quasar | e63b41bfdd3a89b6ebcfc05db158fdc399dbc081e49b01498831a62df34defc3 | Triage

Analysis

max time kernel
30s
max time network
24s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2024 15:14

Sharing

Report Analysis Logs

General

Target

Loader.exe
Size

3.1MB
MD5

e9a138d8c5ab2cccc8bf9976f66d30c8
SHA1

e996894168f0d4e852162d1290250dfa986310f8
SHA256

e63b41bfdd3a89b6ebcfc05db158fdc399dbc081e49b01498831a62df34defc3
SHA512

5982fc759c8b1121ab5befaac53e1521931f06d276140195fa1fcbcd1069f546253e366ef4cc37245b3bc2ed60c4b8d0583f133a1264efd77938adf456a08ccc
SSDEEP

49152:fvrI22SsaNYfdPBldt698dBcjHCWvXE/sGkCqILo+dPVTHHB72eh2NT:fvU22SsaNYfdPBldt6+dBcjHCWvTm

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

Dystopian-62863.portmap.host:62863

Mutex

e1de8f9b-5a7a-4798-a6fb-c03591ef3442

Attributes

encryption_key
8C1BB32BFD240218BA0CB04D65341FB1FDE1E001
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SubStart
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/1092-1-0x0000000000710000-0x0000000000A34000-memory.dmp	family_quasar
behavioral2/files/0x000a000000023b8c-6.dat	family_quasar

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 3 IoCs

pid	Process
4752	Client.exe
3604	Client.exe
804	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

pid	Process
1484	PING.EXE
4776	PING.EXE
5084	PING.EXE

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

pid	Process
5084	PING.EXE
1484	PING.EXE
4776	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1428	schtasks.exe
4504	schtasks.exe
4400	schtasks.exe
2284	schtasks.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1092	Loader.exe
Token: SeDebugPrivilege	4752	Client.exe
Token: SeDebugPrivilege	3604	Client.exe
Token: SeDebugPrivilege	804	Client.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1428	1092	Loader.exe	82
PID 1092 wrote to memory of 1428	1092	Loader.exe	82
PID 1092 wrote to memory of 4752	1092	Loader.exe	84
PID 1092 wrote to memory of 4752	1092	Loader.exe	84
PID 4752 wrote to memory of 4504	4752	Client.exe	85
PID 4752 wrote to memory of 4504	4752	Client.exe	85
PID 4752 wrote to memory of 4236	4752	Client.exe	87
PID 4752 wrote to memory of 4236	4752	Client.exe	87
PID 4236 wrote to memory of 1440	4236	cmd.exe	89
PID 4236 wrote to memory of 1440	4236	cmd.exe	89
PID 4236 wrote to memory of 1484	4236	cmd.exe	90
PID 4236 wrote to memory of 1484	4236	cmd.exe	90
PID 4236 wrote to memory of 3604	4236	cmd.exe	95
PID 4236 wrote to memory of 3604	4236	cmd.exe	95
PID 3604 wrote to memory of 4400	3604	Client.exe	96
PID 3604 wrote to memory of 4400	3604	Client.exe	96
PID 3604 wrote to memory of 8	3604	Client.exe	98
PID 3604 wrote to memory of 8	3604	Client.exe	98
PID 8 wrote to memory of 3308	8	cmd.exe	100
PID 8 wrote to memory of 3308	8	cmd.exe	100
PID 8 wrote to memory of 4776	8	cmd.exe	101
PID 8 wrote to memory of 4776	8	cmd.exe	101
PID 8 wrote to memory of 804	8	cmd.exe	105
PID 8 wrote to memory of 804	8	cmd.exe	105
PID 804 wrote to memory of 2284	804	Client.exe	106
PID 804 wrote to memory of 2284	804	Client.exe	106
PID 804 wrote to memory of 4376	804	Client.exe	108
PID 804 wrote to memory of 4376	804	Client.exe	108
PID 4376 wrote to memory of 2020	4376	cmd.exe	110
PID 4376 wrote to memory of 2020	4376	cmd.exe	110
PID 4376 wrote to memory of 5084	4376	cmd.exe	111
PID 4376 wrote to memory of 5084	4376	cmd.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "SubStart" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1428
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "SubStart" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rJZddAQejhuY.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1440
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1484
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3604
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "SubStart" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4400
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hB978xMMF5S6.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:8
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3308
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4776
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:804
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "SubStart" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jexG5nVc7t3t.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2020
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hB978xMMF5S6.bat

Filesize
207B

MD5
bed47dabd48e1e7202d1b9d7ad26a72d

SHA1
967ecb0e09889d00101abc1595b385e21354112a

SHA256
2bb7a232cec9d71b94a7c0b24904a33ac6cfceba38bb2ec90f21a33f848368ec

SHA512
bd10e3bb102ba98ad0a37041bdd7f56d25f053f7ef05ef031c67a6aa8ca89e7a8dc8c77428fc6e7ed06d8b4668aeae527fc1b6bfbc3b725558d8789f74787cfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\jexG5nVc7t3t.bat

Filesize
207B

MD5
d1095f260cd4c6444a81e33a3eaec6ec

SHA1
1dbe25135629116deeebc65c0d051cde1eb41e7b

SHA256
0a3ef204e22fa939ca4ca199193e6a8638c4f1874305106f2f9facc5657df3dd

SHA512
2384ae53a9a03ae8b88ff62539a87bf477ba9e7032c05e7b0bfc2265149a8c3cdc439310f7429f8e242e6f82bb536ca1fdacb86adbe84f0d364a6270d26858c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\rJZddAQejhuY.bat

Filesize
207B

MD5
fbb21507ed6e58a437fd141f5b1a1ccf

SHA1
a807e7da7b2b3a5d65c61d33c3a23d92b1526a78

SHA256
f830ccc7f96ce486c6d9720026388abdf14c9597bb2eee913fdcf415dd288077

SHA512
380048025799a1fced637c6bdb9d69e3814af9adc577ea43e278b9bf3f7491c7e0b5cb635cfd19cedf58fdbad817e6122e8827ea4d16d95e28a75a82721ae44e

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.1MB

MD5
e9a138d8c5ab2cccc8bf9976f66d30c8

SHA1
e996894168f0d4e852162d1290250dfa986310f8

SHA256
e63b41bfdd3a89b6ebcfc05db158fdc399dbc081e49b01498831a62df34defc3

SHA512
5982fc759c8b1121ab5befaac53e1521931f06d276140195fa1fcbcd1069f546253e366ef4cc37245b3bc2ed60c4b8d0583f133a1264efd77938adf456a08ccc

Download Submit
memory/1092-10-0x00007FFA494B0000-0x00007FFA49F71000-memory.dmp

Filesize
10.8MB

Download
memory/1092-0-0x00007FFA494B3000-0x00007FFA494B5000-memory.dmp

Filesize
8KB

Download
memory/1092-2-0x00007FFA494B0000-0x00007FFA49F71000-memory.dmp

Filesize
10.8MB

Download
memory/1092-1-0x0000000000710000-0x0000000000A34000-memory.dmp

Filesize
3.1MB

Download
memory/4752-9-0x00007FFA494B0000-0x00007FFA49F71000-memory.dmp

Filesize
10.8MB

Download
memory/4752-11-0x00007FFA494B0000-0x00007FFA49F71000-memory.dmp

Filesize
10.8MB

Download
memory/4752-12-0x000000001D2A0000-0x000000001D2F0000-memory.dmp

Filesize
320KB

Download
memory/4752-13-0x000000001D3B0000-0x000000001D462000-memory.dmp

Filesize
712KB

Download
memory/4752-19-0x00007FFA494B0000-0x00007FFA49F71000-memory.dmp

Filesize
10.8MB

Download