quasar | 600920f492a2bed6dd636efa706f7b7fde6043e3189156281ef3a9fbca534180

Analysis

max time kernel
29s
max time network
30s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

System.exe
Size

3.1MB
MD5

e80f9a2d968a10ce2bbd655666befe8c
SHA1

d56125da872bda98b592df56baf7fbfdeff94b6d
SHA256

95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667
SHA512

9bd6e745142143509f64c0239c9e535985c53d5e28ce4fb328f1e4b354c52f081c0545fe80549754a54857338e9b32ac2dfcab5379bca70f05907a55ae10d04c
SSDEEP

49152:Bvuuf2NUaNmwzPWlvdaKM7ZxTwKKoZ2jmZv9oGuDFTHHB72eh2NT:BvJf2NUaNmwzPWlvdaB7ZxTwJoZ2I

Score

10^/10

quasar botnet spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

botnet

165.227.31.192:22069

193.161.193.99:64425

193.161.193.99:60470

Mutex

713051d4-4ad4-4ad0-b2ed-4ddd8fe2349d

Attributes

encryption_key
684009117DF150EF232A2EE8AE172085964C1CF0
install_name
System.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Office
subdirectory
Winrar

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral7/memory/1720-1-0x0000000000B30000-0x0000000000E54000-memory.dmp	family_quasar
behavioral7/files/0x000500000001960b-6.dat	family_quasar
behavioral7/memory/1404-9-0x0000000000DD0000-0x00000000010F4000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
1404	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	System.exe
Token: SeDebugPrivilege	1404	System.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1404	System.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1404	1720	System.exe	30
PID 1720 wrote to memory of 1404	1720	System.exe	30
PID 1720 wrote to memory of 1404	1720	System.exe	30

C:\Users\Admin\AppData\Local\Temp\System.exe
"C:\Users\Admin\AppData\Local\Temp\System.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Roaming\Winrar\System.exe
  "C:\Users\Admin\AppData\Roaming\Winrar\System.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Winrar\System.exe

Filesize
3.1MB

MD5
e80f9a2d968a10ce2bbd655666befe8c

SHA1
d56125da872bda98b592df56baf7fbfdeff94b6d

SHA256
95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667

SHA512
9bd6e745142143509f64c0239c9e535985c53d5e28ce4fb328f1e4b354c52f081c0545fe80549754a54857338e9b32ac2dfcab5379bca70f05907a55ae10d04c

Download Submit
memory/1404-10-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download
memory/1404-11-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download
memory/1404-9-0x0000000000DD0000-0x00000000010F4000-memory.dmp

Filesize
3.1MB

Download
memory/1404-12-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download
memory/1720-0-0x000007FEF5973000-0x000007FEF5974000-memory.dmp

Filesize
4KB

Download
memory/1720-1-0x0000000000B30000-0x0000000000E54000-memory.dmp

Filesize
3.1MB

Download
memory/1720-2-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download
memory/1720-8-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download