quasar | 7c45872682181142c0baf0c738d36ffe0a466c39ea4be1a673b7304426a5606e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-06-2024 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

d15aaa22eb03b31937925310c3d36411
SHA1

45898e18f05d508753c7f051f671c21f4f3324e8
SHA256

7c45872682181142c0baf0c738d36ffe0a466c39ea4be1a673b7304426a5606e
SHA512

6127d1216c41ade025c98727a770d45e852978affa441eb45da108334b28c542e144157b070ec931440109d0890c843af305a29dc829bbc27a9d936df6ff982d
SSDEEP

49152:uvbI22SsaNYfdPBldt698dBcjHlXsAdpiLoGdi5zTHHB72eh2NT:uvk22SsaNYfdPBldt6+dBcjHhsH

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.0.1:8096

Mutex

f897331a-e70c-4b37-9939-0865729f7475

Attributes

encryption_key
1E5FEC53491F397A647C164995877CF2E1897DD5
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2172-1-0x0000000001360000-0x0000000001684000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
behavioral1/memory/2504-9-0x0000000000910000-0x0000000000C34000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

2504 Client.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2524 schtasks.exe
2492 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Client-built.exeClient.exe

description pid process

Token: SeDebugPrivilege 2172 Client-built.exe
Token: SeDebugPrivilege 2504 Client.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Client.exe

pid process

2504 Client.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Client.exe

pid process

2504 Client.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

2504 Client.exe

pid	process
2504	Client.exe

pid	process
2524	schtasks.exe
2492	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2172	Client-built.exe
Token: SeDebugPrivilege	2504	Client.exe

pid	process
2504	Client.exe

pid	process
2504	Client.exe

pid	process
2504	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Client-built.exeClient.exe

description	pid	process	target process
PID 2172 wrote to memory of 2492	2172	Client-built.exe	schtasks.exe
PID 2172 wrote to memory of 2492	2172	Client-built.exe	schtasks.exe
PID 2172 wrote to memory of 2492	2172	Client-built.exe	schtasks.exe
PID 2172 wrote to memory of 2504	2172	Client-built.exe	Client.exe
PID 2172 wrote to memory of 2504	2172	Client-built.exe	Client.exe
PID 2172 wrote to memory of 2504	2172	Client-built.exe	Client.exe
PID 2504 wrote to memory of 2524	2504	Client.exe	schtasks.exe
PID 2504 wrote to memory of 2524	2504	Client.exe	schtasks.exe
PID 2504 wrote to memory of 2524	2504	Client.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2524

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
d15aaa22eb03b31937925310c3d36411

SHA1
45898e18f05d508753c7f051f671c21f4f3324e8

SHA256
7c45872682181142c0baf0c738d36ffe0a466c39ea4be1a673b7304426a5606e

SHA512
6127d1216c41ade025c98727a770d45e852978affa441eb45da108334b28c542e144157b070ec931440109d0890c843af305a29dc829bbc27a9d936df6ff982d

Download Submit
memory/2172-0-0x000007FEF5973000-0x000007FEF5974000-memory.dmp

Filesize
4KB

Download
memory/2172-1-0x0000000001360000-0x0000000001684000-memory.dmp

Filesize
3.1MB

Download
memory/2172-2-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download
memory/2172-8-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download
memory/2504-7-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download
memory/2504-9-0x0000000000910000-0x0000000000C34000-memory.dmp

Filesize
3.1MB

Download
memory/2504-10-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download
memory/2504-11-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download