quasar | 8e52ba8956d643c96cdeb75c43492302cf710a3d2acc852442930dedbe9ea1bb

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea2b9ce0bf438cd413b9da177608b91c6a1129a65917f66ae2db49a4d6776ee8.exe
Size

3.1MB
MD5

59cced923e3a96704b1e7b5549559aa7
SHA1

2a463e2d878673c2041d0064b5185193efbd3113
SHA256

ea2b9ce0bf438cd413b9da177608b91c6a1129a65917f66ae2db49a4d6776ee8
SHA512

6f232972332a860120c663462b836124575ef9208eb1e0e9c7e75b9720f1a22ff09c264e8339f7fb75bb04bafed79bd282bf3d65837f7beec09642cf0dc80d61
SSDEEP

49152:mvBt62XlaSFNWPjljiFa2RoUYIxpxNESE2k/iNLoGdXTHHB72eh2NT:mvr62XlaSFNWPjljiFXRoUYIrxJF

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

0.tcp.ngrok.io:16515

Mutex

8d4f5337-a7b5-4237-9349-d9bede1e2337

Attributes

encryption_key
CC1E18558E65763D4940C1C87A6788F6761FFA4D
install_name
svchostt.exe
log_directory
Logs
reconnect_delay
3000
startup_key
win64launcher
subdirectory
SubDirr

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/1252-1-0x0000000001070000-0x0000000001394000-memory.dmp	family_quasar
behavioral1/files/0x00050000000193d4-5.dat	family_quasar
behavioral1/memory/3024-10-0x0000000000DB0000-0x00000000010D4000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
3024	svchostt.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
2	0.tcp.ngrok.io
15	0.tcp.ngrok.io
23	0.tcp.ngrok.io
29	0.tcp.ngrok.io

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDirr	svchostt.exe
File created	C:\Windows\system32\SubDirr\svchostt.exe	ea2b9ce0bf438cd413b9da177608b91c6a1129a65917f66ae2db49a4d6776ee8.exe
File opened for modification	C:\Windows\system32\SubDirr\svchostt.exe	ea2b9ce0bf438cd413b9da177608b91c6a1129a65917f66ae2db49a4d6776ee8.exe
File opened for modification	C:\Windows\system32\SubDirr	ea2b9ce0bf438cd413b9da177608b91c6a1129a65917f66ae2db49a4d6776ee8.exe
File opened for modification	C:\Windows\system32\SubDirr\svchostt.exe	svchostt.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3056	schtasks.exe
2200	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1252	ea2b9ce0bf438cd413b9da177608b91c6a1129a65917f66ae2db49a4d6776ee8.exe
Token: SeDebugPrivilege	3024	svchostt.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3024	svchostt.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 3056	1252	ea2b9ce0bf438cd413b9da177608b91c6a1129a65917f66ae2db49a4d6776ee8.exe	30
PID 1252 wrote to memory of 3056	1252	ea2b9ce0bf438cd413b9da177608b91c6a1129a65917f66ae2db49a4d6776ee8.exe	30
PID 1252 wrote to memory of 3056	1252	ea2b9ce0bf438cd413b9da177608b91c6a1129a65917f66ae2db49a4d6776ee8.exe	30
PID 1252 wrote to memory of 3024	1252	ea2b9ce0bf438cd413b9da177608b91c6a1129a65917f66ae2db49a4d6776ee8.exe	32
PID 1252 wrote to memory of 3024	1252	ea2b9ce0bf438cd413b9da177608b91c6a1129a65917f66ae2db49a4d6776ee8.exe	32
PID 1252 wrote to memory of 3024	1252	ea2b9ce0bf438cd413b9da177608b91c6a1129a65917f66ae2db49a4d6776ee8.exe	32
PID 3024 wrote to memory of 2200	3024	svchostt.exe	33
PID 3024 wrote to memory of 2200	3024	svchostt.exe	33
PID 3024 wrote to memory of 2200	3024	svchostt.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ea2b9ce0bf438cd413b9da177608b91c6a1129a65917f66ae2db49a4d6776ee8.exe
"C:\Users\Admin\AppData\Local\Temp\ea2b9ce0bf438cd413b9da177608b91c6a1129a65917f66ae2db49a4d6776ee8.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "win64launcher" /sc ONLOGON /tr "C:\Windows\system32\SubDirr\svchostt.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3056
- C:\Windows\system32\SubDirr\svchostt.exe
  "C:\Windows\system32\SubDirr\svchostt.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "win64launcher" /sc ONLOGON /tr "C:\Windows\system32\SubDirr\svchostt.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\SubDirr\svchostt.exe

Filesize
3.1MB

MD5
59cced923e3a96704b1e7b5549559aa7

SHA1
2a463e2d878673c2041d0064b5185193efbd3113

SHA256
ea2b9ce0bf438cd413b9da177608b91c6a1129a65917f66ae2db49a4d6776ee8

SHA512
6f232972332a860120c663462b836124575ef9208eb1e0e9c7e75b9720f1a22ff09c264e8339f7fb75bb04bafed79bd282bf3d65837f7beec09642cf0dc80d61

Download Submit
memory/1252-0-0x000007FEF5E13000-0x000007FEF5E14000-memory.dmp

Filesize
4KB

Download
memory/1252-1-0x0000000001070000-0x0000000001394000-memory.dmp

Filesize
3.1MB

Download
memory/1252-2-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/1252-8-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/3024-9-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/3024-10-0x0000000000DB0000-0x00000000010D4000-memory.dmp

Filesize
3.1MB

Download
memory/3024-11-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/3024-12-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads