Overview

overview

10

Static

static

10

Quasar v1....ar.exe

windows7-x64

10

Quasar v1....ar.exe

windows10-2004-x64

10

Quasar v1....nt.exe

windows7-x64

10

Quasar v1....nt.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    210s
  • max time network
    160s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08-12-2024 13:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Quasar v1.4.1/Quasar.exe

  • Size

    1.2MB

  • MD5

    12ebf922aa80d13f8887e4c8c5e7be83

  • SHA1

    7f87a80513e13efd45175e8f2511c2cd17ff51e8

  • SHA256

    43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e

  • SHA512

    fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275

  • SSDEEP

    12288:IwPs012cBBBYiL9l/bFfpBBBBBBBBBBBBcA:jBBBYiLvzFfpBBBBBBBBBBBBcA

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

10.127.0.174:4782

Mutex

6b3e3e81-b8df-452c-aaca-389f08ef032c

Attributes
  • encryption_key

    EA12945330DD5176251D629AC033CFF37AB2A0BA

  • install_name

    nigger.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\Quasar.exe
    "C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\Quasar.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" /select, "C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\quasar.p12"
      2⤵
        PID:1376
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:572
      • C:\Users\Admin\Documents\Client-built.exe
        "C:\Users\Admin\Documents\Client-built.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:340
        • C:\Windows\system32\schtasks.exe
          "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\nigger.exe" /rl HIGHEST /f
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:832
        • C:\Users\Admin\AppData\Roaming\SubDir\nigger.exe
          "C:\Users\Admin\AppData\Roaming\SubDir\nigger.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1200
          • C:\Windows\system32\schtasks.exe
            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\nigger.exe" /rl HIGHEST /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1208
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2012
      • C:\Windows\system32\ipconfig.exe
        ipconfig
        2⤵
        • Gathers network information
        PID:840
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x258
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2912

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\Profiles\Default.xml
      Filesize

      454B

      MD5

      351bc154a7a109729c97c5f01681ff06

      SHA1

      144612d62e3866cbad2b9435075d2d28c851e590

      SHA256

      26f40679222752f3757c039709575f14425e54744475d68802ace3f5ba5e02fb

      SHA512

      e3c3936efb56f6c30606df64f6a8b2f125e6b44e2639e09435a663de9c254f80573aac036e54c96f506f081113d854a2a73bec47ad079cdb48fd7bbe06d2deaa

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\quasar.p12
      Filesize

      4KB

      MD5

      cb5a044a7c9e6623033396eb2c0ff697

      SHA1

      e7861f75333c4d5b73a96823b62379da896c448c

      SHA256

      b4593604aac9d606233d040e8e265ec328382aa4e4a786c426f89ac0f7f8f36b

      SHA512

      e875f85faa38fafdab72310507c737a2625b29d9a7706036d6aac8d7d01c9bbbad298d7d14408c21ed3161fb3760c10147ba8180c2c5825a7358b1e442cc00c5

      Download Submit

    • C:\Users\Admin\Documents\Client-built.exe
      Filesize

      3.1MB

      MD5

      51850afd3f3bcf86e49c82373426d044

      SHA1

      482f2b99ff22597ff5daed837da683e8df6e2148

      SHA256

      d5da2bb9f7749383c3dfa772edbd42ce66f781154275e404a2a1b5fb0f018eda

      SHA512

      1402935c2fbee9b8df515ba61259ab948b74483c9785d09c2993cb4107b53dd0dda9d9a82ba1444cdbfc76e465b94c46d297c2674d30b77ee221100a32664966

      Download Submit

    • memory/340-117-0x0000000001040000-0x0000000001364000-memory.dmp

      Filesize

      3.1MB

      Download

    • memory/572-48-0x00000000039A0000-0x00000000039B0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1200-122-0x0000000000CF0000-0x0000000001014000-memory.dmp

      Filesize

      3.1MB

      Download

    • memory/2960-13-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2960-47-0x000000001EB10000-0x000000001EB5C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/2960-8-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2960-9-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2960-0-0x000007FEF5693000-0x000007FEF5694000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2960-6-0x000000001F1F0000-0x000000001F51E000-memory.dmp

      Filesize

      3.2MB

      Download

    • memory/2960-46-0x000000001B780000-0x000000001B798000-memory.dmp

      Filesize

      96KB

      Download

    • memory/2960-7-0x000007FEF5693000-0x000007FEF5694000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2960-5-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2960-54-0x000000001B640000-0x000000001B65A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/2960-53-0x0000000021ED0000-0x0000000021F2E000-memory.dmp

      Filesize

      376KB

      Download

    • memory/2960-4-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2960-3-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2960-2-0x00000000003E0000-0x00000000003F6000-memory.dmp

      Filesize

      88KB

      Download

    • memory/2960-1-0x00000000010E0000-0x0000000001218000-memory.dmp

      Filesize

      1.2MB

      Download