quasar | a86c7bf4b03420d6ae80c4ab78f7dd761d53e1b0eabe2a827f295267a03cb32e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rat2.0.exe
Size

3.1MB
MD5

0ec9d66f466763887c3d957ef04a601a
SHA1

4f3bd499508c12c1d15142db4ccb3633d4a563f9
SHA256

ca6205581da131085d4fd448d7a6cb47627ebf0eeeb7e42d7c1047d18631c9b0
SHA512

ffcaf78789c63171473cd0d173875bf83860be15505181f431ef8557e6509af78130a1aee8a067e076238028fba229bb442bb738cff9401bdb8d204bc24bd13d
SSDEEP

49152:LvTlL26AaNeWgPhlmVqvMQ7XSKZF/jBxgLoGdFHTHHB72eh2NT:LvJL26AaNeWgPhlmVqkQ7XSKz/u

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.56.1:4782

192.168.42.36:4782

Mutex

a2375055-d323-4f14-953b-13f74ff9f85a

Attributes

encryption_key
36B9F39EDDE38B2DC6E38AA9208FBAD7687FDB50
install_name
Pygame.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4572-1-0x0000000000C70000-0x0000000000F94000-memory.dmp	family_quasar
behavioral2/files/0x000a000000023b94-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
428	Pygame.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\SubDir\Pygame.exe	rat2.0.exe
File opened for modification	C:\Program Files\SubDir\Pygame.exe	rat2.0.exe
File opened for modification	C:\Program Files\SubDir\Pygame.exe	Pygame.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4572	rat2.0.exe
Token: SeDebugPrivilege	428	Pygame.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
428	Pygame.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 428	4572	rat2.0.exe	85
PID 4572 wrote to memory of 428	4572	rat2.0.exe	85

C:\Users\Admin\AppData\Local\Temp\rat2.0.exe
"C:\Users\Admin\AppData\Local\Temp\rat2.0.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files\SubDir\Pygame.exe
  "C:\Program Files\SubDir\Pygame.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\SubDir\Pygame.exe

Filesize
3.1MB

MD5
0ec9d66f466763887c3d957ef04a601a

SHA1
4f3bd499508c12c1d15142db4ccb3633d4a563f9

SHA256
ca6205581da131085d4fd448d7a6cb47627ebf0eeeb7e42d7c1047d18631c9b0

SHA512
ffcaf78789c63171473cd0d173875bf83860be15505181f431ef8557e6509af78130a1aee8a067e076238028fba229bb442bb738cff9401bdb8d204bc24bd13d

Download Submit
memory/428-9-0x00007FFE174C0000-0x00007FFE17F81000-memory.dmp

Filesize
10.8MB

Download
memory/428-11-0x00007FFE174C0000-0x00007FFE17F81000-memory.dmp

Filesize
10.8MB

Download
memory/428-12-0x000000001BBD0000-0x000000001BC20000-memory.dmp

Filesize
320KB

Download
memory/428-13-0x000000001BCE0000-0x000000001BD92000-memory.dmp

Filesize
712KB

Download
memory/428-14-0x00007FFE174C0000-0x00007FFE17F81000-memory.dmp

Filesize
10.8MB

Download
memory/4572-0-0x00007FFE174C3000-0x00007FFE174C5000-memory.dmp

Filesize
8KB

Download
memory/4572-1-0x0000000000C70000-0x0000000000F94000-memory.dmp

Filesize
3.1MB

Download
memory/4572-2-0x00007FFE174C0000-0x00007FFE17F81000-memory.dmp

Filesize
10.8MB

Download
memory/4572-10-0x00007FFE174C0000-0x00007FFE17F81000-memory.dmp

Filesize
10.8MB

Download