\system32\Windows | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\Windows\Windows Host Process.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\Windows\Windows Host Process.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4028 wrote to memory of 1544 | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | C:\Windows\SYSTEM32\schtasks.exe |
| PID 4028 wrote to memory of 1544 | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | C:\Windows\SYSTEM32\schtasks.exe |
| PID 4028 wrote to memory of 4720 | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | C:\Windows\system32\Windows\Windows Host Process.exe |
| PID 4028 wrote to memory of 4720 | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | C:\Windows\system32\Windows\Windows Host Process.exe |
| PID 4720 wrote to memory of 1860 | N/A | C:\Windows\system32\Windows\Windows Host Process.exe | C:\Windows\SYSTEM32\schtasks.exe |
| PID 4720 wrote to memory of 1860 | N/A | C:\Windows\system32\Windows\Windows Host Process.exe | C:\Windows\SYSTEM32\schtasks.exe |
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f
C:\Windows\system32\Windows\Windows Host Process.exe
"C:\Windows\system32\Windows\Windows Host Process.exe"
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f
Network
| Country | Destination | Domain | Proto |
| US | 147.185.221.22:6712 | tcp | |
| US | 147.185.221.22:6712 | tcp | |
| US | 147.185.221.22:6712 | tcp | |
| US | 147.185.221.22:6712 | tcp | |
| US | 147.185.221.22:6712 | tcp | |
| US | 147.185.221.22:6712 | tcp | |
| US | 147.185.221.22:6712 | tcp |
Files
memory/4028-0-0x00007FFF5CCA0000-0x00007FFF5CDB2000-memory.dmp
memory/4028-1-0x00000000008E0000-0x0000000000C36000-memory.dmp
C:\Windows\System32\Windows\Windows Host Process.exe
| MD5 | 7ab6f43a992374ea2bc02b6870f92726 |
| SHA1 | 52277ea3799bc72c661a82d079184898239301db |
| SHA256 | 659f42a823f37790b2cbdbfc19d0755a3471bfcb0097cdf48e2f891df62f4819 |
| SHA512 | e9e98280a618966b3585c684d113ceee90a57e46ce02c64ab64c2a242f51e024c3c5f4f0313587afb9baf02960f6d6ebd939726dbab26680a4d8a6fcfc420a5e |
memory/4028-8-0x00007FFF5CCA0000-0x00007FFF5CDB2000-memory.dmp
memory/4720-9-0x00007FFF5CCA0000-0x00007FFF5CDB2000-memory.dmp
memory/4720-10-0x000000001B250000-0x000000001B2A0000-memory.dmp
memory/4720-11-0x000000001BEA0000-0x000000001BF52000-memory.dmp
memory/4720-12-0x00007FFF5CCA0000-0x00007FFF5CDB2000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-18 22:00
Reported
2024-08-18 22:03
Platform
win10-20240404-fr
Max time kernel
149s
Max time network
157s
Command Line
Signatures
Quasar RAT
Quasar payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\Windows\Windows Host Process.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\system32\Windows\Windows Host Process.exe | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
| File opened for modification | C:\Windows\system32\Windows\Windows Host Process.exe | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
| File opened for modification | C:\Windows\system32\Windows | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
| File opened for modification | C:\Windows\system32\Windows\Windows Host Process.exe | C:\Windows\system32\Windows\Windows Host Process.exe | N/A |
| File opened for modification | C:\Windows\system32\Windows | C:\Windows\system32\Windows\Windows Host Process.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\Windows\Windows Host Process.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\Windows\Windows Host Process.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 5056 wrote to memory of 1608 | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | C:\Windows\SYSTEM32\schtasks.exe |
| PID 5056 wrote to memory of 1608 | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | C:\Windows\SYSTEM32\schtasks.exe |
| PID 5056 wrote to memory of 4460 | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | C:\Windows\system32\Windows\Windows Host Process.exe |
| PID 5056 wrote to memory of 4460 | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | C:\Windows\system32\Windows\Windows Host Process.exe |
| PID 4460 wrote to memory of 2780 | N/A | C:\Windows\system32\Windows\Windows Host Process.exe | C:\Windows\SYSTEM32\schtasks.exe |
| PID 4460 wrote to memory of 2780 | N/A | C:\Windows\system32\Windows\Windows Host Process.exe | C:\Windows\SYSTEM32\schtasks.exe |
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f
C:\Windows\system32\Windows\Windows Host Process.exe
"C:\Windows\system32\Windows\Windows Host Process.exe"
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows Host Process" /sc ONLOGON /tr "C:\Windows\system32\Windows\Windows Host Process.exe" /rl HIGHEST /f
Network
| Country | Destination | Domain | Proto |
| US | 147.185.221.22:6712 | tcp | |
| US | 147.185.221.22:6712 | tcp | |
| US | 8.8.8.8:53 | 0.0.0.0.0.0.0.0.0.0.0.0.d.2.0.5.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 147.185.221.22:6712 | tcp | |
| US | 147.185.221.22:6712 | tcp | |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| US | 147.185.221.22:6712 | tcp | |
| US | 147.185.221.22:6712 | tcp | |
| US | 8.8.8.8:53 | 27.73.42.20.in-addr.arpa | udp |
| US | 147.185.221.22:6712 | tcp |
Files
memory/5056-0-0x00007FFA5B0D3000-0x00007FFA5B0D4000-memory.dmp
memory/5056-1-0x0000000000E10000-0x0000000001166000-memory.dmp
memory/5056-2-0x00007FFA5B0D0000-0x00007FFA5BABC000-memory.dmp
C:\Windows\System32\Windows\Windows Host Process.exe
| MD5 | 7ab6f43a992374ea2bc02b6870f92726 |
| SHA1 | 52277ea3799bc72c661a82d079184898239301db |
| SHA256 | 659f42a823f37790b2cbdbfc19d0755a3471bfcb0097cdf48e2f891df62f4819 |
| SHA512 | e9e98280a618966b3585c684d113ceee90a57e46ce02c64ab64c2a242f51e024c3c5f4f0313587afb9baf02960f6d6ebd939726dbab26680a4d8a6fcfc420a5e |
memory/4460-10-0x00007FFA5B0D0000-0x00007FFA5BABC000-memory.dmp
memory/5056-9-0x00007FFA5B0D0000-0x00007FFA5BABC000-memory.dmp
memory/4460-11-0x00007FFA5B0D0000-0x00007FFA5BABC000-memory.dmp
memory/4460-12-0x000000001BF70000-0x000000001BFC0000-memory.dmp
memory/4460-13-0x000000001C080000-0x000000001C132000-memory.dmp
memory/4460-14-0x00007FFA5B0D0000-0x00007FFA5BABC000-memory.dmp