quasar | ef894d940115b4382997954bf79c1c8272b24ee479efc93d1b0b649133a457cb

General

Target

ef894d940115b4382997954bf79c1c8272b24ee479efc93d1b0b649133a457cb.ps1
Size

2.1MB
MD5

f98a96a1061e03b2b06ce6092947351b
SHA1

60fb05ecf864e0c716473876b6bb47605dae047c
SHA256

ef894d940115b4382997954bf79c1c8272b24ee479efc93d1b0b649133a457cb
SHA512

9395ae433da87e28cb6a9d9d16d5d814aa2b39d6d7b568d548c8705f673e001cfd3578e8b729c1c5b7d429049edb6609a502d949627ad28af34ba4065f675220
SSDEEP

6144:DcVzJb1d4aU/hQVBJ2A7Is2Csr1Y5mH9OdHUb3ngoq:O

Score

10^/10

quasar office04 discovery execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

C2

ronymahmoud.casacam.net:4782

seznam.hopto.org:4782

Mutex

QSR_MUTEX_mn85pQSh0eqrA3kPek

Attributes

encryption_key
EjggXOgdqRrj8wGQ7mTy
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4380-35-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1832	powershell.exe
4088	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1832 set thread context of 4380	1832	powershell.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4088	powershell.exe
4088	powershell.exe
1832	powershell.exe
1832	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	4380	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 4184	1120	WScript.exe	92
PID 1120 wrote to memory of 4184	1120	WScript.exe	92
PID 4184 wrote to memory of 1832	4184	cmd.exe	94
PID 4184 wrote to memory of 1832	4184	cmd.exe	94
PID 1832 wrote to memory of 4380	1832	powershell.exe	95
PID 1832 wrote to memory of 4380	1832	powershell.exe	95
PID 1832 wrote to memory of 4380	1832	powershell.exe	95
PID 1832 wrote to memory of 4380	1832	powershell.exe	95
PID 1832 wrote to memory of 4380	1832	powershell.exe	95
PID 1832 wrote to memory of 4380	1832	powershell.exe	95
PID 1832 wrote to memory of 4380	1832	powershell.exe	95
PID 1832 wrote to memory of 4380	1832	powershell.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ef894d940115b4382997954bf79c1c8272b24ee479efc93d1b0b649133a457cb.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Public\roox.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\roox.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\roox.ps1'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
38e01d05f1a3c204a4b66f6503a154b4

SHA1
1f13df998e49ba099b8142117047ca78c7728826

SHA256
098383f853295ab4ca31292fc72f149c4d737544f973232a84f48ba060076610

SHA512
d4cf12cc636128328bca08bfefdb5cbd3d7e3fa0b9ab8de99734a9af67c18224146000e2a5b79ad3fcfbcef27290e93fcd8f9c0979c8dd95e47e123b479cbed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_boz33ywx.zet.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Public\roox.bat

Filesize
189B

MD5
252132ac509819fd013a4f235964aa56

SHA1
c4b9f8acd8aa446c777c3adbc7b79f81bb1df490

SHA256
9018a2f6018b6948fc134490c3fb93c945f10d89652db7d8491a98790d001c1e

SHA512
1927902c952da4490368257545c13b1899c46e9f3b30b99da5b947b0ebde8411639f5e3a53b7e1c62707df6e7fe86d025b5e784b6c66fa103fe22e39df559327

Download Submit
C:\Users\Public\roox.ps1

Filesize
2.1MB

MD5
fa225e2185f1db6b6097273df65e3dc4

SHA1
5638bedfb96a6124cdf726dc051ba7828f6bef0e

SHA256
ac05a1ec83c7c36f77dec929781dd2dae7151e9ce00f0535f67fcdb92c4f81d9

SHA512
b5ea9d4c6ec1043c23196323e0ceb282dbb3ce3f6c4d7880b6061d381089be48bab0c4ad678f0ee88849e94e37973cf94851eba18945551c421babde5c494b99

Download Submit
C:\Users\Public\roox.vbs

Filesize
659B

MD5
d0e4524918bde99e070e852de31893ea

SHA1
ae662b541d2df77df3d3068f7e4fbb60320af469

SHA256
d50cfca93637af25dc6720ebf40d54eec874004776b6bc385d544561748c2ffc

SHA512
07a54d952346cb579e58f5578713bd564a79028b7453c33d4763ed13fbf918432b536d35a7be4a1967ec428e529fe88a9a5ae97ba903da455e6d97f79951e3aa

Download Submit
memory/1832-34-0x000001EAA3BC0000-0x000001EAA3BDA000-memory.dmp

Filesize
104KB

Download
memory/4088-16-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

Filesize
10.8MB

Download
memory/4088-19-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

Filesize
10.8MB

Download
memory/4088-0-0x00007FFE4CDD3000-0x00007FFE4CDD5000-memory.dmp

Filesize
8KB

Download
memory/4088-12-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

Filesize
10.8MB

Download
memory/4088-11-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

Filesize
10.8MB

Download
memory/4088-6-0x000001B6A3610000-0x000001B6A3632000-memory.dmp

Filesize
136KB

Download
memory/4380-35-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4380-37-0x0000000005500000-0x0000000005AA4000-memory.dmp

Filesize
5.6MB

Download
memory/4380-38-0x00000000050B0000-0x0000000005142000-memory.dmp

Filesize
584KB

Download
memory/4380-39-0x0000000005150000-0x00000000051B6000-memory.dmp

Filesize
408KB

Download
memory/4380-40-0x0000000005E60000-0x0000000005E72000-memory.dmp

Filesize
72KB

Download
memory/4380-41-0x00000000062A0000-0x00000000062DC000-memory.dmp

Filesize
240KB

Download
memory/4380-42-0x00000000069E0000-0x00000000069EA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing