quasar | 43b71df5e82088360ef5c989dc4d64e73cfc914ce5242227cacd738385920bef

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-12-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Geode.exe
Size

3.1MB
MD5

1d0f632c36b11f0c97f0b9edc9ea3b5b
SHA1

4de1d02026467739101b1ff56040dfcac0c32907
SHA256

43b71df5e82088360ef5c989dc4d64e73cfc914ce5242227cacd738385920bef
SHA512

9c31115c2e8cb640adcd36d2576d68578a521596526beaa6b3f68edfc58035f27088c01bfc2d3efae2a950fd44d136d718ece604c506f5a49d49e6610e31fc46
SSDEEP

49152:ivkt62XlaSFNWPjljiFa2RoUYIaTY+5DpCL/oGdfrTHHB72eh2NT:iv462XlaSFNWPjljiFXRoUYIa8+W

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.1.182:4782

Mutex

3ac0c00d-09c5-4e2f-b311-74219d53d39b

Attributes

encryption_key
3EDD78F514CCF273FBBB32742C07F192C4532416
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Geode
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/1624-1-0x0000000000280000-0x00000000005A4000-memory.dmp	family_quasar
behavioral1/files/0x0007000000019467-6.dat	family_quasar
behavioral1/memory/2348-10-0x00000000010A0000-0x00000000013C4000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2348	Client.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2316	schtasks.exe
2700	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	Geode.exe
Token: SeDebugPrivilege	2348	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2348	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2316	1624	Geode.exe	31
PID 1624 wrote to memory of 2316	1624	Geode.exe	31
PID 1624 wrote to memory of 2316	1624	Geode.exe	31
PID 1624 wrote to memory of 2348	1624	Geode.exe	33
PID 1624 wrote to memory of 2348	1624	Geode.exe	33
PID 1624 wrote to memory of 2348	1624	Geode.exe	33
PID 2348 wrote to memory of 2700	2348	Client.exe	34
PID 2348 wrote to memory of 2700	2348	Client.exe	34
PID 2348 wrote to memory of 2700	2348	Client.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Geode.exe
"C:\Users\Admin\AppData\Local\Temp\Geode.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Geode" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2316
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Geode" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.1MB

MD5
1d0f632c36b11f0c97f0b9edc9ea3b5b

SHA1
4de1d02026467739101b1ff56040dfcac0c32907

SHA256
43b71df5e82088360ef5c989dc4d64e73cfc914ce5242227cacd738385920bef

SHA512
9c31115c2e8cb640adcd36d2576d68578a521596526beaa6b3f68edfc58035f27088c01bfc2d3efae2a950fd44d136d718ece604c506f5a49d49e6610e31fc46

Download Submit
memory/1624-0-0x000007FEF53E3000-0x000007FEF53E4000-memory.dmp

Filesize
4KB

Download
memory/1624-1-0x0000000000280000-0x00000000005A4000-memory.dmp

Filesize
3.1MB

Download
memory/1624-2-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/1624-9-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2348-8-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2348-10-0x00000000010A0000-0x00000000013C4000-memory.dmp

Filesize
3.1MB

Download
memory/2348-11-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2348-12-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads