quasar | 7aa6c2e38366d1b553ce56e67f35cfa687e4ba0f7c3eaa404f5ba2449af9fbe5

Analysis

max time kernel
27s
max time network
36s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
30-06-2024 11:22

Target

New folder/Client-built - Copy.exe
Size

3.1MB
MD5

f3802bd8f99e5c9ca6c04a7addc2d0d8
SHA1

96c6b9feffe04c5fbefc48802ac0635f596c6a33
SHA256

6dc99f25c5f794d14323fa2ed8ec891ea2fd81c359d676052574585471984d06
SHA512

5eb55bf1c70c40124a4d4df4c20ece52d6ed060c874c01f1fe4b130056edead2dad3a3dd919a487f2dec03d7e5e684883770c48e53932ac7c44b8ab03dbb84ce
SSDEEP

49152:OvjI22SsaNYfdPBldt698dBcjHAd19LoGdGTHHB72eh2NT:Ovc22SsaNYfdPBldt6+dBcjHAd11

Score

10^/10

Family

quasar

Version

1.4.1

Botnet

Office04

10.240.115.45:4782

Mutex

2cc201c7-b02e-4a34-8806-aa9a8d33ae2d

Attributes

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar payload 2 IoCs

Processes:

resource yara_rule

behavioral4/memory/400-1-0x0000000000A30000-0x0000000000D54000-memory.dmp family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe family_quasar
Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

1604 Client.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

1332 schtasks.exe
1892 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Client-built - Copy.exeClient.exe

description pid process

Token: SeDebugPrivilege 400 Client-built - Copy.exe
Token: SeDebugPrivilege 1604 Client.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

1604 Client.exe

resource	yara_rule
behavioral4/memory/400-1-0x0000000000A30000-0x0000000000D54000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar

pid	process
1604	Client.exe

pid	process
1332	schtasks.exe
1892	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	400	Client-built - Copy.exe
Token: SeDebugPrivilege	1604	Client.exe

pid	process
1604	Client.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Client-built - Copy.exeClient.exe

description	pid	process	target process
PID 400 wrote to memory of 1892	400	Client-built - Copy.exe	schtasks.exe
PID 400 wrote to memory of 1892	400	Client-built - Copy.exe	schtasks.exe
PID 400 wrote to memory of 1604	400	Client-built - Copy.exe	Client.exe
PID 400 wrote to memory of 1604	400	Client-built - Copy.exe	Client.exe
PID 1604 wrote to memory of 1332	1604	Client.exe	schtasks.exe
PID 1604 wrote to memory of 1332	1604	Client.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
2⤵
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1332

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
f3802bd8f99e5c9ca6c04a7addc2d0d8

SHA1
96c6b9feffe04c5fbefc48802ac0635f596c6a33

SHA256
6dc99f25c5f794d14323fa2ed8ec891ea2fd81c359d676052574585471984d06

SHA512
5eb55bf1c70c40124a4d4df4c20ece52d6ed060c874c01f1fe4b130056edead2dad3a3dd919a487f2dec03d7e5e684883770c48e53932ac7c44b8ab03dbb84ce

Download Submit
memory/400-0-0x00007FFEE6673000-0x00007FFEE6675000-memory.dmp

Filesize
8KB

Download
memory/400-1-0x0000000000A30000-0x0000000000D54000-memory.dmp

Filesize
3.1MB

Download
memory/400-2-0x00007FFEE6670000-0x00007FFEE7132000-memory.dmp

Filesize
10.8MB

Download
memory/400-8-0x00007FFEE6670000-0x00007FFEE7132000-memory.dmp

Filesize
10.8MB

Download
memory/1604-9-0x00007FFEE6670000-0x00007FFEE7132000-memory.dmp

Filesize
10.8MB

Download
memory/1604-10-0x00007FFEE6670000-0x00007FFEE7132000-memory.dmp

Filesize
10.8MB

Download
memory/1604-11-0x0000000002DC0000-0x0000000002E10000-memory.dmp

Filesize
320KB

Download
memory/1604-12-0x000000001C500000-0x000000001C5B2000-memory.dmp

Filesize
712KB

Download
memory/1604-13-0x00007FFEE6670000-0x00007FFEE7132000-memory.dmp

Filesize
10.8MB

Download