quasar | 8e42aaf1c038c992a57bbeb607e21df8d7d2f40248c5b35cd431cac0a1b5c77f

Analysis

max time kernel
41s
max time network
43s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
13-11-2024 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

autodist_proproctor_M2 (2).zip
Size

34.9MB
MD5

38cbe4bfde65070ccbd42fd6d4fd7517
SHA1

a6c8e7cea56ffe8eae93db6128f440cfdf7078e7
SHA256

8e42aaf1c038c992a57bbeb607e21df8d7d2f40248c5b35cd431cac0a1b5c77f
SHA512

251405e6b4885f2e72be95494609899c7fbd51371e5389c9d3bfdbca7201af24a4ba3724ba409c9837960277194115575c3538c921afde456b96cd763b8d0c15
SSDEEP

786432:qK3WRVP/LiO0hSfYxv73lwlOxWyr4Rp73lwlOxWyr4RMst9:qK67iOwSf+73lxxWyrCp73lxxWyrCMc

Score

10^/10

quasar discovery evasion persistence spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 6 IoCs

resource	yara_rule
behavioral1/files/0x002800000004513e-43.dat	family_quasar
behavioral1/memory/1320-46-0x00000000004A0000-0x00000000010FE000-memory.dmp	family_quasar
behavioral1/files/0x002800000004513c-50.dat	family_quasar
behavioral1/memory/3076-52-0x0000000000D90000-0x00000000019F0000-memory.dmp	family_quasar
behavioral1/files/0x00280000000451b2-62.dat	family_quasar
behavioral1/memory/5100-73-0x00000000006D0000-0x000000000071A000-memory.dmp	family_quasar

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Quasar.vmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Client-built.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Quasar.vmp.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Client-built.exe

Executes dropped EXE 6 IoCs

pid	Process
1552	Quasar.vmp.exe
1320	Client.exe
3076	Client-built.exe
1836	Quasar.vmp.exe
5100	tmp37A5.tmp.exe
4936	WindowsAudioServiceV3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Docker Service = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp37A5.tmp.exe\""	tmp37A5.tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Docker Service = "\"C:\\Program Files (x86)\\DockerWorkshopV3\\WindowsAudioServiceV3.exe\""	WindowsAudioServiceV3.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Quasar.vmp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Client-built.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Client-built.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Quasar.vmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Quasar.vmp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Quasar.vmp.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
50	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1552	Quasar.vmp.exe
1552	Quasar.vmp.exe
1836	Quasar.vmp.exe
1836	Quasar.vmp.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DockerWorkshopV3\WindowsAudioServiceV3.exe	tmp37A5.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client-built.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp37A5.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsAudioServiceV3.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1856	7zFM.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	1856	7zFM.exe
Token: 35	1856	7zFM.exe
Token: SeSecurityPrivilege	1856	7zFM.exe
Token: SeDebugPrivilege	3076	Client-built.exe
Token: SeDebugPrivilege	5100	tmp37A5.tmp.exe
Token: SeDebugPrivilege	4936	WindowsAudioServiceV3.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1856	7zFM.exe
1856	7zFM.exe
1552	Quasar.vmp.exe
1552	Quasar.vmp.exe
1836	Quasar.vmp.exe
1836	Quasar.vmp.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1552	Quasar.vmp.exe
1552	Quasar.vmp.exe
1836	Quasar.vmp.exe
1836	Quasar.vmp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4936	WindowsAudioServiceV3.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 5100	3076	Client-built.exe	99
PID 3076 wrote to memory of 5100	3076	Client-built.exe	99
PID 3076 wrote to memory of 5100	3076	Client-built.exe	99
PID 5100 wrote to memory of 4936	5100	tmp37A5.tmp.exe	100
PID 5100 wrote to memory of 4936	5100	tmp37A5.tmp.exe	100
PID 5100 wrote to memory of 4936	5100	tmp37A5.tmp.exe	100

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Quasar.vmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Client-built.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Quasar.vmp.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\autodist_proproctor_M2 (2).zip"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3472

C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Quasar.vmp.exe
"C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Quasar.vmp.exe"
1⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- System policy modification
PID:1552

C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Client.exe
"C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Client.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1320

C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Client-built.exe
"C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Client-built.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3076
- C:\Users\Admin\AppData\Local\Temp\tmp37A5.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp37A5.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Program Files (x86)\DockerWorkshopV3\WindowsAudioServiceV3.exe
    "C:\Program Files (x86)\DockerWorkshopV3\WindowsAudioServiceV3.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4936

C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Quasar.vmp.exe
"C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Quasar.vmp.exe"
1⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- System policy modification
PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Quasar.vmp.exe.log

Filesize
1KB

MD5
6363a0d30ffd622f135d4a285d9dc8b1

SHA1
9e3787eb6c579664e5a2449e181ae21cdb8ef804

SHA256
8332a10a7b5a66fc716adc1bc759ec401c2cf870ac00cdcbdf7b8e395450cadf

SHA512
ddb8c2a69394391c929b2cf760327f7c53f4d076a9093c23e7d22eeb86050b527dc1a338feed30cc804ed9b7e0a473f1469dbd0a5d59d23fe2fe75243b224fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp37A5.tmp.exe

Filesize
268KB

MD5
0db84d4cebc40434c9d350caed5fc9d9

SHA1
215a64172f15e01a0c227907be8d254877519ca8

SHA256
7f7c521207ede40cca08b0d5132bd20d742db81bb09d5f75ffe6e02fe638fae8

SHA512
25579389947d540948a35d28b77e407784c40f48f8eae97b393d780e95e13093104bc439fc7944fac9837e66aad93fdd3e0891d356f6778aa3fa5c9182325c9b

Download Submit
C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Client-built.exe

Filesize
12.4MB

MD5
f7813477edabc442160c2b4bd5a28efb

SHA1
b544c8c8ad68d5ae8c339a304adff69e4001f617

SHA256
628bd830648e0e4e85fba4aac5b89540a2af7a69933a020aa17b42af2a0cc665

SHA512
6e234439915709786536424e6a0c807c64ae2326188e78eb4b081f48a6471b86683fa125423654fc95e441b1236cbde537ecc2a243131f92ac82000f68190a23

Download Submit
C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Client.exe

Filesize
12.3MB

MD5
49fee9e45690cb2d12f32923ff5c7060

SHA1
eaa52d56f0998b81bd54397d0d0d0c68d47e4838

SHA256
4bcc56b8279bc707e0f6a21a9fddc8c67903383f84ba1bc0477b8327ab370719

SHA512
e08c1fb1b1fb76dd6b6d768b397ca7b20bba1aa54affee551e248830ccf8bbf8957e888eb88be4725c047b52c592d13ebae1218771699739c31bcfb43f9d9390

Download Submit
C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Client.exe.config

Filesize
161B

MD5
c16b0746faa39818049fe38709a82c62

SHA1
3fa322fe6ed724b1bc4fd52795428a36b7b8c131

SHA256
d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad

SHA512
cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c

Download Submit
C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Clients\yamun@YAMUNA_A813E46\onlinetestwks.exe

Filesize
178KB

MD5
0646998ef06d1e8d3471824151d23dfe

SHA1
ff3d549f20df9740847a36b218f3565f8613e0ab

SHA256
6e654a9dbb543d5a68d3d6c68daec7fd983304927b49fdc2d05a6cbc90601618

SHA512
f39a46864389f476c2b850bbe39e40c92706b9ae2f95755dd4a557c5a0bb9a3d58c33b53f6a5627f1715f6c18d1c17b0b9a47762b2584ab6c203c0d7eaada54c

Download Submit
C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Mono.Cecil.dll

Filesize
277KB

MD5
8df4d6b5dc1629fcefcdc20210a88eac

SHA1
16c661757ad90eb84228aa3487db11a2eac6fe64

SHA256
3e4288b32006fe8499b43a7f605bb7337931847a0aa79a33217a1d6d1a6c397e

SHA512
874b4987865588efb806a283b0e785fd24e8b1562026edd43050e150bce6c883134f3c8ad0f8c107b0fb1b26fce6ddcc7e344a5f55c3788dac35035b13d15174

Download Submit
C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Mono.Nat.dll

Filesize
45KB

MD5
e3986207ac534dcc31265bbfbd2ccc79

SHA1
3f1139ed1a4e2332507765a60ed2bf4dc0d6c29e

SHA256
89bf6331396dcf10a4d779059105f61a50b4d2fbbe7bf89cdd5dc3102296415f

SHA512
ede1e4bd5763cbeee3b20b53c8678c2a73cd50ca6963235cfab5a7795fc8cc47b42a4e9e0b16b4b68d0b39590bd61fc0e63a9667ead2414e7d1bb2c5e7d95cbb

Download Submit
C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Quasar.vmp.exe

Filesize
2.1MB

MD5
a0dace1b704c623aba724810af79fb01

SHA1
39ccaaa4ed9840a2f8492f0bda615ae9f8e8b8dd

SHA256
ef857f86022cd05c7916f9422ea9f731277b33a4c21efd2e2a475d95d6739f6d

SHA512
b6ccc516c7b506d4ad8094474c9b558f79a189e0790344aac54f240a9124f13dff7d485fdbcc05d83ea7330ce673f88bd4a51c7c09668cf5a006ca09304054dc

Download Submit
C:\Users\Admin\Desktop\test\autodist_proproctor_M2\Vestris.ResourceLib.dll

Filesize
76KB

MD5
64e9cb25aeefeeba3bb579fb1a5559bc

SHA1
e719f80fcbd952609475f3d4a42aa578b2034624

SHA256
34cab594ce9c9af8e12a6923fc16468f5b87e168777db4be2f04db883c1db993

SHA512
b21cd93f010b345b09b771d24b2e5eeed3b73a82fc16badafea7f0324e39477b0d7033623923313d2de5513cb778428ae10161ae7fc0d6b00e446f8d89cf0f8c

Download Submit
C:\Users\Admin\Desktop\test\autodist_proproctor_M2\settings.xml

Filesize
410B

MD5
12251926fa9dcba8e4804f6a4b916738

SHA1
e05acba7468274ad42d42f3074e26e46e2ae5474

SHA256
4146117a7634ca0298529582217756dd06d19370d6806325ce0ab07878bb0c57

SHA512
d9bb8b63ae15195e652412a5cfa81b863675a5405e8945dee8679b96ed65eac58ffe2af411981058ddc51640d7316a6535ccbaa9591d763df7f43380bc8ad104

Download Submit
memory/1320-46-0x00000000004A0000-0x00000000010FE000-memory.dmp

Filesize
12.4MB

Download
memory/1320-48-0x0000000005B00000-0x0000000005B92000-memory.dmp

Filesize
584KB

Download
memory/1320-47-0x0000000005F90000-0x0000000006536000-memory.dmp

Filesize
5.6MB

Download
memory/1552-41-0x0000015CC8ED0000-0x0000015CC8EE2000-memory.dmp

Filesize
72KB

Download
memory/1552-38-0x0000015CB0490000-0x0000015CB04AA000-memory.dmp

Filesize
104KB

Download
memory/1552-34-0x0000015CC8CF0000-0x0000015CC8D3C000-memory.dmp

Filesize
304KB

Download
memory/1552-36-0x0000015CB0460000-0x0000015CB0472000-memory.dmp

Filesize
72KB

Download
memory/1552-40-0x0000015CC8FF0000-0x0000015CC9014000-memory.dmp

Filesize
144KB

Download
memory/1552-31-0x0000015CAE470000-0x0000015CAE8C4000-memory.dmp

Filesize
4.3MB

Download
memory/1552-32-0x0000015CB0410000-0x0000015CB0411000-memory.dmp

Filesize
4KB

Download
memory/1552-30-0x00007FFCA8FA3000-0x00007FFCA8FA5000-memory.dmp

Filesize
8KB

Download
memory/1836-69-0x00000219001D0000-0x00000219001E2000-memory.dmp

Filesize
72KB

Download
memory/3076-53-0x0000000006510000-0x0000000006576000-memory.dmp

Filesize
408KB

Download
memory/3076-56-0x00000000075F0000-0x0000000007602000-memory.dmp

Filesize
72KB

Download
memory/3076-52-0x0000000000D90000-0x00000000019F0000-memory.dmp

Filesize
12.4MB

Download
memory/3076-74-0x0000000007FF0000-0x0000000007FFA000-memory.dmp

Filesize
40KB

Download
memory/5100-73-0x00000000006D0000-0x000000000071A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads