quasar | e190f4cc54506973f7c38fa2cf39148e7bf38887467694d57ae10fc356cd863b

Analysis

max time kernel
87s
max time network
89s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
11-12-2024 04:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

30fe4e7e33259e52666ca6cd6eb12ee3
SHA1

c5c8506ba00e9416197d39149394fceacf3551ac
SHA256

e190f4cc54506973f7c38fa2cf39148e7bf38887467694d57ae10fc356cd863b
SHA512

67647d16e50623fc2019a0c88295c7d1dfe715b00cce6d3e15098f2b668e55dfc3e62a1d27cdf8f68f2c2a770b1f83c8d7ec28c03fa627f03e9984f62ef46bd8
SSDEEP

49152:rvbI22SsaNYfdPBldt698dBcjHidimwmzstoGdaTHHB72eh2NT:rvk22SsaNYfdPBldt6+dBcjHWim+

Score

10^/10

quasar office04 discovery spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

184.98.230.97:4545

Mutex

381fb32a-fd3f-4701-8fca-4b51cb0abac7

Attributes

encryption_key
9D21D822B3655AB7418E123B9807F485C0122440
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Antivirus
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/1900-1-0x0000000000660000-0x0000000000984000-memory.dmp	family_quasar
behavioral1/files/0x001d00000002aae7-5.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
3640	Client.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\SubDir\Client.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client-built.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4596	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4596	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3744	schtasks.exe
336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	Client-built.exe
Token: SeDebugPrivilege	3640	Client.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3640	Client.exe
3640	Client.exe
3640	Client.exe
3640	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3640	Client.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 3744	1900	Client-built.exe	77
PID 1900 wrote to memory of 3744	1900	Client-built.exe	77
PID 1900 wrote to memory of 3640	1900	Client-built.exe	79
PID 1900 wrote to memory of 3640	1900	Client-built.exe	79
PID 3640 wrote to memory of 336	3640	Client.exe	80
PID 3640 wrote to memory of 336	3640	Client.exe	80
PID 3640 wrote to memory of 3720	3640	Client.exe	83
PID 3640 wrote to memory of 3720	3640	Client.exe	83
PID 3640 wrote to memory of 1436	3640	Client.exe	85
PID 3640 wrote to memory of 1436	3640	Client.exe	85
PID 1436 wrote to memory of 2376	1436	cmd.exe	87
PID 1436 wrote to memory of 2376	1436	cmd.exe	87
PID 1436 wrote to memory of 4596	1436	cmd.exe	88
PID 1436 wrote to memory of 4596	1436	cmd.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Antivirus " /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3744
- C:\Windows\system32\SubDir\Client.exe
  "C:\Windows\system32\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Antivirus " /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:336
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /delete /tn "Windows Antivirus " /f
    3⤵
    PID:3720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3yBtgSowhsIp.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2376
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3yBtgSowhsIp.bat

Filesize
200B

MD5
b8e21fe1eeda7d35791b0e614e65d5b6

SHA1
c3275d1ed7f869adad59dae585e52425c41f3847

SHA256
32c759d499411dd43472482678d52041c6e887bf7b43cb3b346c272b5dac261e

SHA512
ec86166c1368f871cf8e9e186adb83929ccc2156c36b26cff9f158c84eb22ffe4b5e803ab95caf25df6e6ccfd78534a79685985410fd58b6d33dc2783beab5c2

Download Submit
C:\Windows\System32\SubDir\Client.exe

Filesize
3.1MB

MD5
30fe4e7e33259e52666ca6cd6eb12ee3

SHA1
c5c8506ba00e9416197d39149394fceacf3551ac

SHA256
e190f4cc54506973f7c38fa2cf39148e7bf38887467694d57ae10fc356cd863b

SHA512
67647d16e50623fc2019a0c88295c7d1dfe715b00cce6d3e15098f2b668e55dfc3e62a1d27cdf8f68f2c2a770b1f83c8d7ec28c03fa627f03e9984f62ef46bd8

Download Submit
memory/1900-0-0x00007FFF1FA13000-0x00007FFF1FA15000-memory.dmp

Filesize
8KB

Download
memory/1900-1-0x0000000000660000-0x0000000000984000-memory.dmp

Filesize
3.1MB

Download
memory/1900-2-0x00007FFF1FA10000-0x00007FFF204D2000-memory.dmp

Filesize
10.8MB

Download
memory/1900-8-0x00007FFF1FA10000-0x00007FFF204D2000-memory.dmp

Filesize
10.8MB

Download
memory/3640-10-0x00007FFF1FA10000-0x00007FFF204D2000-memory.dmp

Filesize
10.8MB

Download
memory/3640-11-0x000000001BF50000-0x000000001BFA0000-memory.dmp

Filesize
320KB

Download
memory/3640-12-0x000000001C060000-0x000000001C112000-memory.dmp

Filesize
712KB

Download
memory/3640-15-0x000000001BFF0000-0x000000001C002000-memory.dmp

Filesize
72KB

Download
memory/3640-16-0x000000001CC70000-0x000000001CCAC000-memory.dmp

Filesize
240KB

Download
memory/3640-17-0x00007FFF1FA10000-0x00007FFF204D2000-memory.dmp

Filesize
10.8MB

Download
memory/3640-22-0x00007FFF1FA10000-0x00007FFF204D2000-memory.dmp

Filesize
10.8MB

Download
memory/3640-9-0x00007FFF1FA10000-0x00007FFF204D2000-memory.dmp

Filesize
10.8MB

Download