General
-
Target
R0X-Built.bat
-
Size
326KB
-
Sample
240502-zq16dafc91
-
MD5
d967ead2d930328fe784be4e199cca49
-
SHA1
cfe200ede38b0c10638d181d64ce202c58b01ba1
-
SHA256
fcedeca6396c7c129f169f635085b84a0af4ab5d1043affe837c96640642230a
-
SHA512
b63459d12140f400539b7233cf8854df6f2805f9f09a902df6fe20649b8af27be408ae667b4101444ce5b1848e4b37383a309c4962e55709c2fe11410a47ee71
-
SSDEEP
6144:bx2lEdv93qPAK5WiwSRae50rX3cvmZi8pSOeAxqDpWStZ9qnR:b1dYPmmH5Tm88pnecqDp3AR
Static task
static1
Behavioral task
behavioral1
Sample
R0X-Built.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
R0X-Built.bat
Resource
win10v2004-20240419-en
Malware Config
Extracted
quasar
3.1.5
Slave
even-lemon.gl.at.ply.gg:33587
$Sxr-3vDee7FzoJnhqjuE3n
-
encryption_key
KaNwItdY6wlv5nCN4prL
-
install_name
$srr-powershell.exe
-
log_directory
Logs
-
reconnect_delay
1000
-
startup_key
$srr-powershell
-
subdirectory
Windows
Targets
-
-
Target
R0X-Built.bat
-
Size
326KB
-
MD5
d967ead2d930328fe784be4e199cca49
-
SHA1
cfe200ede38b0c10638d181d64ce202c58b01ba1
-
SHA256
fcedeca6396c7c129f169f635085b84a0af4ab5d1043affe837c96640642230a
-
SHA512
b63459d12140f400539b7233cf8854df6f2805f9f09a902df6fe20649b8af27be408ae667b4101444ce5b1848e4b37383a309c4962e55709c2fe11410a47ee71
-
SSDEEP
6144:bx2lEdv93qPAK5WiwSRae50rX3cvmZi8pSOeAxqDpWStZ9qnR:b1dYPmmH5Tm88pnecqDp3AR
-
Quasar payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Sets service image path in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1