quasar | e637549ded084cd9e61d64c46ef644362ccd60df698be34e3ebbec60a8a7d609

General

Target

0x000c000000012262-5.exe
Size

3.1MB
MD5

548a6f6748f28b10a5e2f69f9c52fa43
SHA1

7466319907b51baca2b604144c0b7d021806da80
SHA256

e637549ded084cd9e61d64c46ef644362ccd60df698be34e3ebbec60a8a7d609
SHA512

25f26bba572e91f118dafc20248a77a891fc318b5aeb3b17971a6b06415de2b55a6f046eb012f0fa9501bf50957a91b53a70398586b533dc8d98dfcbed36fab4
SSDEEP

49152:HvSI22SsaNYfdPBldt698dBcjHoGrMoGHTTHHB72eh2NT:Hv/22SsaNYfdPBldt6+dBcjHoGY

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

84.67.89.127:4782

Mutex

40b84850-9991-4b2c-a985-76db9b77d6fe

Attributes

encryption_key
24D2D4587F63E088D81748782350D3C2EF08E8BC
install_name
SystemRuntimes.exe
log_directory
Logs
reconnect_delay
3000
startup_key
DisplayRuntimes
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/404-1-0x0000000000F40000-0x0000000001264000-memory.dmp	family_quasar
behavioral2/files/0x0007000000024302-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
4424	SystemRuntimes.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\SubDir\SystemRuntimes.exe	0x000c000000012262-5.exe
File opened for modification	C:\Windows\system32\SubDir\SystemRuntimes.exe	0x000c000000012262-5.exe
File opened for modification	C:\Windows\system32\SubDir	0x000c000000012262-5.exe
File opened for modification	C:\Windows\system32\SubDir\SystemRuntimes.exe	SystemRuntimes.exe
File opened for modification	C:\Windows\system32\SubDir	SystemRuntimes.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4584	schtasks.exe
5068	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	404	0x000c000000012262-5.exe
Token: SeDebugPrivilege	4424	SystemRuntimes.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4424	SystemRuntimes.exe
4424	SystemRuntimes.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4424	SystemRuntimes.exe
4424	SystemRuntimes.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4424	SystemRuntimes.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 5068	404	0x000c000000012262-5.exe	88
PID 404 wrote to memory of 5068	404	0x000c000000012262-5.exe	88
PID 404 wrote to memory of 4424	404	0x000c000000012262-5.exe	90
PID 404 wrote to memory of 4424	404	0x000c000000012262-5.exe	90
PID 4424 wrote to memory of 4584	4424	SystemRuntimes.exe	93
PID 4424 wrote to memory of 4584	4424	SystemRuntimes.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0x000c000000012262-5.exe
"C:\Users\Admin\AppData\Local\Temp\0x000c000000012262-5.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "DisplayRuntimes" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SystemRuntimes.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5068
- C:\Windows\system32\SubDir\SystemRuntimes.exe
  "C:\Windows\system32\SubDir\SystemRuntimes.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "DisplayRuntimes" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SystemRuntimes.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\SubDir\SystemRuntimes.exe

Filesize
3.1MB

MD5
548a6f6748f28b10a5e2f69f9c52fa43

SHA1
7466319907b51baca2b604144c0b7d021806da80

SHA256
e637549ded084cd9e61d64c46ef644362ccd60df698be34e3ebbec60a8a7d609

SHA512
25f26bba572e91f118dafc20248a77a891fc318b5aeb3b17971a6b06415de2b55a6f046eb012f0fa9501bf50957a91b53a70398586b533dc8d98dfcbed36fab4

Download Submit
memory/404-0-0x00007FFBD2AD3000-0x00007FFBD2AD5000-memory.dmp

Filesize
8KB

Download
memory/404-1-0x0000000000F40000-0x0000000001264000-memory.dmp

Filesize
3.1MB

Download
memory/404-2-0x00007FFBD2AD0000-0x00007FFBD3591000-memory.dmp

Filesize
10.8MB

Download
memory/404-10-0x00007FFBD2AD0000-0x00007FFBD3591000-memory.dmp

Filesize
10.8MB

Download
memory/4424-9-0x00007FFBD2AD0000-0x00007FFBD3591000-memory.dmp

Filesize
10.8MB

Download
memory/4424-11-0x00007FFBD2AD0000-0x00007FFBD3591000-memory.dmp

Filesize
10.8MB

Download
memory/4424-12-0x000000001BF90000-0x000000001BFE0000-memory.dmp

Filesize
320KB

Download
memory/4424-13-0x000000001C0A0000-0x000000001C152000-memory.dmp

Filesize
712KB

Download
memory/4424-16-0x000000001C020000-0x000000001C032000-memory.dmp

Filesize
72KB

Download
memory/4424-17-0x000000001C8A0000-0x000000001C8DC000-memory.dmp

Filesize
240KB

Download
memory/4424-18-0x00007FFBD2AD0000-0x00007FFBD3591000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads