quasar | 4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

Resubmissions

09-11-2024 14:57

241109-sbr6lawgmc 10

09-11-2024 14:55

241109-sasezawhkj 10

Analysis

max time kernel
32s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
09-11-2024 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quasar.v1.4.1.zip
Size

3.3MB
MD5

13aa4bf4f5ed1ac503c69470b1ede5c1
SHA1

c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00
SHA256

4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62
SHA512

767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d
SSDEEP

49152:lYLmNgMh/9yUsRFeWMyYISDSwtfxZQNemi57PdHmeFINp/lFnsDbNFNepL6DJo+J:mL9U1yUUQykOQ91XFYBlR8P9d5uNJo9

Score

10^/10

quasar spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x001e00000002aa82-4.dat	family_quasar
behavioral1/memory/3364-13-0x0000025137F90000-0x00000251380C8000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Quasar.exe

pid	Process
3364	Quasar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7zFM.exe

pid	Process
3548	7zFM.exe
3548	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid	Process
3548	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zFM.exeQuasar.exe

description	pid	Process
Token: SeRestorePrivilege	3548	7zFM.exe
Token: 35	3548	7zFM.exe
Token: SeSecurityPrivilege	3548	7zFM.exe
Token: SeDebugPrivilege	3364	Quasar.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe

pid	Process
3548	7zFM.exe
3548	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

7zFM.exe

description	pid	Process	procid_target
PID 3548 wrote to memory of 3364	3548	7zFM.exe	81
PID 3548 wrote to memory of 3364	3548	7zFM.exe	81

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Quasar.v1.4.1.zip"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Users\Admin\AppData\Local\Temp\7zOCDDDB2A7\Quasar.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCDDDB2A7\Quasar.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3364

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zOCDDDB2A7\Quasar.exe

Filesize
1.2MB

MD5
12ebf922aa80d13f8887e4c8c5e7be83

SHA1
7f87a80513e13efd45175e8f2511c2cd17ff51e8

SHA256
43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e

SHA512
fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275

Download Submit
memory/3364-12-0x00007FF8E1D33000-0x00007FF8E1D35000-memory.dmp

Filesize
8KB

Download
memory/3364-13-0x0000025137F90000-0x00000251380C8000-memory.dmp

Filesize
1.2MB

Download
memory/3364-14-0x00007FF8E1D30000-0x00007FF8E27F2000-memory.dmp

Filesize
10.8MB

Download
memory/3364-15-0x00007FF8E1D30000-0x00007FF8E27F2000-memory.dmp

Filesize
10.8MB

Download