quasar | 95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-12-2024 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667.exe
Size

3.1MB
MD5

e80f9a2d968a10ce2bbd655666befe8c
SHA1

d56125da872bda98b592df56baf7fbfdeff94b6d
SHA256

95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667
SHA512

9bd6e745142143509f64c0239c9e535985c53d5e28ce4fb328f1e4b354c52f081c0545fe80549754a54857338e9b32ac2dfcab5379bca70f05907a55ae10d04c
SSDEEP

49152:Bvuuf2NUaNmwzPWlvdaKM7ZxTwKKoZ2jmZv9oGuDFTHHB72eh2NT:BvJf2NUaNmwzPWlvdaB7ZxTwJoZ2I

Score

10^/10

quasar botnet spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

botnet

165.227.31.192:22069

193.161.193.99:64425

193.161.193.99:60470

Mutex

713051d4-4ad4-4ad0-b2ed-4ddd8fe2349d

Attributes

encryption_key
684009117DF150EF232A2EE8AE172085964C1CF0
install_name
System.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Office
subdirectory
Winrar

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3004-1-0x0000000000F70000-0x0000000001294000-memory.dmp	family_quasar
behavioral2/files/0x0008000000023c7f-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
3972	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667.exe
Token: SeDebugPrivilege	3972	System.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3972	System.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3972	3004	95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667.exe	83
PID 3004 wrote to memory of 3972	3004	95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667.exe	83

C:\Users\Admin\AppData\Local\Temp\95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667.exe
"C:\Users\Admin\AppData\Local\Temp\95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Roaming\Winrar\System.exe
  "C:\Users\Admin\AppData\Roaming\Winrar\System.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Winrar\System.exe

Filesize
3.1MB

MD5
e80f9a2d968a10ce2bbd655666befe8c

SHA1
d56125da872bda98b592df56baf7fbfdeff94b6d

SHA256
95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667

SHA512
9bd6e745142143509f64c0239c9e535985c53d5e28ce4fb328f1e4b354c52f081c0545fe80549754a54857338e9b32ac2dfcab5379bca70f05907a55ae10d04c

Download Submit
memory/3004-0-0x00007FFF45A13000-0x00007FFF45A15000-memory.dmp

Filesize
8KB

Download
memory/3004-1-0x0000000000F70000-0x0000000001294000-memory.dmp

Filesize
3.1MB

Download
memory/3004-2-0x00007FFF45A10000-0x00007FFF464D1000-memory.dmp

Filesize
10.8MB

Download
memory/3004-9-0x00007FFF45A10000-0x00007FFF464D1000-memory.dmp

Filesize
10.8MB

Download
memory/3972-10-0x00007FFF45A10000-0x00007FFF464D1000-memory.dmp

Filesize
10.8MB

Download
memory/3972-11-0x00007FFF45A10000-0x00007FFF464D1000-memory.dmp

Filesize
10.8MB

Download
memory/3972-12-0x000000001B3F0000-0x000000001B440000-memory.dmp

Filesize
320KB

Download
memory/3972-13-0x000000001B500000-0x000000001B5B2000-memory.dmp

Filesize
712KB

Download
memory/3972-14-0x00007FFF45A10000-0x00007FFF464D1000-memory.dmp

Filesize
10.8MB

Download