quasar | cf1f9aa93af680a196f52f46de82e37adf6bc7be50018d3ca3b38d6ff16df2d4

Resubmissions

14/10/2024, 20:23

241014-y6cbhsydjn 10

14/10/2024, 20:20

241014-y4k6msyclj 10

14/10/2024, 20:16

241014-y184asyarp 10

14/10/2024, 20:08

241014-ywzztsxgpp 10

Analysis

max time kernel
139s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

58b8b37869465016462b7b14b86d2bb8
SHA1

b5d31e9f8691153b7716c8b5e40211556a7c5710
SHA256

cf1f9aa93af680a196f52f46de82e37adf6bc7be50018d3ca3b38d6ff16df2d4
SHA512

9dc86b3c7a924f86108a0e013ce5859cbc9c60fc61e601378d5f4bca8d593919ccabca336b14205fd696e7b7801eff1f330a342684e488fbf43a951f8ee06b56
SSDEEP

49152:AvcI22SsaNYfdPBldt698dBcjHVGR16dbR3toGd3THHB72eh2NT:AvR22SsaNYfdPBldt6+dBcjHVGR16J

Score

10^/10

quasar traige spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Traige

Alessandrolol66-30592.portmap.host:30592

Mutex

45bdc82f-bdfb-446e-af9c-d0a46e53752d

Attributes

encryption_key
B11D992865826F9FDFE1488DBCF3B1031C9ED9CB
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows.Sys
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/2260-1-0x00000000003B0000-0x00000000006D4000-memory.dmp	family_quasar
behavioral2/files/0x000a000000023b80-7.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
1360	Client.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	Client-built.exe
Token: SeDebugPrivilege	1360	Client.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1360	2260	Client-built.exe	87
PID 2260 wrote to memory of 1360	2260	Client-built.exe	87

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.1MB

MD5
58b8b37869465016462b7b14b86d2bb8

SHA1
b5d31e9f8691153b7716c8b5e40211556a7c5710

SHA256
cf1f9aa93af680a196f52f46de82e37adf6bc7be50018d3ca3b38d6ff16df2d4

SHA512
9dc86b3c7a924f86108a0e013ce5859cbc9c60fc61e601378d5f4bca8d593919ccabca336b14205fd696e7b7801eff1f330a342684e488fbf43a951f8ee06b56

Download Submit
memory/1360-8-0x00007FFEFB170000-0x00007FFEFBC31000-memory.dmp

Filesize
10.8MB

Download
memory/1360-10-0x00007FFEFB170000-0x00007FFEFBC31000-memory.dmp

Filesize
10.8MB

Download
memory/1360-11-0x000000001B540000-0x000000001B590000-memory.dmp

Filesize
320KB

Download
memory/1360-12-0x000000001BB10000-0x000000001BBC2000-memory.dmp

Filesize
712KB

Download
memory/1360-15-0x000000001B5F0000-0x000000001B602000-memory.dmp

Filesize
72KB

Download
memory/1360-16-0x000000001BA50000-0x000000001BA8C000-memory.dmp

Filesize
240KB

Download
memory/1360-17-0x00007FFEFB170000-0x00007FFEFBC31000-memory.dmp

Filesize
10.8MB

Download
memory/2260-0-0x00007FFEFB173000-0x00007FFEFB175000-memory.dmp

Filesize
8KB

Download
memory/2260-1-0x00000000003B0000-0x00000000006D4000-memory.dmp

Filesize
3.1MB

Download
memory/2260-2-0x00007FFEFB170000-0x00007FFEFBC31000-memory.dmp

Filesize
10.8MB

Download
memory/2260-9-0x00007FFEFB170000-0x00007FFEFBC31000-memory.dmp

Filesize
10.8MB

Download