quasar | 43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e | Triage

Analysis

max time kernel
90s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2024, 22:01

Sharing

Report Analysis Logs

General

Target

Quasar.exe
Size

1.2MB
MD5

12ebf922aa80d13f8887e4c8c5e7be83
SHA1

7f87a80513e13efd45175e8f2511c2cd17ff51e8
SHA256

43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e
SHA512

fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275
SSDEEP

12288:IwPs012cBBBYiL9l/bFfpBBBBBBBBBBBBcA:jBBBYiLvzFfpBBBBBBBBBBBBcA

Score

10^/10

quasar spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/384-1-0x0000028FF3930000-0x0000028FF3A68000-memory.dmp	family_quasar

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	384	Quasar.exe

C:\Users\Admin\AppData\Local\Temp\Quasar.exe
"C:\Users\Admin\AppData\Local\Temp\Quasar.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-0-0x00007FFB476E3000-0x00007FFB476E5000-memory.dmp

Filesize
8KB

Download
memory/384-1-0x0000028FF3930000-0x0000028FF3A68000-memory.dmp

Filesize
1.2MB

Download
memory/384-2-0x00007FFB476E0000-0x00007FFB481A1000-memory.dmp

Filesize
10.8MB

Download
memory/384-3-0x00007FFB476E0000-0x00007FFB481A1000-memory.dmp

Filesize
10.8MB

Download