quasar | 3f6e781c28be4da83a3278d17f3f1c615953f29a2dd5af8004960a9ee1291f57

Analysis

max time kernel
10s
max time network
20s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
18-12-2024 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMAVIRUS.exe
Size

3.1MB
MD5

9c9646fbf26b1fc0eaee890d08ad0551
SHA1

3924c30dea1f3e2f971c6d130c6faa81e6ff9302
SHA256

3f6e781c28be4da83a3278d17f3f1c615953f29a2dd5af8004960a9ee1291f57
SHA512

d5bec7b66fa53006a3b979530efced8b59b89d0aaadb6ea55f334b28ebea3b7430011ad0897ce91f551b98597f55dbfe5a6445c301c0861d642e01255b954ab6
SSDEEP

49152:rvOI22SsaNYfdPBldt698dBcjHCjRJ6rbR3LoGdxLTHHB72eh2NT:rvj22SsaNYfdPBldt6+dBcjHCjRJ69

Score

10^/10

quasar imarat spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

IMARAT

192.168.3.157:4782

Mutex

d3b8ad08-6b28-4d2c-a53c-95588f033851

Attributes

encryption_key
70BB1936556498784E09A3EE370936577EC65162
install_name
IMAVIRUS.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
IMAVIRUS

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/3476-1-0x0000000000280000-0x00000000005A4000-memory.dmp	family_quasar
behavioral1/files/0x0028000000046184-3.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
4460	IMAVIRUS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3476	IMAVIRUS.exe
Token: SeDebugPrivilege	4460	IMAVIRUS.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4460	IMAVIRUS.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4460	IMAVIRUS.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 4460	3476	IMAVIRUS.exe	83
PID 3476 wrote to memory of 4460	3476	IMAVIRUS.exe	83

C:\Users\Admin\AppData\Local\Temp\IMAVIRUS.exe
"C:\Users\Admin\AppData\Local\Temp\IMAVIRUS.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Users\Admin\AppData\Roaming\IMAVIRUS\IMAVIRUS.exe
  "C:\Users\Admin\AppData\Roaming\IMAVIRUS\IMAVIRUS.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\IMAVIRUS.exe.log

Filesize
1KB

MD5
b08c36ce99a5ed11891ef6fc6d8647e9

SHA1
db95af417857221948eb1882e60f98ab2914bf1d

SHA256
cc9248a177495f45ec70b86c34fc5746c56730af36ace98ac7eb365dbafda674

SHA512
07e62581eace395b0a9699d727761648103180c21155d84ea09140f9e1c9690705c419118545aa67a564334bbde32710225fe3aa92b0b4b4210cb91f0058b1ea

Download Submit
C:\Users\Admin\AppData\Roaming\IMAVIRUS\IMAVIRUS.exe

Filesize
3.1MB

MD5
9c9646fbf26b1fc0eaee890d08ad0551

SHA1
3924c30dea1f3e2f971c6d130c6faa81e6ff9302

SHA256
3f6e781c28be4da83a3278d17f3f1c615953f29a2dd5af8004960a9ee1291f57

SHA512
d5bec7b66fa53006a3b979530efced8b59b89d0aaadb6ea55f334b28ebea3b7430011ad0897ce91f551b98597f55dbfe5a6445c301c0861d642e01255b954ab6

Download Submit
memory/3476-0-0x00007FFC850E3000-0x00007FFC850E5000-memory.dmp

Filesize
8KB

Download
memory/3476-1-0x0000000000280000-0x00000000005A4000-memory.dmp

Filesize
3.1MB

Download
memory/3476-2-0x00007FFC850E0000-0x00007FFC85BA2000-memory.dmp

Filesize
10.8MB

Download
memory/3476-7-0x00007FFC850E0000-0x00007FFC85BA2000-memory.dmp

Filesize
10.8MB

Download
memory/4460-6-0x00007FFC850E0000-0x00007FFC85BA2000-memory.dmp

Filesize
10.8MB

Download
memory/4460-8-0x00007FFC850E0000-0x00007FFC85BA2000-memory.dmp

Filesize
10.8MB

Download
memory/4460-9-0x000000001EAA0000-0x000000001EAF0000-memory.dmp

Filesize
320KB

Download
memory/4460-10-0x000000001EBB0000-0x000000001EC62000-memory.dmp

Filesize
712KB

Download
memory/4460-11-0x00007FFC850E0000-0x00007FFC85BA2000-memory.dmp

Filesize
10.8MB

Download