Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-01-2025 10:57
Behavioral task
behavioral1
Sample
Quasar.exe
Resource
win7-20241010-en
windows7-x64
11 signatures
150 seconds
General
-
Target
Quasar.exe
-
Size
1.2MB
-
MD5
12ebf922aa80d13f8887e4c8c5e7be83
-
SHA1
7f87a80513e13efd45175e8f2511c2cd17ff51e8
-
SHA256
43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e
-
SHA512
fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275
-
SSDEEP
12288:IwPs012cBBBYiL9l/bFfpBBBBBBBBBBBBcA:jBBBYiLvzFfpBBBBBBBBBBBBcA
Malware Config
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral1/memory/2472-1-0x0000000000D50000-0x0000000000E88000-memory.dmp family_quasar -
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2728 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2472 Quasar.exe Token: 33 2768 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2768 AUDIODG.EXE Token: 33 2768 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2768 AUDIODG.EXE Token: SeDebugPrivilege 2728 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2916 osk.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe -
Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe 2916 osk.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2968 2472 Quasar.exe 29 PID 2472 wrote to memory of 2968 2472 Quasar.exe 29 PID 2472 wrote to memory of 2968 2472 Quasar.exe 29 PID 2372 wrote to memory of 2916 2372 utilman.exe 32 PID 2372 wrote to memory of 2916 2372 utilman.exe 32 PID 2372 wrote to memory of 2916 2372 utilman.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\Quasar.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2472 -s 5842⤵PID:2968
-
-
C:\Windows\system32\osk.exe"C:\Windows\system32\osk.exe"1⤵PID:3040
-
C:\Windows\system32\utilman.exeutilman.exe /debug1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\System32\osk.exe"C:\Windows\System32\osk.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2916
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5081⤵
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
C:\Windows\system32\taskmgr.exetaskmgr.exe /21⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2728