quasar | afe6294896126bff591fd4ff3dee78474d3d5c1eb3ffb1e19feded5790274024

Analysis

max time kernel
145s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FrozenLoader.exe
Size

348KB
MD5

56df78c075bbdd3b936d20271cd5dd82
SHA1

3da3858b7567d1c553d5c0159fcb77bdd066a1eb
SHA256

afe6294896126bff591fd4ff3dee78474d3d5c1eb3ffb1e19feded5790274024
SHA512

e18fd89bfb797ba68fa8f9a74d152693ac2e8b7f2e8fbac564aa8ea6a8562176036eec6cd0ebf599821c6e047a9e28c105e45e7d3d65527c534d24334c1e4c6e
SSDEEP

6144:QG13U1vhtvTA19YhA/bDI3RdG2XC5pH1:LUJtLAvSA4y2XC5pH1

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.0.1

Botnet

Office04

127.0.0.1:2912

Mutex

QSR_MUTEX_kZpgHXcbTqoAXhJbxd

Attributes

encryption_key
BRjfOpzb3dVWPO5EbkGe
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2060-1-0x0000000000910000-0x000000000096E000-memory.dmp	family_quasar
\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
behavioral1/memory/2696-10-0x00000000002A0000-0x00000000002FE000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

2696 Client.exe
Loads dropped DLL 1 IoCs

Processes:

FrozenLoader.exe

pid process

2060 FrozenLoader.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2592 schtasks.exe
2512 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

FrozenLoader.exeClient.exe

description pid process

Token: SeDebugPrivilege 2060 FrozenLoader.exe
Token: SeDebugPrivilege 2696 Client.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

2696 Client.exe

pid	process
2696	Client.exe

pid	process
2060	FrozenLoader.exe

flow	ioc
2	ip-api.com

pid	process
2592	schtasks.exe
2512	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	2060	FrozenLoader.exe
Token: SeDebugPrivilege	2696	Client.exe

pid	process
2696	Client.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

FrozenLoader.exeClient.exe

description	pid	process	target process
PID 2060 wrote to memory of 2592	2060	FrozenLoader.exe	schtasks.exe
PID 2060 wrote to memory of 2592	2060	FrozenLoader.exe	schtasks.exe
PID 2060 wrote to memory of 2592	2060	FrozenLoader.exe	schtasks.exe
PID 2060 wrote to memory of 2592	2060	FrozenLoader.exe	schtasks.exe
PID 2060 wrote to memory of 2696	2060	FrozenLoader.exe	Client.exe
PID 2060 wrote to memory of 2696	2060	FrozenLoader.exe	Client.exe
PID 2060 wrote to memory of 2696	2060	FrozenLoader.exe	Client.exe
PID 2060 wrote to memory of 2696	2060	FrozenLoader.exe	Client.exe
PID 2696 wrote to memory of 2512	2696	Client.exe	schtasks.exe
PID 2696 wrote to memory of 2512	2696	Client.exe	schtasks.exe
PID 2696 wrote to memory of 2512	2696	Client.exe	schtasks.exe
PID 2696 wrote to memory of 2512	2696	Client.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\FrozenLoader.exe
"C:\Users\Admin\AppData\Local\Temp\FrozenLoader.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\FrozenLoader.exe" /rl HIGHEST /f
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2512

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
348KB

MD5
56df78c075bbdd3b936d20271cd5dd82

SHA1
3da3858b7567d1c553d5c0159fcb77bdd066a1eb

SHA256
afe6294896126bff591fd4ff3dee78474d3d5c1eb3ffb1e19feded5790274024

SHA512
e18fd89bfb797ba68fa8f9a74d152693ac2e8b7f2e8fbac564aa8ea6a8562176036eec6cd0ebf599821c6e047a9e28c105e45e7d3d65527c534d24334c1e4c6e

Download Submit
memory/2060-0-0x000000007482E000-0x000000007482F000-memory.dmp

Filesize
4KB

Download
memory/2060-1-0x0000000000910000-0x000000000096E000-memory.dmp

Filesize
376KB

Download
memory/2060-2-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2060-13-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-11-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-12-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-10-0x00000000002A0000-0x00000000002FE000-memory.dmp

Filesize
376KB

Download
memory/2696-15-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-16-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download