quasar | af454978c652f9acb95b7c2f45d41ee0ba7923d6e3b3f554af853ef9efff9440

Analysis

max time kernel
4s
max time network
155s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Celestial.exe
Size

3.1MB
MD5

12bdd4b4c107fc3ffec7f9b29d7d6a93
SHA1

04bb395848578e22cef0c90215463e4efe4965c3
SHA256

af454978c652f9acb95b7c2f45d41ee0ba7923d6e3b3f554af853ef9efff9440
SHA512

ff4a2c42ac1fed5421955a949cf28c9abb714484bb68259f160516d10a7a179cc6e6327ab2fc2f099ba51a98b25fa5f41ea2af4f3815159e1ce7f75a698b8251
SSDEEP

49152:nv6lL26AaNeWgPhlmVqvMQ7XSKZkxNESElk/iULoGdldTHHB72eh2NT:nviL26AaNeWgPhlmVqkQ7XSKGxsa

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

147.185.221.19:33365

Mutex

ba5220e2-c4e8-4381-aad8-a85115ef955e

Attributes

encryption_key
67C139F3E9A16FF8132A3DCF42197B8BA3C38609
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Miicrosoft Securiity
subdirectory
Miicrosoft Securiity

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3008-1-0x0000000000930000-0x0000000000C54000-memory.dmp	family_quasar
C:\Program Files\Miicrosoft Securiity\Client.exe	family_quasar
behavioral1/memory/2116-7-0x00000000010B0000-0x00000000013D4000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

2116 Client.exe

pid	process
2116	Client.exe

Drops file in Program Files directory 4 IoCs

Processes:

Celestial.exeClient.exe

description	ioc	process
File opened for modification	C:\Program Files\Miicrosoft Securiity	Celestial.exe
File opened for modification	C:\Program Files\Miicrosoft Securiity	Client.exe
File created	C:\Program Files\Miicrosoft Securiity\Client.exe	Celestial.exe
File opened for modification	C:\Program Files\Miicrosoft Securiity\Client.exe	Celestial.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

3056 schtasks.exe
2668 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Celestial.exeClient.exe

description pid process

Token: SeDebugPrivilege 3008 Celestial.exe
Token: SeDebugPrivilege 2116 Client.exe

pid	process
3056	schtasks.exe
2668	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	3008	Celestial.exe
Token: SeDebugPrivilege	2116	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Celestial.exeClient.exe

description	pid	process	target process
PID 3008 wrote to memory of 3056	3008	Celestial.exe	schtasks.exe
PID 3008 wrote to memory of 3056	3008	Celestial.exe	schtasks.exe
PID 3008 wrote to memory of 3056	3008	Celestial.exe	schtasks.exe
PID 3008 wrote to memory of 2116	3008	Celestial.exe	Client.exe
PID 3008 wrote to memory of 2116	3008	Celestial.exe	Client.exe
PID 3008 wrote to memory of 2116	3008	Celestial.exe	Client.exe
PID 2116 wrote to memory of 2668	2116	Client.exe	schtasks.exe
PID 2116 wrote to memory of 2668	2116	Client.exe	schtasks.exe
PID 2116 wrote to memory of 2668	2116	Client.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Celestial.exe
"C:\Users\Admin\AppData\Local\Temp\Celestial.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Miicrosoft Securiity" /sc ONLOGON /tr "C:\Program Files\Miicrosoft Securiity\Client.exe" /rl HIGHEST /f
2⤵
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Program Files\Miicrosoft Securiity\Client.exe
"C:\Program Files\Miicrosoft Securiity\Client.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Miicrosoft Securiity" /sc ONLOGON /tr "C:\Program Files\Miicrosoft Securiity\Client.exe" /rl HIGHEST /f
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2668

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Miicrosoft Securiity\Client.exe
Filesize
3.1MB

MD5
12bdd4b4c107fc3ffec7f9b29d7d6a93

SHA1
04bb395848578e22cef0c90215463e4efe4965c3

SHA256
af454978c652f9acb95b7c2f45d41ee0ba7923d6e3b3f554af853ef9efff9440

SHA512
ff4a2c42ac1fed5421955a949cf28c9abb714484bb68259f160516d10a7a179cc6e6327ab2fc2f099ba51a98b25fa5f41ea2af4f3815159e1ce7f75a698b8251

Download Submit
memory/2116-7-0x00000000010B0000-0x00000000013D4000-memory.dmp

Filesize
3.1MB

Download
memory/2116-9-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Filesize
9.9MB

Download
memory/2116-10-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Filesize
9.9MB

Download
memory/2116-11-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Filesize
9.9MB

Download
memory/2116-12-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Filesize
9.9MB

Download
memory/3008-0-0x000007FEF58D3000-0x000007FEF58D4000-memory.dmp

Filesize
4KB

Download
memory/3008-1-0x0000000000930000-0x0000000000C54000-memory.dmp

Filesize
3.1MB

Download
memory/3008-2-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Filesize
9.9MB

Download
memory/3008-8-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Filesize
9.9MB

Download