quasar | 671d1bd3c3281935daaf31d5f9265b019509371442c2e8eba4f3626dec2418fe

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
STIMenu/Main/Extra/RunMenu.bat
Size 2KB
Sample240813-xt4dsswbnk
SHA256 4354441c02f160e9442b272c2a7f8c113201754d8287dc7e2419a5fc22fe954b
MD5 7f9c24b3b5e0bcbd87981985b8c08823
SHA1 c8196caab3579c495126799801f61992dfa619a6
SHA512 f2b04367bffd9d6ff08d87b56c78292177e191593b82cd7992421476f05b1c224cdb21846fce74d8a708f2488ca97e92f545f1f970b70a7013d7d23c7216598c
MD5 SHA1 SHA512

Score

10^/10

quasar desktop defense_evasion execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Desktop

minecraftdayzserver.ddns.net:2400

Mutex

75424b76-6e02-429f-933a-8f0c46b80ea3

Attributes

encryption_key
BAB780866E59DF462CB03FA8A8ABD639E9524897
install_name
WinRar.exe
log_directory
Logs
reconnect_delay
3000
startup_key
WinRar.exe
subdirectory
temp

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023488-5536.dat	family_quasar
behavioral2/memory/4348-5538-0x0000000000920000-0x0000000000C44000-memory.dmp	family_quasar

Blocklisted process makes network request 1 IoCs

flow	pid	Process
23	1092	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1092	powershell.exe
4956	powershell.exe
4464	powershell.exe
1404	powershell.exe
1804	powershell.exe
1512	powershell.exe
2316	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4348	fwky1wyq1u.exe
5016	WinRar.exe

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4140	certutil.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
22	raw.githubusercontent.com
23	raw.githubusercontent.com

Delays execution with timeout.exe 11 IoCs

evasion

pid	Process
5016	timeout.exe
1476	timeout.exe
4572	timeout.exe
3708	timeout.exe
3148	timeout.exe
2180	timeout.exe
4956	timeout.exe
436	timeout.exe
1596	timeout.exe
1608	timeout.exe
4416	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3708	schtasks.exe
4040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4956	powershell.exe
4956	powershell.exe
4464	powershell.exe
4464	powershell.exe
1404	powershell.exe
1404	powershell.exe
1804	powershell.exe
1804	powershell.exe
1512	powershell.exe
1512	powershell.exe
2316	powershell.exe
2316	powershell.exe
1092	powershell.exe
1092	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	4348	fwky1wyq1u.exe
Token: SeDebugPrivilege	5016	WinRar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5016	WinRar.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 4844	2988	cmd.exe	86
PID 2988 wrote to memory of 4844	2988	cmd.exe	86
PID 2988 wrote to memory of 4956	2988	cmd.exe	87
PID 2988 wrote to memory of 4956	2988	cmd.exe	87
PID 2988 wrote to memory of 4464	2988	cmd.exe	90
PID 2988 wrote to memory of 4464	2988	cmd.exe	90
PID 2988 wrote to memory of 1404	2988	cmd.exe	91
PID 2988 wrote to memory of 1404	2988	cmd.exe	91
PID 2988 wrote to memory of 1804	2988	cmd.exe	92
PID 2988 wrote to memory of 1804	2988	cmd.exe	92
PID 2988 wrote to memory of 1512	2988	cmd.exe	93
PID 2988 wrote to memory of 1512	2988	cmd.exe	93
PID 2988 wrote to memory of 2316	2988	cmd.exe	94
PID 2988 wrote to memory of 2316	2988	cmd.exe	94
PID 2988 wrote to memory of 4572	2988	cmd.exe	95
PID 2988 wrote to memory of 4572	2988	cmd.exe	95
PID 2988 wrote to memory of 1092	2988	cmd.exe	96
PID 2988 wrote to memory of 1092	2988	cmd.exe	96
PID 2988 wrote to memory of 5016	2988	cmd.exe	105
PID 2988 wrote to memory of 5016	2988	cmd.exe	105
PID 2988 wrote to memory of 3708	2988	cmd.exe	106
PID 2988 wrote to memory of 3708	2988	cmd.exe	106
PID 2988 wrote to memory of 3148	2988	cmd.exe	107
PID 2988 wrote to memory of 3148	2988	cmd.exe	107
PID 2988 wrote to memory of 1476	2988	cmd.exe	108
PID 2988 wrote to memory of 1476	2988	cmd.exe	108
PID 2988 wrote to memory of 2180	2988	cmd.exe	109
PID 2988 wrote to memory of 2180	2988	cmd.exe	109
PID 2988 wrote to memory of 4956	2988	cmd.exe	110
PID 2988 wrote to memory of 4956	2988	cmd.exe	110
PID 2988 wrote to memory of 436	2988	cmd.exe	111
PID 2988 wrote to memory of 436	2988	cmd.exe	111
PID 2988 wrote to memory of 1596	2988	cmd.exe	113
PID 2988 wrote to memory of 1596	2988	cmd.exe	113
PID 2988 wrote to memory of 1608	2988	cmd.exe	115
PID 2988 wrote to memory of 1608	2988	cmd.exe	115
PID 2988 wrote to memory of 4416	2988	cmd.exe	116
PID 2988 wrote to memory of 4416	2988	cmd.exe	116
PID 2988 wrote to memory of 4140	2988	cmd.exe	118
PID 2988 wrote to memory of 4140	2988	cmd.exe	118
PID 2988 wrote to memory of 4348	2988	cmd.exe	119
PID 2988 wrote to memory of 4348	2988	cmd.exe	119
PID 4348 wrote to memory of 4040	4348	fwky1wyq1u.exe	120
PID 4348 wrote to memory of 4040	4348	fwky1wyq1u.exe	120
PID 4348 wrote to memory of 5016	4348	fwky1wyq1u.exe	122
PID 4348 wrote to memory of 5016	4348	fwky1wyq1u.exe	122
PID 5016 wrote to memory of 3708	5016	WinRar.exe	123
PID 5016 wrote to memory of 3708	5016	WinRar.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\STIMenu\Main\Extra\RunMenu.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:4844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:USERPROFILE\AppData\Roaming\Temp
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:USERPROFILE\Temp\fwky1wyq1u.exe
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:USERPROFILE\Appdata\Local\Temp
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:USERPROFILE\Downloads
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:USERPROFILE\Desktop
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:USERPROFILE\Temp
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:4572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle hidden -executionpolicy bypass -File .\Updater.ps1
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1092
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:5016
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:3708
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:3148
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:1476
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:2180
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:4956
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:436
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:1596
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:1608
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:4416
- C:\Windows\system32\certutil.exe
  certutil -decode C:\Users\Admin\AppData\Local\Temp\fwky1wyq1u.txt C:\Users\Admin\AppData\Local\Temp\fwky1wyq1u.exe
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:4140
- C:\Users\Admin\AppData\Local\Temp\fwky1wyq1u.exe
  C:\Users\Admin\AppData\Local\Temp\fwky1wyq1u.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "WinRar.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\temp\WinRar.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4040
- - C:\Users\Admin\AppData\Roaming\temp\WinRar.exe
    "C:\Users\Admin\AppData\Roaming\temp\WinRar.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WinRar.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\temp\WinRar.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

STILauncher.bat

Path C:\Users\Admin\AppData\Local\Temp\STIMenu\Main\Extra\STILauncher.bat
Size 4.3MB
SHA256 266e5bf832ba811ff6d300a9dbcf34808588a09b43277b9fb7c80b7c67d6d411
MD5 dcc48e77bd22e5aa6d4426e90eedeca3
SHA1 911b2094237c23a7265121846776716b15051177
SHA512 1359c1df552406f419f5ab04d61367485de0df5e8608e971b972990fc872a4727eb1d818af52488eca7ba3b9f389421341c0063bdbb9a0f735b72e987ba2debe
SSDEEP 24576:llop69DxAjhXyuIMhr+pToqYdkJrZNc8s7FvJFx1atLG9ysrUQy+pPJ3psFeBuOp:aYuIHQeqH1ywFGgh3ITi
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_0icgbbgw.yna.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0icgbbgw.yna.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

fwky1wyq1u.exe

Path C:\Users\Admin\AppData\Local\Temp\fwky1wyq1u.exe
Size 3.1MB
SHA256 5caf0e2b0689aa607e8c3af5a144474ff5c24d040acdd3a00d41f9172441d9e1
MD5 c849861ac4949d50be5c91bfb0bd7a9f
SHA1 64c4af5d4ec4e8d8632ce7fa07dffd423ca9da83
SHA512 187423fb773b5f26c0a5678b4bb8ea88d91893097b6d2a51e31a689e1f02014416300c90ea5a104c2997042b49a8032b6d30361a4412571cf0513ee005420bed
SSDEEP 49152:QvpI22SsaNYfdPBldt698dBcjHQzENrFfvJEfoGd2pTHHB72eh2NT:QvK22SsaNYfdPBldt6+dBcjHJFwm
MD5 SHA1 SHA512 SSDEEP

Submit Download

fwky1wyq1u.txt

Path C:\Users\Admin\AppData\Local\Temp\fwky1wyq1u.txt
Size 4.2MB
SHA256 11c0d0ce948b03b6d3eef0321977220aaee51f012ba79fd2d65795c97e60fd3e
MD5 c8f98672cfe471af934d8f69178a1663
SHA1 9b4e6584e09db8ee6f5f3f9cf233dd2fef9e8288
SHA512 d422c477b3cb2ac81c73f116b49a0d3b52c18c592ca877a365b1a4e64f0cddc04e0c336fcb63fd3392c632a8789f9fc506d7f33ed7f482bc627846dcf82fc724
SSDEEP 24576:51Oz69bVW1vhyW8MTtihZW48dKZ3HBG6GZdBnJPJIjh0Xsi3C2uIHZ3TFwdUB2M9:WoW8bYGO7Xy8pQu5J2Js
MD5 SHA1 SHA512 SSDEEP

Submit Download

fwky1wyq1u.txt

Path C:\Users\Admin\AppData\Local\Temp\fwky1wyq1u.txt
Size 142KB
SHA256 1a5de53ac7bb3a2fa2527ef4303f9dc2e013ca83da050481f2f9885f4b7be0cf
MD5 4b2ad65dfb839d2d5b84522258c09105
SHA1 99eff92c005a4ee1eb62196a59f207b89da9d4ab
SHA512 5820a330e6e65b9b3e1f304dd91c35a20d27752e931b5b67547170fe64fb54b6ac4d3259655401e2bd68b48f2626964ebdb0eb388dfbca6d6df33ad93a61616a
SSDEEP 3072:zdFxwBz4Jd9HFimMenzetiYV0f0zMRb88Ha:zdLwBz4xF9MenzetiYVU0zMRo8Ha
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4348-5538-0x0000000000920000-0x0000000000C44000-memory.dmp

Download

memory/4464-29-0x00007FF999280000-0x00007FF999D41000-memory.dmp

Download

memory/4464-31-0x00007FF999280000-0x00007FF999D41000-memory.dmp

Download

memory/4464-28-0x00007FF999280000-0x00007FF999D41000-memory.dmp

Download

memory/4464-17-0x00007FF999280000-0x00007FF999D41000-memory.dmp

Download

memory/4956-0-0x00007FF999283000-0x00007FF999285000-memory.dmp

Download

memory/4956-15-0x00007FF999280000-0x00007FF999D41000-memory.dmp

Download

memory/4956-12-0x00007FF999280000-0x00007FF999D41000-memory.dmp

Download

memory/4956-11-0x00007FF999280000-0x00007FF999D41000-memory.dmp

Download

memory/4956-6-0x0000016363D20000-0x0000016363D42000-memory.dmp

Download

memory/5016-5545-0x000000001C5A0000-0x000000001C5F0000-memory.dmp

Download

memory/5016-5546-0x000000001C6B0000-0x000000001C762000-memory.dmp

Download