quasar | 38333105568fce734bdd879230abda47774869fa84ab37d956287d9ba197314c

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
29-06-2024 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built - Copie.exe
Size

3.1MB
MD5

c558a79e91fc7a650470b5013874ffa3
SHA1

c79d23530d3c3edecc9b84f100ac8000d83c5522
SHA256

38333105568fce734bdd879230abda47774869fa84ab37d956287d9ba197314c
SHA512

4c0c9137b780f77a2fe7b29bb90a389fc42077b03ea4dc4626cf728ac11050bb5f1043876d9011528ec323258168f89283b8d64af9ad6162af6577cff294e174
SSDEEP

98304:KvI22SsaNYfdPBldt6+dBcjHozRJ6/+W:8d7jeG+

Score

10^/10

quasar testip spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

TESTIP

6.tcp.ngrok.io:19468

Mutex

88de9d82-6909-427b-8a11-f28cf4280285

Attributes

encryption_key
562515CBE0241F4FD48C91375ED3063F997D8AEE
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/224-1-0x0000000000590000-0x00000000008B4000-memory.dmp family_quasar
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

1 6.tcp.ngrok.io
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Client-built - Copie.exe

description pid process

Token: SeDebugPrivilege 224 Client-built - Copie.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client-built - Copie.exe

pid process

224 Client-built - Copie.exe

resource	yara_rule
behavioral1/memory/224-1-0x0000000000590000-0x00000000008B4000-memory.dmp	family_quasar

flow	ioc
1	6.tcp.ngrok.io

description	pid	process
Token: SeDebugPrivilege	224	Client-built - Copie.exe

pid	process
224	Client-built - Copie.exe

C:\Users\Admin\AppData\Local\Temp\Client-built - Copie.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built - Copie.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:224

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/224-0-0x00007FFF7D5D3000-0x00007FFF7D5D5000-memory.dmp

Filesize
8KB

Download
memory/224-1-0x0000000000590000-0x00000000008B4000-memory.dmp

Filesize
3.1MB

Download
memory/224-2-0x00007FFF7D5D0000-0x00007FFF7E092000-memory.dmp

Filesize
10.8MB

Download
memory/224-3-0x0000000002AA0000-0x0000000002AF0000-memory.dmp

Filesize
320KB

Download
memory/224-4-0x000000001BED0000-0x000000001BF82000-memory.dmp

Filesize
712KB

Download
memory/224-5-0x000000001C5C0000-0x000000001CAE8000-memory.dmp

Filesize
5.2MB

Download
memory/224-7-0x00007FFF7D5D3000-0x00007FFF7D5D5000-memory.dmp

Filesize
8KB

Download
memory/224-8-0x00007FFF7D5D0000-0x00007FFF7E092000-memory.dmp

Filesize
10.8MB

Download