quasar | 88e0b988d824eab43fcc8ef79a0dae23381c1929e02cef3c82c00b3626a5c1d3

Analysis

max time kernel
1796s
max time network
1800s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2024 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chrome.exe
Size

3.1MB
MD5

19fd16e1d1e4025f1dcea5d29f66024f
SHA1

c472e576446a8f803e60f15e7c454f8f18a402f6
SHA256

88e0b988d824eab43fcc8ef79a0dae23381c1929e02cef3c82c00b3626a5c1d3
SHA512

1996bbcd191f714daf4d89ff0a6730c5d407cda4387f6732aaec1aba12b06cc266845a860120ad9ef11063f947b652c37cf61dff12df2f5f076b7bb965cf88bd
SSDEEP

49152:yvyI22SsaNYfdPBldt698dBcjH00+AFmzkjoGdsUTSTHHB72eh2NT:yvf22SsaNYfdPBldt6+dBcjH00+A5cU

Score

10^/10

quasar chrome spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

chrome

192.168.1.58:4782

Mutex

1d5a53de-53d3-4349-abab-ee1b0579f85f

Attributes

encryption_key
56B4C4DAE2FF0461296EBCFD733DDB88E29C8E38
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/3972-1-0x0000000000350000-0x0000000000674000-memory.dmp	family_quasar
behavioral1/files/0x0007000000023c88-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
5096	Client.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2860	schtasks.exe
752	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3972	Chrome.exe
Token: SeDebugPrivilege	5096	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5096	Client.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 2860	3972	Chrome.exe	84
PID 3972 wrote to memory of 2860	3972	Chrome.exe	84
PID 3972 wrote to memory of 5096	3972	Chrome.exe	86
PID 3972 wrote to memory of 5096	3972	Chrome.exe	86
PID 5096 wrote to memory of 752	5096	Client.exe	87
PID 5096 wrote to memory of 752	5096	Client.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2860
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.1MB

MD5
19fd16e1d1e4025f1dcea5d29f66024f

SHA1
c472e576446a8f803e60f15e7c454f8f18a402f6

SHA256
88e0b988d824eab43fcc8ef79a0dae23381c1929e02cef3c82c00b3626a5c1d3

SHA512
1996bbcd191f714daf4d89ff0a6730c5d407cda4387f6732aaec1aba12b06cc266845a860120ad9ef11063f947b652c37cf61dff12df2f5f076b7bb965cf88bd

Download Submit
memory/3972-0-0x00007FF909AE3000-0x00007FF909AE5000-memory.dmp

Filesize
8KB

Download
memory/3972-1-0x0000000000350000-0x0000000000674000-memory.dmp

Filesize
3.1MB

Download
memory/3972-2-0x00007FF909AE0000-0x00007FF90A5A1000-memory.dmp

Filesize
10.8MB

Download
memory/3972-10-0x00007FF909AE0000-0x00007FF90A5A1000-memory.dmp

Filesize
10.8MB

Download
memory/5096-9-0x00007FF909AE0000-0x00007FF90A5A1000-memory.dmp

Filesize
10.8MB

Download
memory/5096-11-0x00007FF909AE0000-0x00007FF90A5A1000-memory.dmp

Filesize
10.8MB

Download
memory/5096-12-0x0000000002E20000-0x0000000002E70000-memory.dmp

Filesize
320KB

Download
memory/5096-13-0x000000001C120000-0x000000001C1D2000-memory.dmp

Filesize
712KB

Download
memory/5096-14-0x00007FF909AE0000-0x00007FF90A5A1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads