quasar | 3864d360423959f1c229abd6db2a8b94c197910296c20661c4736102a388112f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2025 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3864d360423959f1c229abd6db2a8b94c197910296c20661c4736102a388112f.exe
Size

3.1MB
MD5

d0d7ab7998eee34f17c5299b2e5369d8
SHA1

6c1d3438adeb0b7f21be3c881be8fbee01b4e4f4
SHA256

3864d360423959f1c229abd6db2a8b94c197910296c20661c4736102a388112f
SHA512

fcec45df80bbe966817e468d3a4b56fb5d67d3472bc60f49cc25e86099b91f566ed1627e4f33b1ee037726e431af11c267bdd6d22518daf4489b6272f0d29304
SSDEEP

49152:SvnI22SsaNYfdPBldt698dBcjHp2RJ6EbR3LoGdQRZTHHB72eh2NT:SvI22SsaNYfdPBldt6+dBcjHp2RJ6O

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

other-little.gl.at.ply.gg:11758

Mutex

fbbc34bd-7320-405e-aebb-d4c666ee475f

Attributes

encryption_key
FEA99DED4EFE826DE2850621FD7919E62525FD26
install_name
DirectX111.exe
log_directory
Logs
reconnect_delay
3000
startup_key
DirectX
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3520-1-0x0000000000B80000-0x0000000000EA4000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023ca5-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
3596	DirectX111.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4956	schtasks.exe
776	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	3864d360423959f1c229abd6db2a8b94c197910296c20661c4736102a388112f.exe
Token: SeDebugPrivilege	3596	DirectX111.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 4956	3520	3864d360423959f1c229abd6db2a8b94c197910296c20661c4736102a388112f.exe	81
PID 3520 wrote to memory of 4956	3520	3864d360423959f1c229abd6db2a8b94c197910296c20661c4736102a388112f.exe	81
PID 3520 wrote to memory of 3596	3520	3864d360423959f1c229abd6db2a8b94c197910296c20661c4736102a388112f.exe	84
PID 3520 wrote to memory of 3596	3520	3864d360423959f1c229abd6db2a8b94c197910296c20661c4736102a388112f.exe	84
PID 3596 wrote to memory of 776	3596	DirectX111.exe	85
PID 3596 wrote to memory of 776	3596	DirectX111.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3864d360423959f1c229abd6db2a8b94c197910296c20661c4736102a388112f.exe
"C:\Users\Admin\AppData\Local\Temp\3864d360423959f1c229abd6db2a8b94c197910296c20661c4736102a388112f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "DirectX" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\DirectX111.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4956
- C:\Users\Admin\AppData\Roaming\SubDir\DirectX111.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\DirectX111.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "DirectX" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\DirectX111.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\DirectX111.exe

Filesize
3.1MB

MD5
d0d7ab7998eee34f17c5299b2e5369d8

SHA1
6c1d3438adeb0b7f21be3c881be8fbee01b4e4f4

SHA256
3864d360423959f1c229abd6db2a8b94c197910296c20661c4736102a388112f

SHA512
fcec45df80bbe966817e468d3a4b56fb5d67d3472bc60f49cc25e86099b91f566ed1627e4f33b1ee037726e431af11c267bdd6d22518daf4489b6272f0d29304

Download Submit
memory/3520-0-0x00007FFC76C43000-0x00007FFC76C45000-memory.dmp

Filesize
8KB

Download
memory/3520-1-0x0000000000B80000-0x0000000000EA4000-memory.dmp

Filesize
3.1MB

Download
memory/3520-2-0x00007FFC76C40000-0x00007FFC77701000-memory.dmp

Filesize
10.8MB

Download
memory/3520-10-0x00007FFC76C40000-0x00007FFC77701000-memory.dmp

Filesize
10.8MB

Download
memory/3596-9-0x00007FFC76C40000-0x00007FFC77701000-memory.dmp

Filesize
10.8MB

Download
memory/3596-11-0x00007FFC76C40000-0x00007FFC77701000-memory.dmp

Filesize
10.8MB

Download
memory/3596-12-0x000000001AF90000-0x000000001AFE0000-memory.dmp

Filesize
320KB

Download
memory/3596-13-0x000000001D010000-0x000000001D0C2000-memory.dmp

Filesize
712KB

Download
memory/3596-14-0x00007FFC76C40000-0x00007FFC77701000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads