Overview

overview

10

Static

static

10

Quasar v1....e.html

windows7-x64

3

Quasar v1....e.html

windows10-2004-x64

3

Quasar v1....to.dll

windows7-x64

1

Quasar v1....to.dll

windows10-2004-x64

1

Quasar v1....ok.dll

windows7-x64

1

Quasar v1....ok.dll

windows10-2004-x64

1

Quasar v1....db.dll

windows7-x64

1

Quasar v1....db.dll

windows10-2004-x64

1

Quasar v1....db.dll

windows7-x64

1

Quasar v1....db.dll

windows10-2004-x64

1

Quasar v1....ks.dll

windows7-x64

1

Quasar v1....ks.dll

windows10-2004-x64

1

Quasar v1....il.dll

windows7-x64

1

Quasar v1....il.dll

windows10-2004-x64

1

Quasar v1....at.dll

windows7-x64

1

Quasar v1....at.dll

windows10-2004-x64

1

Quasar v1....on.dll

windows7-x64

1

Quasar v1....on.dll

windows10-2004-x64

1

Quasar v1....ar.exe

windows7-x64

10

Quasar v1....ar.exe

windows10-2004-x64

10

Quasar v1....ib.dll

windows7-x64

1

Quasar v1....ib.dll

windows10-2004-x64

1

Quasar v1....nt.exe

windows7-x64

10

Quasar v1....nt.exe

windows10-2004-x64

10

Quasar v1....et.dll

windows7-x64

1

Quasar v1....et.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    1047s
  • max time network
    839s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05-01-2025 21:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Quasar v1.4.1/Quasar.exe

  • Size

    1.2MB

  • MD5

    12ebf922aa80d13f8887e4c8c5e7be83

  • SHA1

    7f87a80513e13efd45175e8f2511c2cd17ff51e8

  • SHA256

    43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e

  • SHA512

    fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275

  • SSDEEP

    12288:IwPs012cBBBYiL9l/bFfpBBBBBBBBBBBBcA:jBBBYiLvzFfpBBBBBBBBBBBBcA

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

10.127.0.224:4782

Mutex

e4c3d57d-6d96-497b-b10a-62d1c3d31649

Attributes
  • encryption_key

    44CD7EF92E6E0A2543E7465C8BE27A9FE15E0E18

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    wadadw

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 5 IoCs
  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 62 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\Quasar.exe
    "C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\Quasar.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2776
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" /select, "C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\quasar.p12"
      2⤵
        PID:2912
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1296
      • C:\Windows\system32\ipconfig.exe
        ipconfig
        2⤵
        • Gathers network information
        PID:2408
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\Quasar.exe
        "C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\Quasar.exe"
        2⤵
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1492
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:2240
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x4f4
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1988
      • C:\Users\Admin\Downloads\FortniteXAmoungus.exe
        "C:\Users\Admin\Downloads\FortniteXAmoungus.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Windows\system32\schtasks.exe
          "schtasks" /create /tn "wadadw" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
          2⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2052
      • C:\Users\Admin\Downloads\FortniteXAmoungus.exe
        "C:\Users\Admin\Downloads\FortniteXAmoungus.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1656
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe"
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2484
      • C:\Users\Admin\Downloads\FortniteXAmoungus.exe
        "C:\Users\Admin\Downloads\FortniteXAmoungus.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2072

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\Profiles\Default.xml
        Filesize

        1KB

        MD5

        687e2683690873c98ad169f85a23671f

        SHA1

        395601c85cbcc5806b95e9c1b5e065a4d8c4b65d

        SHA256

        a582ed314356eac0b020f7880e4a4e46a5470b5b88ef9b6a3c257b72b11c3d61

        SHA512

        3f6d347afe1c9480bbc5b2401818ac35c2a30bdc336109fec4ef5a0f8bdddb708069931c3e66e68de0b0e95a3ceb4830e2867753a8ae2e11435cbb79d0321d79

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\quasar.p12
        Filesize

        4KB

        MD5

        e202c8dba49b7ef37d51ff2fa77d2d10

        SHA1

        29dd9060d1a0d5698f20475ccc60325dd1703bd5

        SHA256

        0f144060e1390c01d73ec07767ddea8ffbcc49aefdb5e5a0b30e707a67587859

        SHA512

        dbb6c7ca3e0fe284e6dfcf53bd14302726ad74c36dfff12090f55497e02814b862e33eb31432d796267c65ec623449de8b5412c6547ce405e7db04eeb15269f8

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-312935884-697965778-3955649944-1000\414267c747517a9871777ca7960ea864_1defa0c0-fc04-4155-83bc-b490dbaa3679
        Filesize

        3KB

        MD5

        2a387a6fe6591c6b9c935d36dc09f510

        SHA1

        f359cbd35d7d363827258001195fc99b74bbafda

        SHA256

        33f179cf0e1154848eed11159087e54d7818e194199a2900e433ae175c43184c

        SHA512

        3285a2bb4dc4d527d75c8e089ff6a2e2d7e70302271314ccccdee8029c7e8db5aff0986f2d6bf78026a20f8e4f11c0e12b3a0e02efe6c25d92111ea4c4a90ca7

        Download Submit

      • C:\Users\Admin\Downloads\FortniteXAmoungus.exe
        Filesize

        3.1MB

        MD5

        6d7c94c070e74b757e81d9a93f201b31

        SHA1

        6ff415d1c2e1033236a1f6fc6485690568a66dbf

        SHA256

        10aebc9b5f029eafb7b78cff7019b9235646379f502b3c89183cbfccf3944fa6

        SHA512

        7a8a70bfbaa762ca6a405122c42067232bddd47a82b8ad7ff4efac674a1377890a77fe23f8cb5e37c841969bdb70e3dc505d124087c6c9280b41fee40592db10

        Download Submit

      • memory/536-34-0x0000000003A10000-0x0000000003A20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1492-43-0x000000001B3C0000-0x000000001B3DA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1492-42-0x00000000200F0000-0x000000002014E000-memory.dmp

        Filesize

        376KB

        Download

      • memory/2484-119-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/2484-118-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/2484-116-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/2484-115-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/2616-110-0x0000000001160000-0x0000000001484000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2776-33-0x000000001C9E0000-0x000000001CA2C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/2776-32-0x000000001C810000-0x000000001C828000-memory.dmp

        Filesize

        96KB

        Download

      • memory/2776-8-0x000000001F130000-0x000000001F45E000-memory.dmp

        Filesize

        3.2MB

        Download

      • memory/2776-7-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2776-6-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2776-0-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2776-5-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2776-4-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2776-3-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2776-2-0x0000000000420000-0x0000000000436000-memory.dmp

        Filesize

        88KB

        Download

      • memory/2776-1-0x0000000000030000-0x0000000000168000-memory.dmp

        Filesize

        1.2MB

        Download