quasar | 49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87

Analysis

max time kernel
147s
max time network
139s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dabaf8f6f0a1c62aea91871b215fe93c.exe
Size

524KB
MD5

dabaf8f6f0a1c62aea91871b215fe93c
SHA1

7a1e1d9981e64379b6ad2517f3705180aa45c5c5
SHA256

49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87
SHA512

d509c13f5b28ca1c2d1ec0e57f9d0bb0c31f08ede421f9b57f4a7cb08a782ebf97f4ef0f38e7b36c9747b3f607302a5b5d9ddc8a30d625e7e6f09dc2a5e24c6b
SSDEEP

6144:RswAitwXUqtyzlKJCCzq1GzzjQ6NWiOhODiPw532k1c3u5WM+ix/WJpBvCIvyNVp:RJ4y5KJIMznOTPwtdIYbfSBvqN

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office04

194.26.192.92:4782

xmarvel.ddns.net:4782

Mutex

1D5hAYqKMWDHFxCpFw

Attributes

encryption_key
GqEm1Kfv49pa27CfDSc9
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2724-26-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/2724-24-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/2724-30-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/2724-32-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/2724-31-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar

Drops startup file 1 IoCs

Processes:

dabaf8f6f0a1c62aea91871b215fe93c.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windowssandbox.lnk dabaf8f6f0a1c62aea91871b215fe93c.exe
Executes dropped EXE 1 IoCs

Processes:

windowssandbox.exe

pid process

2516 windowssandbox.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

3048 cmd.exe
3048 cmd.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
6 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

windowssandbox.exe

description pid process target process

PID 2516 set thread context of 2724 2516 windowssandbox.exe InstallUtil.exe
Drops file in Program Files directory 2 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Program Files (x86)\windowssandbox.exe cmd.exe
File opened for modification C:\Program Files (x86)\windowssandbox.exe cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

2660 PING.EXE
2756 PING.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windowssandbox.lnk	dabaf8f6f0a1c62aea91871b215fe93c.exe

pid	process
2516	windowssandbox.exe

pid	process
3048	cmd.exe
3048	cmd.exe

flow	ioc
2	ip-api.com
6	api.ipify.org

description	pid	process	target process
PID 2516 set thread context of 2724	2516	windowssandbox.exe	InstallUtil.exe

description	ioc	process
File created	C:\Program Files (x86)\windowssandbox.exe	cmd.exe
File opened for modification	C:\Program Files (x86)\windowssandbox.exe	cmd.exe

pid	process
2660	PING.EXE
2756	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

dabaf8f6f0a1c62aea91871b215fe93c.exewindowssandbox.exe

pid	process
1252	dabaf8f6f0a1c62aea91871b215fe93c.exe
1252	dabaf8f6f0a1c62aea91871b215fe93c.exe
1252	dabaf8f6f0a1c62aea91871b215fe93c.exe
1252	dabaf8f6f0a1c62aea91871b215fe93c.exe
2516	windowssandbox.exe
2516	windowssandbox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

dabaf8f6f0a1c62aea91871b215fe93c.exewindowssandbox.exeInstallUtil.exe

description pid process

Token: SeDebugPrivilege 1252 dabaf8f6f0a1c62aea91871b215fe93c.exe
Token: SeDebugPrivilege 2516 windowssandbox.exe
Token: SeDebugPrivilege 2724 InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	1252	dabaf8f6f0a1c62aea91871b215fe93c.exe
Token: SeDebugPrivilege	2516	windowssandbox.exe
Token: SeDebugPrivilege	2724	InstallUtil.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

dabaf8f6f0a1c62aea91871b215fe93c.execmd.exewindowssandbox.exe

description	pid	process	target process
PID 1252 wrote to memory of 3048	1252	dabaf8f6f0a1c62aea91871b215fe93c.exe	cmd.exe
PID 1252 wrote to memory of 3048	1252	dabaf8f6f0a1c62aea91871b215fe93c.exe	cmd.exe
PID 1252 wrote to memory of 3048	1252	dabaf8f6f0a1c62aea91871b215fe93c.exe	cmd.exe
PID 1252 wrote to memory of 3048	1252	dabaf8f6f0a1c62aea91871b215fe93c.exe	cmd.exe
PID 3048 wrote to memory of 2660	3048	cmd.exe	PING.EXE
PID 3048 wrote to memory of 2660	3048	cmd.exe	PING.EXE
PID 3048 wrote to memory of 2660	3048	cmd.exe	PING.EXE
PID 3048 wrote to memory of 2660	3048	cmd.exe	PING.EXE
PID 3048 wrote to memory of 2756	3048	cmd.exe	PING.EXE
PID 3048 wrote to memory of 2756	3048	cmd.exe	PING.EXE
PID 3048 wrote to memory of 2756	3048	cmd.exe	PING.EXE
PID 3048 wrote to memory of 2756	3048	cmd.exe	PING.EXE
PID 3048 wrote to memory of 2516	3048	cmd.exe	windowssandbox.exe
PID 3048 wrote to memory of 2516	3048	cmd.exe	windowssandbox.exe
PID 3048 wrote to memory of 2516	3048	cmd.exe	windowssandbox.exe
PID 3048 wrote to memory of 2516	3048	cmd.exe	windowssandbox.exe
PID 2516 wrote to memory of 2724	2516	windowssandbox.exe	InstallUtil.exe
PID 2516 wrote to memory of 2724	2516	windowssandbox.exe	InstallUtil.exe
PID 2516 wrote to memory of 2724	2516	windowssandbox.exe	InstallUtil.exe
PID 2516 wrote to memory of 2724	2516	windowssandbox.exe	InstallUtil.exe
PID 2516 wrote to memory of 2724	2516	windowssandbox.exe	InstallUtil.exe
PID 2516 wrote to memory of 2724	2516	windowssandbox.exe	InstallUtil.exe
PID 2516 wrote to memory of 2724	2516	windowssandbox.exe	InstallUtil.exe
PID 2516 wrote to memory of 2724	2516	windowssandbox.exe	InstallUtil.exe
PID 2516 wrote to memory of 2724	2516	windowssandbox.exe	InstallUtil.exe
PID 2516 wrote to memory of 2724	2516	windowssandbox.exe	InstallUtil.exe
PID 2516 wrote to memory of 2724	2516	windowssandbox.exe	InstallUtil.exe
PID 2516 wrote to memory of 2724	2516	windowssandbox.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\dabaf8f6f0a1c62aea91871b215fe93c.exe
"C:\Users\Admin\AppData\Local\Temp\dabaf8f6f0a1c62aea91871b215fe93c.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 18 > nul && copy "C:\Users\Admin\AppData\Local\Temp\dabaf8f6f0a1c62aea91871b215fe93c.exe" "C:\Program Files (x86)\windowssandbox.exe" && ping 127.0.0.1 -n 18 > nul && "C:\Program Files (x86)\windowssandbox.exe"
2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 18
3⤵
- Runs ping.exe
PID:2660

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 18
3⤵
- Runs ping.exe
PID:2756

C:\Program Files (x86)\windowssandbox.exe
"C:\Program Files (x86)\windowssandbox.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2724

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\windowssandbox.exe
Filesize
524KB

MD5
dabaf8f6f0a1c62aea91871b215fe93c

SHA1
7a1e1d9981e64379b6ad2517f3705180aa45c5c5

SHA256
49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87

SHA512
d509c13f5b28ca1c2d1ec0e57f9d0bb0c31f08ede421f9b57f4a7cb08a782ebf97f4ef0f38e7b36c9747b3f607302a5b5d9ddc8a30d625e7e6f09dc2a5e24c6b

Download Submit
memory/1252-0-0x000000007448E000-0x000000007448F000-memory.dmp

Filesize
4KB

Download
memory/1252-1-0x0000000000280000-0x0000000000308000-memory.dmp

Filesize
544KB

Download
memory/1252-2-0x0000000004170000-0x00000000041B4000-memory.dmp

Filesize
272KB

Download
memory/1252-3-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download
memory/1252-5-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download
memory/2516-29-0x00000000743A0000-0x0000000074495000-memory.dmp

Filesize
980KB

Download
memory/2516-17-0x0000000000CC0000-0x0000000000D48000-memory.dmp

Filesize
544KB

Download
memory/2516-18-0x00000000004A0000-0x00000000004BA000-memory.dmp

Filesize
104KB

Download
memory/2516-19-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/2516-33-0x00000000743A0000-0x0000000074495000-memory.dmp

Filesize
980KB

Download
memory/2516-16-0x00000000743A0000-0x0000000074495000-memory.dmp

Filesize
980KB

Download
memory/2724-22-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2724-24-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2724-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2724-26-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2724-30-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2724-32-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2724-31-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2724-20-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download