quasar | 425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04-11-2024 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe
Size

3.2MB
MD5

58abd80cc431895f2c2126f714ca3c8c
SHA1

9338c3bbe9e6dd3658848c03a5d3bcf02dfbe965
SHA256

425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff
SHA512

fcd8197173da2c475451f500cbea32b446d872a8553ebd76dae4ac3873ed8da149e8036cad65968f10d6719992e442e0ddfb458ce250c41521668d5117a14ec4
SSDEEP

49152:S9GUKQbhUbLP/WdzmmVoNyQNKXVTHUt0ONKgDGsbolFjeTXbjuOvtXcUwowyr4T5:yUbLPudCfUj0t0ON/GUW6lJ3HdjX0

Score

10^/10

quasar office04 discovery execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

y20.ddns.net:5552

Mutex

081f9344-bbf0-4c0d-832c-1597fc2c5291

Attributes

encryption_key
51E85A39CEAF3ACB23D073483E360B1A632697B4
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2884-16-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/2884-20-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/2884-18-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/2884-13-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/2884-12-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
2700	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe

description	pid	Process	procid_target
PID 2944 set thread context of 2884	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

chcp.comPING.EXERegAsm.exe425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exepowershell.exeRegAsm.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

PING.EXE

pid	Process
3028	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
3028	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid	Process
2700	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeRegAsm.exe

description	pid	Process
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	2884	RegAsm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

RegAsm.exe

pid	Process
2884	RegAsm.exe

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

RegAsm.exe

pid	Process
2884	RegAsm.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exeRegAsm.execmd.exe

description	pid	Process	procid_target
PID 2944 wrote to memory of 2700	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	30
PID 2944 wrote to memory of 2700	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	30
PID 2944 wrote to memory of 2700	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	30
PID 2944 wrote to memory of 2700	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	30
PID 2944 wrote to memory of 2884	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	32
PID 2944 wrote to memory of 2884	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	32
PID 2944 wrote to memory of 2884	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	32
PID 2944 wrote to memory of 2884	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	32
PID 2944 wrote to memory of 2884	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	32
PID 2944 wrote to memory of 2884	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	32
PID 2944 wrote to memory of 2884	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	32
PID 2944 wrote to memory of 2884	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	32
PID 2944 wrote to memory of 2884	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	32
PID 2944 wrote to memory of 2884	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	32
PID 2944 wrote to memory of 2884	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	32
PID 2944 wrote to memory of 2884	2944	425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe	32
PID 2884 wrote to memory of 592	2884	RegAsm.exe	33
PID 2884 wrote to memory of 592	2884	RegAsm.exe	33
PID 2884 wrote to memory of 592	2884	RegAsm.exe	33
PID 2884 wrote to memory of 592	2884	RegAsm.exe	33
PID 592 wrote to memory of 1476	592	cmd.exe	35
PID 592 wrote to memory of 1476	592	cmd.exe	35
PID 592 wrote to memory of 1476	592	cmd.exe	35
PID 592 wrote to memory of 1476	592	cmd.exe	35
PID 592 wrote to memory of 3028	592	cmd.exe	36
PID 592 wrote to memory of 3028	592	cmd.exe	36
PID 592 wrote to memory of 3028	592	cmd.exe	36
PID 592 wrote to memory of 3028	592	cmd.exe	36
PID 592 wrote to memory of 2400	592	cmd.exe	37
PID 592 wrote to memory of 2400	592	cmd.exe	37
PID 592 wrote to memory of 2400	592	cmd.exe	37
PID 592 wrote to memory of 2400	592	cmd.exe	37
PID 592 wrote to memory of 2400	592	cmd.exe	37
PID 592 wrote to memory of 2400	592	cmd.exe	37
PID 592 wrote to memory of 2400	592	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe
"C:\Users\Admin\AppData\Local\Temp\425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '' -Value '"C:\Users\Admin\AppData\Roaming\.exe"' -PropertyType 'String'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #cmd
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\90I1Em3jD7Tk.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:592
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:1476
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3028
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\90I1Em3jD7Tk.bat

Filesize
215B

MD5
4eaf173cfe8df343383d613b61092f3c

SHA1
e39acfcb4b3fca72f3e85917b672ef7610671881

SHA256
2279a5ac5c755b9d88f64be8d8664968435e22c6998e38dcf84af2174810411d

SHA512
849a6e4fe05a964c43b4d627f4f63d75ddd91c52f71e841a4419de83237292a9fb5aae33a7ab2b0ef1daaac6dde80242b6fab5d70b9478c0d6788a050ddc1be7

Download Submit
memory/2400-35-0x0000000001320000-0x0000000001332000-memory.dmp

Filesize
72KB

Download
memory/2700-23-0x000000006FFB0000-0x000000007055B000-memory.dmp

Filesize
5.7MB

Download
memory/2700-7-0x000000006FFB2000-0x000000006FFB4000-memory.dmp

Filesize
8KB

Download
memory/2700-6-0x0000000001CB0000-0x0000000001CF0000-memory.dmp

Filesize
256KB

Download
memory/2700-25-0x000000006FFB0000-0x000000007055B000-memory.dmp

Filesize
5.7MB

Download
memory/2700-21-0x000000006FFB0000-0x000000007055B000-memory.dmp

Filesize
5.7MB

Download
memory/2700-24-0x000000006FFB0000-0x000000007055B000-memory.dmp

Filesize
5.7MB

Download
memory/2884-10-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2884-16-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2884-20-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2884-18-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2884-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2884-13-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2884-12-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2884-8-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2944-22-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/2944-0-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

Filesize
4KB

Download
memory/2944-5-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/2944-1-0x0000000000020000-0x000000000034E000-memory.dmp

Filesize
3.2MB

Download