quasar | a86c7bf4b03420d6ae80c4ab78f7dd761d53e1b0eabe2a827f295267a03cb32e

Analysis

max time kernel
1797s
max time network
1800s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rat2.0.exe
Size

3.1MB
MD5

0ec9d66f466763887c3d957ef04a601a
SHA1

4f3bd499508c12c1d15142db4ccb3633d4a563f9
SHA256

ca6205581da131085d4fd448d7a6cb47627ebf0eeeb7e42d7c1047d18631c9b0
SHA512

ffcaf78789c63171473cd0d173875bf83860be15505181f431ef8557e6509af78130a1aee8a067e076238028fba229bb442bb738cff9401bdb8d204bc24bd13d
SSDEEP

49152:LvTlL26AaNeWgPhlmVqvMQ7XSKZF/jBxgLoGdFHTHHB72eh2NT:LvJL26AaNeWgPhlmVqkQ7XSKz/u

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.56.1:4782

192.168.42.36:4782

Mutex

a2375055-d323-4f14-953b-13f74ff9f85a

Attributes

encryption_key
36B9F39EDDE38B2DC6E38AA9208FBAD7687FDB50
install_name
Pygame.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3400-1-0x0000000000390000-0x00000000006B4000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023c9c-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2856	Pygame.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\SubDir\Pygame.exe	rat2.0.exe
File opened for modification	C:\Program Files\SubDir\Pygame.exe	rat2.0.exe
File opened for modification	C:\Program Files\SubDir\Pygame.exe	Pygame.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3400	rat2.0.exe
Token: SeDebugPrivilege	2856	Pygame.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2856	Pygame.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 2856	3400	rat2.0.exe	83
PID 3400 wrote to memory of 2856	3400	rat2.0.exe	83

C:\Users\Admin\AppData\Local\Temp\rat2.0.exe
"C:\Users\Admin\AppData\Local\Temp\rat2.0.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Program Files\SubDir\Pygame.exe
  "C:\Program Files\SubDir\Pygame.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\SubDir\Pygame.exe

Filesize
3.1MB

MD5
0ec9d66f466763887c3d957ef04a601a

SHA1
4f3bd499508c12c1d15142db4ccb3633d4a563f9

SHA256
ca6205581da131085d4fd448d7a6cb47627ebf0eeeb7e42d7c1047d18631c9b0

SHA512
ffcaf78789c63171473cd0d173875bf83860be15505181f431ef8557e6509af78130a1aee8a067e076238028fba229bb442bb738cff9401bdb8d204bc24bd13d

Download Submit
memory/2856-9-0x00007FFEF1220000-0x00007FFEF1CE1000-memory.dmp

Filesize
10.8MB

Download
memory/2856-11-0x00007FFEF1220000-0x00007FFEF1CE1000-memory.dmp

Filesize
10.8MB

Download
memory/2856-12-0x000000001C100000-0x000000001C150000-memory.dmp

Filesize
320KB

Download
memory/2856-13-0x000000001C210000-0x000000001C2C2000-memory.dmp

Filesize
712KB

Download
memory/2856-14-0x00007FFEF1220000-0x00007FFEF1CE1000-memory.dmp

Filesize
10.8MB

Download
memory/3400-0-0x00007FFEF1223000-0x00007FFEF1225000-memory.dmp

Filesize
8KB

Download
memory/3400-1-0x0000000000390000-0x00000000006B4000-memory.dmp

Filesize
3.1MB

Download
memory/3400-2-0x00007FFEF1220000-0x00007FFEF1CE1000-memory.dmp

Filesize
10.8MB

Download
memory/3400-10-0x00007FFEF1220000-0x00007FFEF1CE1000-memory.dmp

Filesize
10.8MB

Download