quasar | 95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

System.exe
Size

3.1MB
MD5

e80f9a2d968a10ce2bbd655666befe8c
SHA1

d56125da872bda98b592df56baf7fbfdeff94b6d
SHA256

95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667
SHA512

9bd6e745142143509f64c0239c9e535985c53d5e28ce4fb328f1e4b354c52f081c0545fe80549754a54857338e9b32ac2dfcab5379bca70f05907a55ae10d04c
SSDEEP

49152:Bvuuf2NUaNmwzPWlvdaKM7ZxTwKKoZ2jmZv9oGuDFTHHB72eh2NT:BvJf2NUaNmwzPWlvdaB7ZxTwJoZ2I

Score

10^/10

quasar botnet spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

botnet

165.227.31.192:22069

193.161.193.99:64425

193.161.193.99:60470

Mutex

713051d4-4ad4-4ad0-b2ed-4ddd8fe2349d

Attributes

encryption_key
684009117DF150EF232A2EE8AE172085964C1CF0
install_name
System.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Office
subdirectory
Winrar

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4648-1-0x0000000000CE0000-0x0000000001004000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023c8f-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
992	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	System.exe
Token: SeDebugPrivilege	992	System.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
992	System.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 992	4648	System.exe	82
PID 4648 wrote to memory of 992	4648	System.exe	82

C:\Users\Admin\AppData\Local\Temp\System.exe
"C:\Users\Admin\AppData\Local\Temp\System.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Roaming\Winrar\System.exe
  "C:\Users\Admin\AppData\Roaming\Winrar\System.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Roaming\Winrar\System.exe

Filesize
3.1MB

MD5
e80f9a2d968a10ce2bbd655666befe8c

SHA1
d56125da872bda98b592df56baf7fbfdeff94b6d

SHA256
95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667

SHA512
9bd6e745142143509f64c0239c9e535985c53d5e28ce4fb328f1e4b354c52f081c0545fe80549754a54857338e9b32ac2dfcab5379bca70f05907a55ae10d04c

Download Submit
memory/992-10-0x00007FFDDEDD0000-0x00007FFDDF891000-memory.dmp

Filesize
10.8MB

Download
memory/992-12-0x00007FFDDEDD0000-0x00007FFDDF891000-memory.dmp

Filesize
10.8MB

Download
memory/992-13-0x000000001BE20000-0x000000001BE70000-memory.dmp

Filesize
320KB

Download
memory/992-14-0x000000001DBC0000-0x000000001DC72000-memory.dmp

Filesize
712KB

Download
memory/992-15-0x00007FFDDEDD0000-0x00007FFDDF891000-memory.dmp

Filesize
10.8MB

Download
memory/4648-0-0x00007FFDDEDD3000-0x00007FFDDEDD5000-memory.dmp

Filesize
8KB

Download
memory/4648-1-0x0000000000CE0000-0x0000000001004000-memory.dmp

Filesize
3.1MB

Download
memory/4648-2-0x00007FFDDEDD0000-0x00007FFDDF891000-memory.dmp

Filesize
10.8MB

Download
memory/4648-11-0x00007FFDDEDD0000-0x00007FFDDF891000-memory.dmp

Filesize
10.8MB

Download