quasar | aff3e08b50336ce6a1cfe39c45d32d918dc6f190662aef666addb193f44d47a8

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75e5b5dd81e4e1cc6623f32b322c79ef80d65a2383afa33a45db6e9e75b8d519.exe
Size

502KB
MD5

8a04eeadf3aa212ad8b9ec03750598b5
SHA1

8ecd4c1b9e3f52c8cfb33785b8669d0fe12a67bd
SHA256

75e5b5dd81e4e1cc6623f32b322c79ef80d65a2383afa33a45db6e9e75b8d519
SHA512

e804d6b2530a1239dcd0dc51921841342def20fa97d2f64029f793321fcba343d3bf703fbf7c4e167233c219724364e1e6ca4266f806f5194cfda927f46d8dff
SSDEEP

6144:xTEgdc0YrXAGbgiIN2RSBKnaJm5xGDy5Etqk+yw4sUcEOOb8F9Z2U/iBWcTR3y:xTEgdfYbbgyaJpj4xywyepTcBWcdy

Score

10^/10

quasar office365 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

office365

192.168.0.182:4782

Mutex

247cbad3-d2c3-4911-bcea-2ba07f8a24dd

Attributes

encryption_key
B23B358E069C74D3466E9FC1110706C029AADF0D
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/2824-1-0x0000000000070000-0x00000000000F4000-memory.dmp	family_quasar
behavioral1/memory/2732-7-0x0000000000870000-0x00000000008F4000-memory.dmp	family_quasar
behavioral1/files/0x0005000000019da4-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2732	Client.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\SubDir\Client.exe	75e5b5dd81e4e1cc6623f32b322c79ef80d65a2383afa33a45db6e9e75b8d519.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	75e5b5dd81e4e1cc6623f32b322c79ef80d65a2383afa33a45db6e9e75b8d519.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	75e5b5dd81e4e1cc6623f32b322c79ef80d65a2383afa33a45db6e9e75b8d519.exe
Token: SeDebugPrivilege	2732	Client.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2732	Client.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2732	Client.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2732	2824	75e5b5dd81e4e1cc6623f32b322c79ef80d65a2383afa33a45db6e9e75b8d519.exe	30
PID 2824 wrote to memory of 2732	2824	75e5b5dd81e4e1cc6623f32b322c79ef80d65a2383afa33a45db6e9e75b8d519.exe	30
PID 2824 wrote to memory of 2732	2824	75e5b5dd81e4e1cc6623f32b322c79ef80d65a2383afa33a45db6e9e75b8d519.exe	30

C:\Users\Admin\AppData\Local\Temp\75e5b5dd81e4e1cc6623f32b322c79ef80d65a2383afa33a45db6e9e75b8d519.exe
"C:\Users\Admin\AppData\Local\Temp\75e5b5dd81e4e1cc6623f32b322c79ef80d65a2383afa33a45db6e9e75b8d519.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\SubDir\Client.exe
  "C:\Windows\system32\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\SubDir\Client.exe

Filesize
502KB

MD5
8a04eeadf3aa212ad8b9ec03750598b5

SHA1
8ecd4c1b9e3f52c8cfb33785b8669d0fe12a67bd

SHA256
75e5b5dd81e4e1cc6623f32b322c79ef80d65a2383afa33a45db6e9e75b8d519

SHA512
e804d6b2530a1239dcd0dc51921841342def20fa97d2f64029f793321fcba343d3bf703fbf7c4e167233c219724364e1e6ca4266f806f5194cfda927f46d8dff

Download Submit
memory/2732-7-0x0000000000870000-0x00000000008F4000-memory.dmp

Filesize
528KB

Download
memory/2732-9-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2732-10-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2732-11-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2824-0-0x000007FEF6403000-0x000007FEF6404000-memory.dmp

Filesize
4KB

Download
memory/2824-1-0x0000000000070000-0x00000000000F4000-memory.dmp

Filesize
528KB

Download
memory/2824-2-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2824-8-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download