quasar | 2a69213a7677e532af714831eff3f7bbca5a8b578bad3ba018a11c447a9eb422

Analysis

max time kernel
32s
max time network
34s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
28-12-2024 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Licencia contraseña 1234.zip
Size

1.1MB
MD5

737f6281fd4d983e3224a410f1149efb
SHA1

55c486ac423393fefcceab02ff7ba72a7d23b327
SHA256

2a69213a7677e532af714831eff3f7bbca5a8b578bad3ba018a11c447a9eb422
SHA512

7925ba5ca0d962f9cb1987df71168cad02885b5cd4cdaa546314dfcceff2edded45f8209521700da964686c276dfe681f05ca559c543cf4a75ba2741b3f4bb52
SSDEEP

24576:T+E+8LclAGQ6vGayPt+5V80boRRIzxfS1xzvmJehMnrX6FkLyAKa5esH:TY8LXSubKm06RIzxOVmYGnrfLfKK9

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

azxq0ap.localto.net:3425

Mutex

e51e2b65-e963-4051-9736-67d57ed46798

Attributes

encryption_key
AEA258EF65BF1786F0F767C0BE2497ECC304C46F
install_name
WindowsUpdate.exe
log_directory
Logs
reconnect_delay
3000
startup_key
WindowsUpdate
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00280000000460dc-2.dat	family_quasar
behavioral1/memory/2144-5-0x0000000000740000-0x0000000000A66000-memory.dmp	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
2144	Licencia XHXX.exe
4748	WindowsUpdate.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4380	schtasks.exe
3424	schtasks.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	1504	7zFM.exe
Token: 35	1504	7zFM.exe
Token: SeSecurityPrivilege	1504	7zFM.exe
Token: SeDebugPrivilege	2144	Licencia XHXX.exe
Token: SeDebugPrivilege	4748	WindowsUpdate.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1504	7zFM.exe
1504	7zFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4748	WindowsUpdate.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 4380	2144	Licencia XHXX.exe	92
PID 2144 wrote to memory of 4380	2144	Licencia XHXX.exe	92
PID 2144 wrote to memory of 4748	2144	Licencia XHXX.exe	94
PID 2144 wrote to memory of 4748	2144	Licencia XHXX.exe	94
PID 4748 wrote to memory of 3424	4748	WindowsUpdate.exe	95
PID 4748 wrote to memory of 3424	4748	WindowsUpdate.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Licencia contraseña 1234.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1504

C:\Users\Admin\Desktop\Licencia XHXX.exe
"C:\Users\Admin\Desktop\Licencia XHXX.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4380
- C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Licencia XHXX.exe

Filesize
3.1MB

MD5
16656861d60be66d91ef29c455276669

SHA1
8d21d8e02398f67be2abd30d6162b9c990c9da44

SHA256
5e66f2e25b980485b49cbaaccf16eb6b39495e356eea2d4a9e51c3a81ca15f4b

SHA512
0bd5138730a6cc7fbc56271d9364ef3104c24b5442b7549b59b3ea662e918897ab79e510eb764315c0cec7e576250391ae43cc9754c6199bcef379ddb60a389a

Download Submit
memory/2144-4-0x00007FFDBF483000-0x00007FFDBF485000-memory.dmp

Filesize
8KB

Download
memory/2144-5-0x0000000000740000-0x0000000000A66000-memory.dmp

Filesize
3.1MB

Download
memory/2144-6-0x00007FFDBF480000-0x00007FFDBFF42000-memory.dmp

Filesize
10.8MB

Download
memory/2144-9-0x00007FFDBF480000-0x00007FFDBFF42000-memory.dmp

Filesize
10.8MB

Download
memory/4748-10-0x000000001B0F0000-0x000000001B140000-memory.dmp

Filesize
320KB

Download
memory/4748-11-0x000000001C640000-0x000000001C6F2000-memory.dmp

Filesize
712KB

Download
memory/4748-14-0x000000001B2A0000-0x000000001B2B2000-memory.dmp

Filesize
72KB

Download
memory/4748-15-0x000000001CD40000-0x000000001CD7C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads