quasar | 273c917fc8fddcb94de25686720df1ea12f948dfbebffa56314b6565123ae678

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-01-2025 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

273c917fc8fddcb94de25686720df1ea12f948dfbebffa56314b6565123ae678.exe
Size

3.1MB
MD5

21ce4cd2ce246c86222b57b93cdc92bd
SHA1

9dc24ad846b2d9db64e5bbea1977e23bb185d224
SHA256

273c917fc8fddcb94de25686720df1ea12f948dfbebffa56314b6565123ae678
SHA512

ff43fe890e30d6766f51922cfd1e9c36d312fd305620954fae8c61829f58d7361ae442bf9145339904eb6a88c2629c1e83f5b8a1d78ab0d13554cf6053d194f6
SSDEEP

49152:DvTI22SsaNYfdPBldt698dBcjHZqS71J/ioGdRTTHHB72eh2NT:Dvs22SsaNYfdPBldt6+dBcjHZqSOB

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

0.tcp.in.ngrok.io:14296

Mutex

cc827307-beb6-456e-b5dd-e28a204ebd45

Attributes

encryption_key
93486CAE624EBAD6626412E4A7DC6221B139DAA8
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/2660-1-0x0000000000CD0000-0x0000000000FF4000-memory.dmp	family_quasar

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	0.tcp.in.ngrok.io
15	0.tcp.in.ngrok.io
27	0.tcp.in.ngrok.io

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2144	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	273c917fc8fddcb94de25686720df1ea12f948dfbebffa56314b6565123ae678.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2660	273c917fc8fddcb94de25686720df1ea12f948dfbebffa56314b6565123ae678.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2144	2660	273c917fc8fddcb94de25686720df1ea12f948dfbebffa56314b6565123ae678.exe	29
PID 2660 wrote to memory of 2144	2660	273c917fc8fddcb94de25686720df1ea12f948dfbebffa56314b6565123ae678.exe	29
PID 2660 wrote to memory of 2144	2660	273c917fc8fddcb94de25686720df1ea12f948dfbebffa56314b6565123ae678.exe	29

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\273c917fc8fddcb94de25686720df1ea12f948dfbebffa56314b6565123ae678.exe
"C:\Users\Admin\AppData\Local\Temp\273c917fc8fddcb94de25686720df1ea12f948dfbebffa56314b6565123ae678.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2660-2-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

Filesize
9.9MB

Download
memory/2660-1-0x0000000000CD0000-0x0000000000FF4000-memory.dmp

Filesize
3.1MB

Download
memory/2660-0-0x000007FEF5E03000-0x000007FEF5E04000-memory.dmp

Filesize
4KB

Download
memory/2660-3-0x000007FEF5E03000-0x000007FEF5E04000-memory.dmp

Filesize
4KB

Download
memory/2660-4-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads