quasar | ef211cb6f339827eba4ab312b5b4a2b477798a233b975702e8d863e5a5c2f260

General

Target

ef211cb6f339827eba4ab312b5b4a2b477798a233b975702e8d863e5a5c2f260.exe
Size

2.1MB
MD5

087a67ee553b19774b9ce8f45c9532b3
SHA1

5a06e39e4000fb1480753d320e3b252c24b51c82
SHA256

ef211cb6f339827eba4ab312b5b4a2b477798a233b975702e8d863e5a5c2f260
SHA512

fe66c75ca8e55b3d4f34f742852f5821509510ec4dd614d3c7bcd857b3361c47ecb3e7871bf2c2c05362a3e4cfde935fdcf1a61c5995696ab78b30edad8bf274
SSDEEP

49152:3Djlabwz9L7bFVItZNvxxiXIHLyoltZMqzlsHbk:zqwhlVQLvxqIHL5t6qobk

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.0.97:4782

Mutex

ce58d4d7-5ffa-4b20-9aff-e05dd520bef2

Attributes

encryption_key
E7BFEA6A25E205DE16660AD01E8DE9BD5D2907A9
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/files/0x000a000000023b97-6.dat	family_quasar
behavioral2/memory/4824-15-0x0000000000490000-0x00000000007B4000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ef211cb6f339827eba4ab312b5b4a2b477798a233b975702e8d863e5a5c2f260.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	ef211cb6f339827eba4ab312b5b4a2b477798a233b975702e8d863e5a5c2f260.exe

Executes dropped EXE 2 IoCs

Processes:

Client-built.exeClient.exe

pid	Process
4824	Client-built.exe
1732	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exe

pid	Process
3404	schtasks.exe
4496	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Client-built.exeClient.exe

description	pid	Process
Token: SeDebugPrivilege	4824	Client-built.exe
Token: SeDebugPrivilege	1732	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid	Process
1732	Client.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ef211cb6f339827eba4ab312b5b4a2b477798a233b975702e8d863e5a5c2f260.exeClient-built.exeClient.exe

description	pid	Process	procid_target
PID 1540 wrote to memory of 4824	1540	ef211cb6f339827eba4ab312b5b4a2b477798a233b975702e8d863e5a5c2f260.exe	86
PID 1540 wrote to memory of 4824	1540	ef211cb6f339827eba4ab312b5b4a2b477798a233b975702e8d863e5a5c2f260.exe	86
PID 4824 wrote to memory of 3404	4824	Client-built.exe	88
PID 4824 wrote to memory of 3404	4824	Client-built.exe	88
PID 4824 wrote to memory of 1732	4824	Client-built.exe	90
PID 4824 wrote to memory of 1732	4824	Client-built.exe	90
PID 1732 wrote to memory of 4496	1732	Client.exe	91
PID 1732 wrote to memory of 4496	1732	Client.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ef211cb6f339827eba4ab312b5b4a2b477798a233b975702e8d863e5a5c2f260.exe
"C:\Users\Admin\AppData\Local\Temp\ef211cb6f339827eba4ab312b5b4a2b477798a233b975702e8d863e5a5c2f260.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3404
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe

Filesize
3.1MB

MD5
1ce028c7fcd75ceadf48a00e6e8b3414

SHA1
ab34c6edd50267ddba0ad59c6fc4963e79348a4c

SHA256
8290155eb76bfffd148ad64980d9d3bdeb4ea04649ef0b7c89e36fd98e8e0369

SHA512
e16877d56fad7d05f67ca08d5ae39ec4e3ac380fccc99ff67ab66129b0333789bc324b556d4ca04f90e15d95c9beb9560d74488d22765a1ec0893f1bd4c46148

Download Submit
memory/1732-24-0x000000001C450000-0x000000001C4A0000-memory.dmp

Filesize
320KB

Download
memory/1732-25-0x000000001C560000-0x000000001C612000-memory.dmp

Filesize
712KB

Download
memory/4824-14-0x00007FFF14933000-0x00007FFF14935000-memory.dmp

Filesize
8KB

Download
memory/4824-15-0x0000000000490000-0x00000000007B4000-memory.dmp

Filesize
3.1MB

Download
memory/4824-16-0x00007FFF14930000-0x00007FFF153F1000-memory.dmp

Filesize
10.8MB

Download
memory/4824-23-0x00007FFF14930000-0x00007FFF153F1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads