quasar | 95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-12-2024 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667.exe
Size

3.1MB
MD5

e80f9a2d968a10ce2bbd655666befe8c
SHA1

d56125da872bda98b592df56baf7fbfdeff94b6d
SHA256

95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667
SHA512

9bd6e745142143509f64c0239c9e535985c53d5e28ce4fb328f1e4b354c52f081c0545fe80549754a54857338e9b32ac2dfcab5379bca70f05907a55ae10d04c
SSDEEP

49152:Bvuuf2NUaNmwzPWlvdaKM7ZxTwKKoZ2jmZv9oGuDFTHHB72eh2NT:BvJf2NUaNmwzPWlvdaB7ZxTwJoZ2I

Score

10^/10

quasar botnet spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

botnet

165.227.31.192:22069

193.161.193.99:64425

193.161.193.99:60470

Mutex

713051d4-4ad4-4ad0-b2ed-4ddd8fe2349d

Attributes

encryption_key
684009117DF150EF232A2EE8AE172085964C1CF0
install_name
System.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Office
subdirectory
Winrar

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/2488-1-0x0000000000C10000-0x0000000000F34000-memory.dmp	family_quasar
behavioral1/files/0x0008000000016dd0-6.dat	family_quasar
behavioral1/memory/304-10-0x0000000000DC0000-0x00000000010E4000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
304	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667.exe
Token: SeDebugPrivilege	304	System.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
304	System.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 304	2488	95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667.exe	31
PID 2488 wrote to memory of 304	2488	95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667.exe	31
PID 2488 wrote to memory of 304	2488	95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667.exe	31

C:\Users\Admin\AppData\Local\Temp\95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667.exe
"C:\Users\Admin\AppData\Local\Temp\95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Roaming\Winrar\System.exe
  "C:\Users\Admin\AppData\Roaming\Winrar\System.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Winrar\System.exe

Filesize
3.1MB

MD5
e80f9a2d968a10ce2bbd655666befe8c

SHA1
d56125da872bda98b592df56baf7fbfdeff94b6d

SHA256
95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667

SHA512
9bd6e745142143509f64c0239c9e535985c53d5e28ce4fb328f1e4b354c52f081c0545fe80549754a54857338e9b32ac2dfcab5379bca70f05907a55ae10d04c

Download Submit
memory/304-10-0x0000000000DC0000-0x00000000010E4000-memory.dmp

Filesize
3.1MB

Download
memory/304-9-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/304-11-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/304-12-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2488-0-0x000007FEF5873000-0x000007FEF5874000-memory.dmp

Filesize
4KB

Download
memory/2488-1-0x0000000000C10000-0x0000000000F34000-memory.dmp

Filesize
3.1MB

Download
memory/2488-2-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2488-8-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download