quasar | 043bd9f70265da014b6ca98126748570265db535b8105d5ef9ee5b9d4064c9ed

General

Target

Client-built.exe
Size

3.1MB
MD5

bb394e24cefb7def4a58be7a086c1b6e
SHA1

ca0ee7eb98f7f3fac0dbb64178e8bbdb6a85688e
SHA256

043bd9f70265da014b6ca98126748570265db535b8105d5ef9ee5b9d4064c9ed
SHA512

4acab7609b1ccbaf5a37e3239db135c350edad82caefa28f46dbbcf68ba002b9ca42765f96e7df7899c9a29e6f570f20c1a1455ddd0b3ac5f2a3017f9dbf02db
SSDEEP

49152:DvzlL26AaNeWgPhlmVqvMQ7XSKixRJ6fbR3LoGdctTHHB72eh2NT:DvpL26AaNeWgPhlmVqkQ7XSKixRJ6x

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.0.169:4782

Mutex

d1633e8d-888a-4785-b591-7ddec8df31a6

Attributes

encryption_key
E2C0A8DE00F91C56BBD30BD99E29F3EB6F0E59DB
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/3540-1-0x00000000009A0000-0x0000000000CC4000-memory.dmp	family_quasar
behavioral1/files/0x001c00000002aacc-5.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2404	Client.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3540	Client-built.exe
Token: SeDebugPrivilege	2404	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4968	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 2404	3540	Client-built.exe	77
PID 3540 wrote to memory of 2404	3540	Client-built.exe	77

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2404

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4968

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\6d7109c3-fe57-4939-8f01-efff69cf990b.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
711f1a880c08e1f7867f1bdd117320b7

SHA1
50c2d0859f6fd41024d486e2ab537507b975991d

SHA256
f868e98aa21c341e365d73e301d87c006b557033d8d7b2808fed207734fe5143

SHA512
885c2abd9047727b33ea760836cbbe4eaf5fddc08375a8b37840c99332131f0f7164f87c0abeb4523f42262349ab12a1c22c12813a9d81d6955c7d20b41a9a0a

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.1MB

MD5
bb394e24cefb7def4a58be7a086c1b6e

SHA1
ca0ee7eb98f7f3fac0dbb64178e8bbdb6a85688e

SHA256
043bd9f70265da014b6ca98126748570265db535b8105d5ef9ee5b9d4064c9ed

SHA512
4acab7609b1ccbaf5a37e3239db135c350edad82caefa28f46dbbcf68ba002b9ca42765f96e7df7899c9a29e6f570f20c1a1455ddd0b3ac5f2a3017f9dbf02db

Download Submit
memory/2404-9-0x00007FFCF6F20000-0x00007FFCF79E2000-memory.dmp

Filesize
10.8MB

Download
memory/2404-10-0x00007FFCF6F20000-0x00007FFCF79E2000-memory.dmp

Filesize
10.8MB

Download
memory/2404-11-0x000000001B4D0000-0x000000001B520000-memory.dmp

Filesize
320KB

Download
memory/2404-12-0x000000001B5E0000-0x000000001B692000-memory.dmp

Filesize
712KB

Download
memory/2404-13-0x00007FFCF6F20000-0x00007FFCF79E2000-memory.dmp

Filesize
10.8MB

Download
memory/3540-0-0x00007FFCF6F23000-0x00007FFCF6F25000-memory.dmp

Filesize
8KB

Download
memory/3540-1-0x00000000009A0000-0x0000000000CC4000-memory.dmp

Filesize
3.1MB

Download
memory/3540-2-0x00007FFCF6F20000-0x00007FFCF79E2000-memory.dmp

Filesize
10.8MB

Download
memory/3540-8-0x00007FFCF6F20000-0x00007FFCF79E2000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing