quasar | 5172700366f345593877129c22ae1bed1a597aa9332c2c912da3dc7ff7bd0a9b

Analysis

max time kernel
299s
max time network
302s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
17-06-2024 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

ec3f91bf354d94946e524b288ef97c6d
SHA1

ab2dfc79878a8195f142a18595fd822c2d8d5a7d
SHA256

5172700366f345593877129c22ae1bed1a597aa9332c2c912da3dc7ff7bd0a9b
SHA512

7a021563fbcf21c14eac7cd9d43e21272449973dae2d9c6f133170254ecd0e76495a2cb574486d80246b3de7a52adf486ab0ca529ec2d79df57ca1c0534101e9
SSDEEP

49152:yvbI22SsaNYfdPBldt698dBcjHyARJ6lbR3LoGdrXTHHB72eh2NT:yvk22SsaNYfdPBldt6+dBcjHyARJ63

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

37.114.46.114:7676

Mutex

e0310c76-889c-426f-97d7-5884c55eb219

Attributes

encryption_key
759E26EEFA8087EDC8E60DA520B42D33F934A835
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4044-1-0x0000000000520000-0x0000000000844000-memory.dmp family_quasar
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Client-built.exe

description pid process

Token: SeDebugPrivilege 4044 Client-built.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Client-built.exe

pid process

4044 Client-built.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Client-built.exe

pid process

4044 Client-built.exe

resource	yara_rule
behavioral2/memory/4044-1-0x0000000000520000-0x0000000000844000-memory.dmp	family_quasar

description	pid	process
Token: SeDebugPrivilege	4044	Client-built.exe

pid	process
4044	Client-built.exe

pid	process
4044	Client-built.exe

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4044

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4044-0-0x00007FFF45B73000-0x00007FFF45B75000-memory.dmp

Filesize
8KB

Download
memory/4044-1-0x0000000000520000-0x0000000000844000-memory.dmp

Filesize
3.1MB

Download
memory/4044-2-0x00007FFF45B70000-0x00007FFF46632000-memory.dmp

Filesize
10.8MB

Download
memory/4044-3-0x000000001C2A0000-0x000000001C2F0000-memory.dmp

Filesize
320KB

Download
memory/4044-4-0x000000001C3B0000-0x000000001C462000-memory.dmp

Filesize
712KB

Download
memory/4044-5-0x00007FFF45B73000-0x00007FFF45B75000-memory.dmp

Filesize
8KB

Download
memory/4044-6-0x00007FFF45B70000-0x00007FFF46632000-memory.dmp

Filesize
10.8MB

Download