Overview
overview
10Static
static
10Quasar v1....e.html
windows11-21h2-x64
1Quasar v1....to.dll
windows11-21h2-x64
1Quasar v1....ok.dll
windows11-21h2-x64
1Quasar v1....db.dll
windows11-21h2-x64
1Quasar v1....db.dll
windows11-21h2-x64
1Quasar v1....ks.dll
windows11-21h2-x64
1Quasar v1....il.dll
windows11-21h2-x64
1Quasar v1....at.dll
windows11-21h2-x64
1Quasar v1....on.dll
windows11-21h2-x64
1Quasar v1....ar.exe
windows11-21h2-x64
10Quasar v1....ib.dll
windows11-21h2-x64
1Quasar v1....nt.exe
windows11-21h2-x64
10Quasar v1....et.dll
windows11-21h2-x64
1Analysis
-
max time kernel
50s -
max time network
461s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-06-2024 14:19
Behavioral task
behavioral1
Sample
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
Quasar v1.4.1/BouncyCastle.Crypto.dll
Resource
win11-20240419-en
Behavioral task
behavioral3
Sample
Quasar v1.4.1/Gma.System.MouseKeyHook.dll
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
Quasar v1.4.1/Mono.Cecil.Mdb.dll
Resource
win11-20240611-en
Behavioral task
behavioral5
Sample
Quasar v1.4.1/Mono.Cecil.Pdb.dll
Resource
win11-20240611-en
Behavioral task
behavioral6
Sample
Quasar v1.4.1/Mono.Cecil.Rocks.dll
Resource
win11-20240508-en
Behavioral task
behavioral7
Sample
Quasar v1.4.1/Mono.Cecil.dll
Resource
win11-20240508-en
Behavioral task
behavioral8
Sample
Quasar v1.4.1/Open.Nat.dll
Resource
win11-20240611-en
Behavioral task
behavioral9
Sample
Quasar v1.4.1/Quasar.Common.dll
Resource
win11-20240419-en
Behavioral task
behavioral10
Sample
Quasar v1.4.1/Quasar.exe
Resource
win11-20240508-en
Behavioral task
behavioral11
Sample
Quasar v1.4.1/Vestris.ResourceLib.dll
Resource
win11-20240611-en
Behavioral task
behavioral12
Sample
Quasar v1.4.1/client.exe
Resource
win11-20240611-en
Behavioral task
behavioral13
Sample
Quasar v1.4.1/protobuf-net.dll
Resource
win11-20240508-en
General
-
Target
Quasar v1.4.1/Quasar.exe
-
Size
1.2MB
-
MD5
12ebf922aa80d13f8887e4c8c5e7be83
-
SHA1
7f87a80513e13efd45175e8f2511c2cd17ff51e8
-
SHA256
43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e
-
SHA512
fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275
-
SSDEEP
12288:IwPs012cBBBYiL9l/bFfpBBBBBBBBBBBBcA:jBBBYiLvzFfpBBBBBBBBBBBBcA
Malware Config
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral10/memory/1624-1-0x000001AAA2800000-0x000001AAA2938000-memory.dmp family_quasar behavioral10/memory/1624-2-0x000001AAA2DC0000-0x000001AAA2DD6000-memory.dmp family_quasar -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Quasar.exedescription pid process Token: SeDebugPrivilege 1624 Quasar.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Quasar.exepid process 1624 Quasar.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Quasar.exepid process 1624 Quasar.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid process 876 explorer.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Quasar.exedescription pid process target process PID 1624 wrote to memory of 632 1624 Quasar.exe explorer.exe PID 1624 wrote to memory of 632 1624 Quasar.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\Quasar.exe"C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\Quasar.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" /select, "C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\quasar.p12"2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.dbFilesize
14KB
MD58b0db1922b300badec414af13c231630
SHA15a175ad6744083ae427c66f3ff238c8a23b52a7c
SHA256844ae96b032247958fe7a28d39d5553ef6cee1342a6bee56f3f9291eb2be22aa
SHA512e1055ce1d1881ef9a7dc2a4ae4835510fa8c3ec3822f8151041f894726a2d6afdc79a91bfed05382a5628537502a08d433ad17918e277703f13247231e923952
-
C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\quasar.p12Filesize
4KB
MD57b557a796c20348d91dd5ea246b77054
SHA16474adc1bf55cbd17daf12c7a04c785682268cbf
SHA256c3d7a215a488aad143e8b275ab914a2a7ac1f9a1f4480b2e26411daf2fdb049c
SHA5124ae3dc132a9c6222da0f831b3246cc98501288ca60df75bd8e645d7b9118c945f242ecdd8af17a30fdc4c2a53ed9765a8487b180fc667397627d1ea515fc7a8f
-
memory/1624-8-0x00007FFB728F0000-0x00007FFB733B2000-memory.dmpFilesize
10.8MB
-
memory/1624-9-0x00007FFB728F0000-0x00007FFB733B2000-memory.dmpFilesize
10.8MB
-
memory/1624-4-0x00007FFB728F0000-0x00007FFB733B2000-memory.dmpFilesize
10.8MB
-
memory/1624-5-0x00007FFB728F0000-0x00007FFB733B2000-memory.dmpFilesize
10.8MB
-
memory/1624-6-0x00007FFB728F0000-0x00007FFB733B2000-memory.dmpFilesize
10.8MB
-
memory/1624-7-0x000001AABF840000-0x000001AABFB6E000-memory.dmpFilesize
3.2MB
-
memory/1624-1-0x000001AAA2800000-0x000001AAA2938000-memory.dmpFilesize
1.2MB
-
memory/1624-3-0x00007FFB728F0000-0x00007FFB733B2000-memory.dmpFilesize
10.8MB
-
memory/1624-10-0x00007FFB728F0000-0x00007FFB733B2000-memory.dmpFilesize
10.8MB
-
memory/1624-2-0x000001AAA2DC0000-0x000001AAA2DD6000-memory.dmpFilesize
88KB
-
memory/1624-31-0x000001AABF4A0000-0x000001AABF4F0000-memory.dmpFilesize
320KB
-
memory/1624-33-0x000001AAC10A0000-0x000001AAC10EC000-memory.dmpFilesize
304KB
-
memory/1624-32-0x000001AAC1160000-0x000001AAC1212000-memory.dmpFilesize
712KB
-
memory/1624-30-0x000001AABF430000-0x000001AABF448000-memory.dmpFilesize
96KB
-
memory/1624-0-0x00007FFB728F3000-0x00007FFB728F5000-memory.dmpFilesize
8KB