quasar | 49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87

Analysis

max time kernel
133s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
Size

524KB
MD5

dabaf8f6f0a1c62aea91871b215fe93c
SHA1

7a1e1d9981e64379b6ad2517f3705180aa45c5c5
SHA256

49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87
SHA512

d509c13f5b28ca1c2d1ec0e57f9d0bb0c31f08ede421f9b57f4a7cb08a782ebf97f4ef0f38e7b36c9747b3f607302a5b5d9ddc8a30d625e7e6f09dc2a5e24c6b
SSDEEP

6144:RswAitwXUqtyzlKJCCzq1GzzjQ6NWiOhODiPw532k1c3u5WM+ix/WJpBvCIvyNVp:RJ4y5KJIMznOTPwtdIYbfSBvqN

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office04

194.26.192.92:4782

xmarvel.ddns.net:4782

Mutex

1D5hAYqKMWDHFxCpFw

Attributes

encryption_key
GqEm1Kfv49pa27CfDSc9
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/4940-24-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar
Drops startup file 1 IoCs

Processes:

49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windowssandbox.lnk 49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
Executes dropped EXE 1 IoCs

Processes:

windowssandbox.exe

pid process

1724 windowssandbox.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

49 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

windowssandbox.exe

description pid process target process

PID 1724 set thread context of 4940 1724 windowssandbox.exe InstallUtil.exe
Drops file in Program Files directory 2 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Program Files (x86)\windowssandbox.exe cmd.exe
File opened for modification C:\Program Files (x86)\windowssandbox.exe cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

4564 PING.EXE
956 PING.EXE

resource	yara_rule
behavioral1/memory/4940-24-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windowssandbox.lnk	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe

pid	process
1724	windowssandbox.exe

flow	ioc
49	ip-api.com

description	pid	process	target process
PID 1724 set thread context of 4940	1724	windowssandbox.exe	InstallUtil.exe

description	ioc	process
File created	C:\Program Files (x86)\windowssandbox.exe	cmd.exe
File opened for modification	C:\Program Files (x86)\windowssandbox.exe	cmd.exe

pid	process
4564	PING.EXE
956	PING.EXE

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exewindowssandbox.exe

pid	process
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
1724	windowssandbox.exe
1724	windowssandbox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exewindowssandbox.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
Token: SeDebugPrivilege	1724	windowssandbox.exe
Token: SeDebugPrivilege	4940	InstallUtil.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.execmd.exewindowssandbox.exe

description	pid	process	target process
PID 1368 wrote to memory of 3864	1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe	cmd.exe
PID 1368 wrote to memory of 3864	1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe	cmd.exe
PID 1368 wrote to memory of 3864	1368	49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe	cmd.exe
PID 3864 wrote to memory of 4564	3864	cmd.exe	PING.EXE
PID 3864 wrote to memory of 4564	3864	cmd.exe	PING.EXE
PID 3864 wrote to memory of 4564	3864	cmd.exe	PING.EXE
PID 3864 wrote to memory of 956	3864	cmd.exe	PING.EXE
PID 3864 wrote to memory of 956	3864	cmd.exe	PING.EXE
PID 3864 wrote to memory of 956	3864	cmd.exe	PING.EXE
PID 3864 wrote to memory of 1724	3864	cmd.exe	windowssandbox.exe
PID 3864 wrote to memory of 1724	3864	cmd.exe	windowssandbox.exe
PID 3864 wrote to memory of 1724	3864	cmd.exe	windowssandbox.exe
PID 1724 wrote to memory of 4940	1724	windowssandbox.exe	InstallUtil.exe
PID 1724 wrote to memory of 4940	1724	windowssandbox.exe	InstallUtil.exe
PID 1724 wrote to memory of 4940	1724	windowssandbox.exe	InstallUtil.exe
PID 1724 wrote to memory of 4940	1724	windowssandbox.exe	InstallUtil.exe
PID 1724 wrote to memory of 4940	1724	windowssandbox.exe	InstallUtil.exe
PID 1724 wrote to memory of 4940	1724	windowssandbox.exe	InstallUtil.exe
PID 1724 wrote to memory of 4940	1724	windowssandbox.exe	InstallUtil.exe
PID 1724 wrote to memory of 4940	1724	windowssandbox.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe
"C:\Users\Admin\AppData\Local\Temp\49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 15 > nul && copy "C:\Users\Admin\AppData\Local\Temp\49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87.exe" "C:\Program Files (x86)\windowssandbox.exe" && ping 127.0.0.1 -n 15 > nul && "C:\Program Files (x86)\windowssandbox.exe"
2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3864

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 15
3⤵
- Runs ping.exe
PID:4564

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 15
3⤵
- Runs ping.exe
PID:956

C:\Program Files (x86)\windowssandbox.exe
"C:\Program Files (x86)\windowssandbox.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4940

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\windowssandbox.exe
Filesize
524KB

MD5
dabaf8f6f0a1c62aea91871b215fe93c

SHA1
7a1e1d9981e64379b6ad2517f3705180aa45c5c5

SHA256
49d3a6363261b6915cf925e115234347ea4d4bb1bfe603a52a58d764eb266f87

SHA512
d509c13f5b28ca1c2d1ec0e57f9d0bb0c31f08ede421f9b57f4a7cb08a782ebf97f4ef0f38e7b36c9747b3f607302a5b5d9ddc8a30d625e7e6f09dc2a5e24c6b

Download Submit
memory/1368-5-0x0000000005D90000-0x0000000005DD4000-memory.dmp

Filesize
272KB

Download
memory/1368-3-0x00000000055F0000-0x000000000568C000-memory.dmp

Filesize
624KB

Download
memory/1368-11-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/1368-4-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/1368-0-0x000000007474E000-0x000000007474F000-memory.dmp

Filesize
4KB

Download
memory/1368-6-0x00000000064F0000-0x0000000006A94000-memory.dmp

Filesize
5.6MB

Download
memory/1368-7-0x0000000005ED0000-0x0000000005EDA000-memory.dmp

Filesize
40KB

Download
memory/1368-9-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/1368-2-0x0000000005540000-0x00000000055D2000-memory.dmp

Filesize
584KB

Download
memory/1368-1-0x0000000000DF0000-0x0000000000E78000-memory.dmp

Filesize
544KB

Download
memory/1724-19-0x0000000074710000-0x0000000074EC0000-memory.dmp

Filesize
7.7MB

Download
memory/1724-18-0x0000000074710000-0x0000000074EC0000-memory.dmp

Filesize
7.7MB

Download
memory/1724-20-0x0000000074710000-0x0000000074EC0000-memory.dmp

Filesize
7.7MB

Download
memory/1724-21-0x00000000073E0000-0x00000000073FA000-memory.dmp

Filesize
104KB

Download
memory/1724-22-0x0000000007430000-0x0000000007436000-memory.dmp

Filesize
24KB

Download
memory/1724-23-0x0000000074710000-0x0000000074EC0000-memory.dmp

Filesize
7.7MB

Download
memory/1724-26-0x0000000074710000-0x0000000074EC0000-memory.dmp

Filesize
7.7MB

Download
memory/1724-17-0x0000000000980000-0x0000000000A08000-memory.dmp

Filesize
544KB

Download
memory/4940-29-0x0000000006820000-0x000000000685C000-memory.dmp

Filesize
240KB

Download
memory/4940-24-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4940-27-0x00000000056C0000-0x0000000005726000-memory.dmp

Filesize
408KB

Download
memory/4940-28-0x00000000063E0000-0x00000000063F2000-memory.dmp

Filesize
72KB

Download