quasar | 718833d88ff6500a6dde11a5b3b1809a61c591823ae214a59d99450abfb006ce

Analysis

max time kernel
126s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2025, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built66.exe
Size

1.5MB
MD5

67d95d3eb21ca6d4e309d3e0c7b65595
SHA1

f60d16348059a74b03d368ef3df41a15c2c6cc01
SHA256

718833d88ff6500a6dde11a5b3b1809a61c591823ae214a59d99450abfb006ce
SHA512

004e8fa6499b640be4d6f69ebeb752d6dcaeececc4832a920fe6d2dec3988eee52350cb69b90a6d9fc458a38bb12fa96ff7457a6dbded25266545c3c2428706f
SSDEEP

24576:ffMnwA1Qg+S2HIPbcNE0KKzaOwIRxl2SLuLLusXbQ4q045nLjuodgD:HYrMEwKKzwipyX8WGLj9g

Score

10^/10

quasar spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral2/memory/2292-1-0x00000163A4D50000-0x00000163A4EDC000-memory.dmp	family_quasar
behavioral2/memory/2292-2-0x00000163A6B70000-0x00000163A6B8A000-memory.dmp	family_quasar
behavioral2/files/0x000a0000000241a8-7.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
5664	Clientsided.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\SubDir\Clientsided.exe	Client-built66.exe
File opened for modification	C:\Windows\system32\SubDir\Clientsided.exe	Client-built66.exe
File opened for modification	C:\Windows\system32\SubDir	Client-built66.exe
File opened for modification	C:\Windows\system32\SubDir\Clientsided.exe	Clientsided.exe
File opened for modification	C:\Windows\system32\SubDir	Clientsided.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4220	schtasks.exe
5900	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5664	Clientsided.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	Client-built66.exe
Token: SeDebugPrivilege	5664	Clientsided.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5664	Clientsided.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 4220	2292	Client-built66.exe	86
PID 2292 wrote to memory of 4220	2292	Client-built66.exe	86
PID 2292 wrote to memory of 5664	2292	Client-built66.exe	89
PID 2292 wrote to memory of 5664	2292	Client-built66.exe	89
PID 5664 wrote to memory of 5900	5664	Clientsided.exe	94
PID 5664 wrote to memory of 5900	5664	Clientsided.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built66.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built66.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "hack Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Clientsided.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4220
- C:\Windows\system32\SubDir\Clientsided.exe
  "C:\Windows\system32\SubDir\Clientsided.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "hack Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Clientsided.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\SubDir\Clientsided.exe

Filesize
1.5MB

MD5
67d95d3eb21ca6d4e309d3e0c7b65595

SHA1
f60d16348059a74b03d368ef3df41a15c2c6cc01

SHA256
718833d88ff6500a6dde11a5b3b1809a61c591823ae214a59d99450abfb006ce

SHA512
004e8fa6499b640be4d6f69ebeb752d6dcaeececc4832a920fe6d2dec3988eee52350cb69b90a6d9fc458a38bb12fa96ff7457a6dbded25266545c3c2428706f

Download Submit
memory/2292-0-0x00007FFDE1293000-0x00007FFDE1295000-memory.dmp

Filesize
8KB

Download
memory/2292-1-0x00000163A4D50000-0x00000163A4EDC000-memory.dmp

Filesize
1.5MB

Download
memory/2292-2-0x00000163A6B70000-0x00000163A6B8A000-memory.dmp

Filesize
104KB

Download
memory/2292-3-0x00007FFDE1290000-0x00007FFDE1D51000-memory.dmp

Filesize
10.8MB

Download
memory/2292-10-0x00007FFDE1290000-0x00007FFDE1D51000-memory.dmp

Filesize
10.8MB

Download
memory/5664-11-0x00007FFDE1290000-0x00007FFDE1D51000-memory.dmp

Filesize
10.8MB

Download
memory/5664-12-0x00007FFDE1290000-0x00007FFDE1D51000-memory.dmp

Filesize
10.8MB

Download
memory/5664-13-0x000001636FEC0000-0x000001636FED2000-memory.dmp

Filesize
72KB

Download
memory/5664-14-0x0000016370250000-0x00000163702A0000-memory.dmp

Filesize
320KB

Download
memory/5664-15-0x0000016370360000-0x0000016370412000-memory.dmp

Filesize
712KB

Download
memory/5664-16-0x000001636FED0000-0x000001636FF1E000-memory.dmp

Filesize
312KB

Download
memory/5664-17-0x00007FFDE1290000-0x00007FFDE1D51000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads