Malware Analysis Report

2025-05-06 00:48

Sample ID 241109-zbjyjs1ka1
Target celex.exe
SHA256 85af420868f937e1d70898ef30664bb62cf3da9eea467191d407eb1f418a67b7
Tags
skid quasar discovery spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

85af420868f937e1d70898ef30664bb62cf3da9eea467191d407eb1f418a67b7

Threat Level: Known bad

The file celex.exe was found to be: Known bad.

Malicious Activity Summary

skid quasar discovery spyware trojan

Quasar RAT

Quasar payload

Quasar family

Executes dropped EXE

Drops file in Windows directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Uses Task Scheduler COM API

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 20:32

Signatures

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 20:32

Reported

2024-11-09 20:35

Platform

win7-20240729-en

Max time kernel

146s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\celex.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\clnt\clnt.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Office loads VBA resources, possible macro or embedded object present

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\celex.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\clnt\clnt.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\clnt\clnt.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\clnt\clnt.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2500 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\celex.exe C:\Windows\system32\schtasks.exe
PID 2500 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\celex.exe C:\Windows\system32\schtasks.exe
PID 2500 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\celex.exe C:\Windows\system32\schtasks.exe
PID 2500 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\celex.exe C:\Users\Admin\AppData\Roaming\clnt\clnt.exe
PID 2500 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\celex.exe C:\Users\Admin\AppData\Roaming\clnt\clnt.exe
PID 2500 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\celex.exe C:\Users\Admin\AppData\Roaming\clnt\clnt.exe
PID 1932 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Roaming\clnt\clnt.exe C:\Windows\system32\schtasks.exe
PID 1932 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Roaming\clnt\clnt.exe C:\Windows\system32\schtasks.exe
PID 1932 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Roaming\clnt\clnt.exe C:\Windows\system32\schtasks.exe
PID 2396 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2396 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2396 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2396 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\celex.exe

"C:\Users\Admin\AppData\Local\Temp\celex.exe"

C:\Windows\system32\schtasks.exe

"schtasks" /create /tn "clnt" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\clnt\clnt.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\clnt\clnt.exe

"C:\Users\Admin\AppData\Roaming\clnt\clnt.exe"

C:\Windows\system32\schtasks.exe

"schtasks" /create /tn "clnt" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\clnt\clnt.exe" /rl HIGHEST /f

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\UninstallRedo.docx"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

Country Destination Domain Proto
US 8.8.8.8:53 xxvvsn-26169.portmap.host udp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp

Files

memory/2500-0-0x000007FEF5EC3000-0x000007FEF5EC4000-memory.dmp

memory/2500-1-0x0000000000EF0000-0x0000000001214000-memory.dmp

memory/2500-2-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

C:\Users\Admin\AppData\Roaming\clnt\clnt.exe

MD5 e97bf71664c901e2dd3b02c158d14cc7
SHA1 75827ff9fefcd7bab397d6a7af15f3093e38d1c6
SHA256 85af420868f937e1d70898ef30664bb62cf3da9eea467191d407eb1f418a67b7
SHA512 532b0dcb2027cafb2a568c692360589d855b8c36bcd22b7dfb92c7b71b437e03dc26a55da0c3d0163b3286b9b63980e30d5ebb4d7e5fa6dd2ed3f1aba5f09476

memory/1932-8-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

memory/2500-10-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

memory/1932-9-0x0000000000DF0000-0x0000000001114000-memory.dmp

memory/1932-11-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

memory/1932-12-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

memory/2396-13-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 20:32

Reported

2024-11-09 20:35

Platform

win10v2004-20241007-en

Max time kernel

142s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\celex.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\clnt\clnt.exe N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\celex.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\clnt\clnt.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\clnt\clnt.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\celex.exe

"C:\Users\Admin\AppData\Local\Temp\celex.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "clnt" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\clnt\clnt.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\clnt\clnt.exe

"C:\Users\Admin\AppData\Roaming\clnt\clnt.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "clnt" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\clnt\clnt.exe" /rl HIGHEST /f

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SendMeasure.mp3"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 xxvvsn-26169.portmap.host udp
DE 193.161.193.99:26169 xxvvsn-26169.portmap.host tcp
US 8.8.8.8:53 ipwho.is udp
DE 195.201.57.90:443 ipwho.is tcp
US 8.8.8.8:53 99.193.161.193.in-addr.arpa udp
US 8.8.8.8:53 90.57.201.195.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

memory/4812-0-0x00007FFC27113000-0x00007FFC27115000-memory.dmp

memory/4812-1-0x00000000007E0000-0x0000000000B04000-memory.dmp

memory/4812-2-0x00007FFC27110000-0x00007FFC27BD1000-memory.dmp

C:\Users\Admin\AppData\Roaming\clnt\clnt.exe

MD5 e97bf71664c901e2dd3b02c158d14cc7
SHA1 75827ff9fefcd7bab397d6a7af15f3093e38d1c6
SHA256 85af420868f937e1d70898ef30664bb62cf3da9eea467191d407eb1f418a67b7
SHA512 532b0dcb2027cafb2a568c692360589d855b8c36bcd22b7dfb92c7b71b437e03dc26a55da0c3d0163b3286b9b63980e30d5ebb4d7e5fa6dd2ed3f1aba5f09476

memory/4812-10-0x00007FFC27110000-0x00007FFC27BD1000-memory.dmp

memory/3888-9-0x00007FFC27110000-0x00007FFC27BD1000-memory.dmp

memory/3888-11-0x00007FFC27110000-0x00007FFC27BD1000-memory.dmp

memory/3888-12-0x000000001BC80000-0x000000001BCD0000-memory.dmp

memory/3888-13-0x000000001BD90000-0x000000001BE42000-memory.dmp

memory/3888-16-0x000000001BD10000-0x000000001BD22000-memory.dmp

memory/3888-17-0x000000001C490000-0x000000001C4CC000-memory.dmp

memory/3888-18-0x00007FFC27110000-0x00007FFC27BD1000-memory.dmp

memory/3888-19-0x000000001C7D0000-0x000000001C979000-memory.dmp

memory/3888-25-0x000000001C7D0000-0x000000001C979000-memory.dmp

memory/1012-39-0x00007FFC21EA0000-0x00007FFC21ED4000-memory.dmp

memory/1012-38-0x00007FF6D17B0000-0x00007FF6D18A8000-memory.dmp

memory/1012-40-0x00007FFC209F0000-0x00007FFC20CA6000-memory.dmp

memory/1012-41-0x00007FFC19810000-0x00007FFC1A8C0000-memory.dmp

memory/3888-42-0x000000001C7D0000-0x000000001C979000-memory.dmp

memory/3888-43-0x000000001C7D0000-0x000000001C979000-memory.dmp

memory/3888-44-0x000000001C7D0000-0x000000001C979000-memory.dmp

memory/3888-45-0x000000001C7D0000-0x000000001C979000-memory.dmp

memory/3888-46-0x000000001C7D0000-0x000000001C979000-memory.dmp

memory/3888-47-0x000000001C7D0000-0x000000001C979000-memory.dmp

memory/3888-48-0x000000001C7D0000-0x000000001C979000-memory.dmp

memory/3888-49-0x000000001C7D0000-0x000000001C979000-memory.dmp

memory/3888-51-0x000000001C7D0000-0x000000001C979000-memory.dmp

memory/3888-52-0x000000001C7D0000-0x000000001C979000-memory.dmp