Overview
overview
10Static
static
10Quasar v1....e.html
windows11-21h2-x64
3Quasar v1....to.dll
windows11-21h2-x64
1Quasar v1....ok.dll
windows11-21h2-x64
1Quasar v1....db.dll
windows11-21h2-x64
1Quasar v1....db.dll
windows11-21h2-x64
1Quasar v1....ks.dll
windows11-21h2-x64
1Quasar v1....il.dll
windows11-21h2-x64
1Quasar v1....at.dll
windows11-21h2-x64
1Quasar v1....on.dll
windows11-21h2-x64
1Quasar v1....ar.exe
windows11-21h2-x64
10Quasar v1....ib.dll
windows11-21h2-x64
1Quasar v1....nt.exe
windows11-21h2-x64
10Quasar v1....et.dll
windows11-21h2-x64
1Analysis
-
max time kernel
481s -
max time network
488s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
28-11-2024 10:48
Behavioral task
behavioral1
Sample
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
Quasar v1.4.1/BouncyCastle.Crypto.dll
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
Quasar v1.4.1/Gma.System.MouseKeyHook.dll
Resource
win11-20241023-en
Behavioral task
behavioral4
Sample
Quasar v1.4.1/Mono.Cecil.Mdb.dll
Resource
win11-20241023-en
Behavioral task
behavioral5
Sample
Quasar v1.4.1/Mono.Cecil.Pdb.dll
Resource
win11-20241023-en
Behavioral task
behavioral6
Sample
Quasar v1.4.1/Mono.Cecil.Rocks.dll
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
Quasar v1.4.1/Mono.Cecil.dll
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
Quasar v1.4.1/Open.Nat.dll
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
Quasar v1.4.1/Quasar.Common.dll
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
Quasar v1.4.1/Quasar.exe
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
Quasar v1.4.1/Vestris.ResourceLib.dll
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
Quasar v1.4.1/client.exe
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
Quasar v1.4.1/protobuf-net.dll
Resource
win11-20241007-en
General
-
Target
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
-
Size
1KB
-
MD5
bf8d5a737e70dd3493a475b8672f14df
-
SHA1
01d35be1b65293f7ca43ee1045424599923ab54a
-
SHA256
6b73c0a42d138d1f05b527c7b936e79af9f44a55d52e35f912da15c0dea43d30
-
SHA512
ecc23ef88b80944ed135233118db167bf5dc161b0392af25ae846010f9993673bbdb62f88bf6de24dc060a48a0cfe96be261d30f5dac2705ed0f01d987fe24b8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 5032 msedge.exe 5032 msedge.exe 4076 msedge.exe 4076 msedge.exe 4240 msedge.exe 4240 msedge.exe 672 identity_helper.exe 672 identity_helper.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4076 wrote to memory of 2668 4076 msedge.exe 78 PID 4076 wrote to memory of 2668 4076 msedge.exe 78 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 2108 4076 msedge.exe 79 PID 4076 wrote to memory of 5032 4076 msedge.exe 80 PID 4076 wrote to memory of 5032 4076 msedge.exe 80 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81 PID 4076 wrote to memory of 2620 4076 msedge.exe 81
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\3rdPartyLicenses\BouncyCastle_license.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9fc763cb8,0x7ff9fc763cc8,0x7ff9fc763cd82⤵PID:2668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,10511794314338102009,17193776370578656893,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:22⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,10511794314338102009,17193776370578656893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,10511794314338102009,17193776370578656893,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:82⤵PID:2620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10511794314338102009,17193776370578656893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:3164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10511794314338102009,17193776370578656893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1836,10511794314338102009,17193776370578656893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,10511794314338102009,17193776370578656893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10511794314338102009,17193776370578656893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10511794314338102009,17193776370578656893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:12⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10511794314338102009,17193776370578656893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:1828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,10511794314338102009,17193776370578656893,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:12⤵PID:3500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,10511794314338102009,17193776370578656893,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5240 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3096
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3360
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54c1a24fa898d2a98b540b20272c8e47b
SHA13218bff9ce95b52842fa1b8bd00be073177141ef
SHA256bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95
SHA512e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e
-
Filesize
152B
MD5f1d2c7fd2ca29bb77a5da2d1847fbb92
SHA1840de2cf36c22ba10ac96f90890b6a12a56526c6
SHA25658d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5
SHA512ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14
-
Filesize
5KB
MD5056725cbc51ba9a72ccd0ea28c24b82a
SHA12161c2b3b94090ff7d36a00d4a4da76668682302
SHA2565f217a7c3c4cedbe8d9f4e623e8b917ec6219b9dbe022e1e68a9ed053ff862ee
SHA512c739a4b5ea2f60caee8feaf218036eae38f8e156c4c2aefeac7721b469e448d102403c92553037cf537cf58dfaa12427cc062e157c3e3b36ef7f65890b6bdebc
-
Filesize
5KB
MD5f29cacd40b7a0ddd8485ea801ab4269c
SHA17c0622b093263c3542f0d795768f3c148c28df40
SHA256d349dfc2791338117da8ae58c5b8101e4e661949836c470f966265fca151abd2
SHA5122e250cedb9e3a6b6030ffbf98c3da8bc27b7faf7c6db2b0ac352995f08389dbdc2807247a10ed3b12ad60c10f5df0a0c83295cfce0752996c5488e96ca0467f3
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5df373058577020ac41bc9d6b9e23015c
SHA13c436f429b09335e1da72e1d04b6168fc890528b
SHA2565d3f398906367df0b702077cfd7b13b49931110900fb14a81b867614d3ce8866
SHA51276b1180d1037e844c9addbfb898d34d6b17cca05a6aad747c7097e4ff985c0b0285786bd5d3a8e2492a281cdacae2c0b4c3de418038d10d5fd8b2b76462d6a7a