quasar | a86c7bf4b03420d6ae80c4ab78f7dd761d53e1b0eabe2a827f295267a03cb32e

Resubmissions

13-12-2024 13:56

241213-q82eeszqgw 10

13-12-2024 13:53

241213-q7e5sszqdt 10

Analysis

max time kernel
468s
max time network
460s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rat2.0.exe
Size

3.1MB
MD5

0ec9d66f466763887c3d957ef04a601a
SHA1

4f3bd499508c12c1d15142db4ccb3633d4a563f9
SHA256

ca6205581da131085d4fd448d7a6cb47627ebf0eeeb7e42d7c1047d18631c9b0
SHA512

ffcaf78789c63171473cd0d173875bf83860be15505181f431ef8557e6509af78130a1aee8a067e076238028fba229bb442bb738cff9401bdb8d204bc24bd13d
SSDEEP

49152:LvTlL26AaNeWgPhlmVqvMQ7XSKZF/jBxgLoGdFHTHHB72eh2NT:LvJL26AaNeWgPhlmVqkQ7XSKz/u

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.56.1:4782

192.168.42.36:4782

Mutex

a2375055-d323-4f14-953b-13f74ff9f85a

Attributes

encryption_key
36B9F39EDDE38B2DC6E38AA9208FBAD7687FDB50
install_name
Pygame.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/1868-1-0x0000000000B90000-0x0000000000EB4000-memory.dmp	family_quasar
behavioral1/files/0x0009000000016d36-6.dat	family_quasar
behavioral1/memory/2236-9-0x0000000001230000-0x0000000001554000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2236	Pygame.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\SubDir\Pygame.exe	rat2.0.exe
File opened for modification	C:\Program Files\SubDir\Pygame.exe	rat2.0.exe
File opened for modification	C:\Program Files\SubDir\Pygame.exe	Pygame.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	rat2.0.exe
Token: SeDebugPrivilege	2236	Pygame.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2236	Pygame.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2236	1868	rat2.0.exe	30
PID 1868 wrote to memory of 2236	1868	rat2.0.exe	30
PID 1868 wrote to memory of 2236	1868	rat2.0.exe	30

C:\Users\Admin\AppData\Local\Temp\rat2.0.exe
"C:\Users\Admin\AppData\Local\Temp\rat2.0.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files\SubDir\Pygame.exe
  "C:\Program Files\SubDir\Pygame.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2236

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\SubDir\Pygame.exe

Filesize
3.1MB

MD5
0ec9d66f466763887c3d957ef04a601a

SHA1
4f3bd499508c12c1d15142db4ccb3633d4a563f9

SHA256
ca6205581da131085d4fd448d7a6cb47627ebf0eeeb7e42d7c1047d18631c9b0

SHA512
ffcaf78789c63171473cd0d173875bf83860be15505181f431ef8557e6509af78130a1aee8a067e076238028fba229bb442bb738cff9401bdb8d204bc24bd13d

Download Submit
memory/1868-0-0x000007FEF53E3000-0x000007FEF53E4000-memory.dmp

Filesize
4KB

Download
memory/1868-1-0x0000000000B90000-0x0000000000EB4000-memory.dmp

Filesize
3.1MB

Download
memory/1868-2-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/1868-8-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2236-10-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2236-9-0x0000000001230000-0x0000000001554000-memory.dmp

Filesize
3.1MB

Download
memory/2236-11-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2236-12-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download