Analysis
-
max time kernel
190s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-12-2024 18:12
General
-
Target
Quasar.v1.4.1.zip
-
Size
3.3MB
-
MD5
13aa4bf4f5ed1ac503c69470b1ede5c1
-
SHA1
c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00
-
SHA256
4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62
-
SHA512
767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d
-
SSDEEP
49152:lYLmNgMh/9yUsRFeWMyYISDSwtfxZQNemi57PdHmeFINp/lFnsDbNFNepL6DJo+J:mL9U1yUUQykOQ91XFYBlR8P9d5uNJo9
Malware Config
Extracted
quasar
-
reconnect_delay
5000
Extracted
quasar
1.4.1
test
10.127.0.107:4782
2dcb6fc0-8185-4f23-976e-7aef72c5eac8
-
encryption_key
C8FE3F0F96017E1192DE042ED6018751E0CEE9AC
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 7 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Drops file in System32 directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 64 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Quasar.v1.4.1.zip"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" /select, "C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12"2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exeipconfig2⤵
- Gathers network information
-
-
C:\Users\Admin\Desktop\Client-built.exe"C:\Users\Admin\Desktop\Client-built.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ecbb556c0f21388f3c8f6cdb8850da85
SHA105f70be8b4f9f9b1df94a4f4d454617c274b41a2
SHA2560637e45879f23ecd32fb79808ea221d22cc73a899b42a70de5c95320abd5d729
SHA5125cc14cfec6a3da40fe37e09ba2df6b8ffa91c992e0f7d996c8d3f4ded21cae24b7f63be34e199a34fe8449f982147d192282a5f1e52f4563312296624af204be
-
Filesize
3.1MB
MD58392e1d9fc0aaae924dc5a5734066ca4
SHA1909a01c97d3206097635667327522fecd117d425
SHA256d2da2ff809ae5f340eee8cd9c42027c2b7c95067c5b0556b986ea8e29363213a
SHA512e462b0d0599b68c5b1f54cc8c8fc16aaf7dd12cd22af4cca10454d9d3efaa48c828703931613419acbbaf42e9f66c2a5ffb8ae1976ce6ce5fb52d81d7b78398d
-
Filesize
3.2MB
MD50cf454b6ed4d9e46bc40306421e4b800
SHA19611aa929d35cbd86b87e40b628f60d5177d2411
SHA256e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42
SHA51285262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048
-
Filesize
56KB
MD5bfb3bd1cb571360435100bfa6ed2b997
SHA11325e8dd76180a165117e04da4ee4a020e996880
SHA256a67a424013544c8270c12633e2e1e287cd5cf0b3f2e81e8d8204b37a03da59ef
SHA512ae5a88a9e86b9e64b8c289213f814586dfa5fe5e0cc21bdbc3e48c36d81fa9e763c6e78f24e40df07696228270ad72f408846125e61e33cae867ef8ff88a3c15
-
Filesize
350KB
MD5de69bb29d6a9dfb615a90df3580d63b1
SHA174446b4dcc146ce61e5216bf7efac186adf7849b
SHA256f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc
SHA5126e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015
-
Filesize
68KB
MD5cc6f6503d29a99f37b73bfd881de8ae0
SHA192d3334898dbb718408f1f134fe2914ef666ce46
SHA2560b1e0d8f87f557b52315d98c1f4727e539f5120d20b4ca9edba548983213fbb5
SHA5127f4c0a35b612b864ad9bc6a46370801ed7433424791622bf77bf47d6a776cb6a49e4977b34725ead5d0feaa1c9516db2ca75cb8872c77a8f2fab6c37740b681f
-
Filesize
238B
MD5308b89cd90bf4c581ece867ffd2f42b4
SHA1284949496518808e73a37e2e53d39d6770b41e9e
SHA2566d804b565a56dc9da14494a1a831ff3c136598b4dbf8b5f16b9fd16b71656a6d
SHA5123cd20f76463b24e77a50d7c71287f9bfb2aae56df8a3eb3e58e3e694504b3fab0b4323c60bcbfbf038c3f34ed967a7deeee2069ff3344b41db39445a16ba8727
-
Filesize
1017B
MD5aa8158bca01a2e115c124c6443b06cd6
SHA19aa71dcc1d7f5c2fe6757989791d04dee0b36d6b
SHA25655bdc17b2788a1aef38268e8d1bd92048ad89278b9793f13e11cb7b7133fd804
SHA5128bc56b379daf7446f3d0c44617985f1317c6ce5899b80982854f2c743e7d0cc5c6813271dad1cf3fcbaa6d996e70d2b1953f5d331be6f933112986bdffe8e046
-
Filesize
62KB
MD52185564051ea2e046d9f711ed3cd93ff
SHA12f2d7fd470da6d126582ad80df2802aabd6c9cea
SHA256de930a748e4dc08c851ba0a22afce8dcfd0f15f23b291f9306c8ef6ccd7460a2
SHA51200af241c1f89b478e66d758db26ed0a413b690d695abf91211b5cbc3985133632327ea0fc41140bd61d02271b6aa278a8e8f539d8ca6ce94972aef50c1a9c868
-
Filesize
1.2MB
MD512ebf922aa80d13f8887e4c8c5e7be83
SHA17f87a80513e13efd45175e8f2511c2cd17ff51e8
SHA25643315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e
SHA512fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275
-
Filesize
176B
MD5c8cd50e8472b71736e6543f5176a0c12
SHA10bd6549820de5a07ac034777b3de60021121405e
SHA256b44739eeff82db2b575a45b668893e2fe8fdd24a709cbf0554732fd3520b2190
SHA5126e8f77fcca5968788cc9f73c9543ce9ab7b416372bc681093aa8a3aad43af1f06c56fcbc296c7897a3654b86a6f9d0e8b0fe036677cf290957924377bc177d9f
-
Filesize
76KB
MD5944ce5123c94c66a50376e7b37e3a6a6
SHA1a1936ac79c987a5ba47ca3d023f740401f73529b
SHA2567da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
SHA5124c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
-
Filesize
3.1MB
MD5f4d16cfe4cad388255e43f258329f805
SHA1fe7cc6c9eb76b5ad97867b46d053fae601fd4a2d
SHA2568fb6ae3496d4ac025eab443d3e322b0faa3461d25b54093c9205d35746e3250e
SHA512867045eac0f7765e6bea51e62bc4ed68b1e81ce6c2843d2e08714eb391a8ac94c2571c09828286252248400ea5c12bffa50a25c8ec5ad9e6d0bb836320ec188f
-
Filesize
282KB
MD5abc82ae4f579a0bbfa2a93db1486eb38
SHA1faa645b92e3de7037c23e99dd2101ef3da5756e5
SHA256ca6608346291ec82ee4acf8017c90e72db2ee7598015f695120c328d25319ec6
SHA512e06ee564fdd3fe2e26b0dec744a969a94e4b63a2e37692a7dcc244cb7949b584d895e9d3766ea52c9fe72b7a31dacf4551f86ea0d7c987b80903ff43be9faed3
-
Filesize
4KB
MD58fea9e12b4a0345cdecf636a5f05da1f
SHA1f54bfe66df6b94976346e42d3027d220ea9423af
SHA256fc7920f38e82f8e3fa07023f5442d1a77fded0c8bb45e2e81b9724827f72494b
SHA51220a21ebf960fab449700d286238f10dfff176eeaef334ed729c49f3dcecfeb15077791a447c4b5f83d9d9c3dcd42bd85bca0e0f0767fadd68aa688c201f303b8
-
Filesize
3.2MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
304KB
-
Filesize
712KB
-
Filesize
104KB
-
Filesize
320KB
-
Filesize
376KB
-
Filesize
96KB
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
1.2MB
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
3.1MB