quasar | b7521fbbcc6a7324f8c8849b5e16dfc2a00d1b648e70b47a93a2b97ac4df3738

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoWizard.exe
Size 3.1MB
Sample240920-c678asvbla
SHA256 b7521fbbcc6a7324f8c8849b5e16dfc2a00d1b648e70b47a93a2b97ac4df3738
MD5 10940d658a4c54da91d0c0724d47644e
SHA1 da3d9e51ccc7432746d066337fb459bbf624c92a
SHA512 a1ff398937f75c51dd199553cd41889cbf7c0e9b498f1fc6f26ad9ffc13778a189b74c5c7f577a85778215cfa89e85467046e1054b8684aeb9ff58383afdb15c
SSDEEP 49152:OvblL26AaNeWgPhlmVqvMQ7XSKfX8FEFUhk/bBLoGdZpTHHB72eh2NT:OvBL26AaNeWgPhlmVqkQ7XSKP8sRp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

natural-processor.gl.at.ply.gg:52897

Mutex

db07703d-6eb7-451c-b4c1-daa365c5e21a

Attributes

encryption_key
D6BBAE7A79E9CB135CA60E651F157605EA259426
install_name
AutoWizard.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Defender
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/1484-1-0x0000000000670000-0x000000000099C000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023c98-8.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
5004	AutoWizard.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir\AutoWizard.exe	AutoWizard.exe
File opened for modification	C:\Windows\system32\SubDir	AutoWizard.exe
File created	C:\Windows\system32\SubDir\AutoWizard.exe	AutoWizard.exe
File opened for modification	C:\Windows\system32\SubDir\AutoWizard.exe	AutoWizard.exe
File opened for modification	C:\Windows\system32\SubDir	AutoWizard.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3120	schtasks.exe
3008	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1484	AutoWizard.exe
Token: SeDebugPrivilege	5004	AutoWizard.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 3008	1484	AutoWizard.exe	87
PID 1484 wrote to memory of 3008	1484	AutoWizard.exe	87
PID 1484 wrote to memory of 5004	1484	AutoWizard.exe	89
PID 1484 wrote to memory of 5004	1484	AutoWizard.exe	89
PID 5004 wrote to memory of 3120	5004	AutoWizard.exe	90
PID 5004 wrote to memory of 3120	5004	AutoWizard.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AutoWizard.exe
"C:\Users\Admin\AppData\Local\Temp\AutoWizard.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Windows\system32\SubDir\AutoWizard.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3008
- C:\Windows\system32\SubDir\AutoWizard.exe
  "C:\Windows\system32\SubDir\AutoWizard.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Windows\system32\SubDir\AutoWizard.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoWizard.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AutoWizard.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

AutoWizard.exe

Path C:\Windows\system32\SubDir\AutoWizard.exe
Size 3.1MB
SHA256 b7521fbbcc6a7324f8c8849b5e16dfc2a00d1b648e70b47a93a2b97ac4df3738
MD5 10940d658a4c54da91d0c0724d47644e
SHA1 da3d9e51ccc7432746d066337fb459bbf624c92a
SHA512 a1ff398937f75c51dd199553cd41889cbf7c0e9b498f1fc6f26ad9ffc13778a189b74c5c7f577a85778215cfa89e85467046e1054b8684aeb9ff58383afdb15c
SSDEEP 49152:OvblL26AaNeWgPhlmVqvMQ7XSKfX8FEFUhk/bBLoGdZpTHHB72eh2NT:OvBL26AaNeWgPhlmVqkQ7XSKP8sRp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1484-0-0x00007FF819F83000-0x00007FF819F85000-memory.dmp

Download

memory/1484-1-0x0000000000670000-0x000000000099C000-memory.dmp

Download

memory/1484-2-0x00007FF819F80000-0x00007FF81AA41000-memory.dmp

Download

memory/1484-11-0x00007FF819F80000-0x00007FF81AA41000-memory.dmp

Download

memory/5004-10-0x00007FF819F80000-0x00007FF81AA41000-memory.dmp

Download

memory/5004-12-0x00007FF819F80000-0x00007FF81AA41000-memory.dmp

Download

memory/5004-13-0x000000001B7C0000-0x000000001B810000-memory.dmp

Download

memory/5004-14-0x000000001C020000-0x000000001C0D2000-memory.dmp

Download

memory/5004-15-0x00007FF819F80000-0x00007FF81AA41000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads