Windows
Analysis Report
http://dro.pm/ax
Overview
Detection
Quasar
Score: | 100 |
Range: | 0 - 100 |
Confidence: | 100% |
Signatures
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Suricata IDS alerts for network traffic
Yara detected Quasar RAT
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suspicious execution chain found
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Stores files to the Windows start menu directory
Yara signature match
Classification
- System is w10x64_ra
chrome.exe (PID: 6936 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed "about :blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA) chrome.exe (PID: 7160 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2212 --fi eld-trial- handle=200 0,i,386091 3452195160 072,114017 4603240648 8247,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA) chrome.exe (PID: 6500 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= chrome.moj om.UtilRea dIcon --la ng=en-US - -service-s andbox-typ e=icon_rea der --mojo -platform- channel-ha ndle=5508 --field-tr ial-handle =2000,i,38 6091345219 5160072,11 4017460324 06488247,2 62144 --di sable-feat ures=Optim izationGui deModelDow nloading,O ptimizatio nHints,Opt imizationH intsFetchi ng,Optimiz ationTarge tPredictio n /prefetc h:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA) Solara Executor.exe (PID: 6772 cmdline:
"C:\Users\ user\Downl oads\Solar a Executor .exe" MD5: 20F922EB17EFC661C32B9AF7123CC2E3) conhost.exe (PID: 6420 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) powershell.exe (PID: 4860 cmdline:
"powershel l.exe" -Co mmand Add- MpPreferen ce -Exclus ionPath 'C :\mckdvplf ' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) conhost.exe (PID: 3828 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) eyoctxaj.exe (PID: 7860 cmdline:
"C:\mckdvp lf\eyoctxa j.exe" MD5: FBB44DA2D0860AF30FC45116529832DF) schtasks.exe (PID: 7936 cmdline:
"schtasks" /create / tn "svhost 32" /sc ON LOGON /tr "C:\Users\ user\AppDa ta\Roaming \SubDir\Cl ient.exe" /rl HIGHES T /f MD5: 76CD6626DD8834BD4A42E6A565104DC2) conhost.exe (PID: 7944 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) Client.exe (PID: 8004 cmdline:
"C:\Users\ user\AppDa ta\Roaming \SubDir\Cl ient.exe" MD5: FBB44DA2D0860AF30FC45116529832DF) schtasks.exe (PID: 8040 cmdline:
"schtasks" /create / tn "svhost 32" /sc ON LOGON /tr "C:\Users\ user\AppDa ta\Roaming \SubDir\Cl ient.exe" /rl HIGHES T /f MD5: 76CD6626DD8834BD4A42E6A565104DC2) conhost.exe (PID: 8052 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) Solara Executor.exe (PID: 6332 cmdline:
"C:\Users\ user\Downl oads\Solar a Executor .exe" MD5: 20F922EB17EFC661C32B9AF7123CC2E3) conhost.exe (PID: 6092 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) powershell.exe (PID: 7592 cmdline:
"powershel l.exe" -Co mmand Add- MpPreferen ce -Exclus ionPath 'C :\munyxvpa cf' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) conhost.exe (PID: 7600 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) xvxpujwj.exe (PID: 8156 cmdline:
"C:\munyxv pacf\xvxpu jwj.exe" MD5: FBB44DA2D0860AF30FC45116529832DF)
chrome.exe (PID: 4272 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt p://dro.pm /ax" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Quasar RAT, QuasarRAT | Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult. |
{"Version": "1.4.1", "Host:Port": "87.228.57.81:4782;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "47b71fc0-b2c4-4112-b97a-39385a5399c1", "StartupKey": "svhost32", "Tag": "svhost32", "LogDirectoryName": "Logs", "ServerSignature": "SSSXaR44GRb6RYmfFpZjNvvxDEF0KI5jH8nAxi6KcQzCkmdFj4EmiNa7wzIn6QlTh6m9p8r0dvOdGcKp9R7a0feJ+9nftufivecVEcRMW+w9A0X3vAKDbhMDGoJK/oCpkIWanwn5htUKhAJB1lNPjwjIbjG59Xr7nQuXbI0zG8R5zUBqkB7LcDn23y9ViJS55kXsDdCMrrrzn3PsDzs0HTUE4E9W1OuqLpiq9ipYZce25NDQPlIfeAVgyRYzjvec4Uu1mthPaSYUvBiWdDBx5a+gN5tH6ZXROlVMsEMnIJhg/hN/HZVnynGXWaXLgqXtOtfSU5CWH4htKhRkXVbV4yhbXcIXhxL3G2FtXHDDWQjdiYyXKkTx8/z5tnTaobjzjutR8DMWLMg0D/zOKCP0VwSU5Vqn1N5RGbaOinPoUyKL1/3G9eTNYXnl00LzeENlA+hxJ6TyB9hsv85lArDm3jZ5ixI+Bl9M4ajNwTXVY8p+s41nOYrSammq6OgAThh4nd2GWivTLvpgYzJ7NWJM2yWObOFCJlLqdFVlOme65jzZyWtRSYx57sdgOVsNs5/OOJz6jSBSzEq3N0TN/hzpwQ6Tvxj0Xvvwn9DNmHiWLLE13tGYBkJfg+WVKW3m6MINZOm8VZ019XPs+RldMn2Kbu5SMX3WNIN7zvPGpR2mcRw=", "ServerCertificate": "MIIE9jCCAt6gAwIBAgIQAMCIrkV3lAMp6Vz+9SYptTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFQaGFudG9tIFNlcnZlciBDQTAgFw0yNTAxMjQxNzU0MjFaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRUGhhbnRvbSBTZXJ2ZXIgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCLqDcacB918PiS52/zK8NuYRFBjeeZXbEfkolana8gflQhGUIyaXW73olgd952Z18rz4CBCX2jb1f+vqHqWwbwIiVt+Ek8urXFgrOXR2CMqV/HE3QRvviIPkrLKGUsAOue2cN0CRvgEnhMpw80CsO2ZJLCoD3NHsLp+1kY7HQalZeCDuyF9F/1zoRogBQ+yYyNDshY/FTdxRak/6a2WjSD0FJpHkMNKTvCYxi2AIILH57Cyz5dr6pD/s4T+2TiiBK2SlOqm2IQ7zkcfI5rRyie1Q4UwUK1Q7+AXni7Al7XYNH5n5sHGylOW55Sf1uX8rhD7dt/rVxv4IroQeXh0ULwnZkTzHxpjLUclv7FjqSSBegcF98uGdqJzZQDHzwUPEMqJvQ4ikZBKRZtDhReWYAZoobYHxrhAv471L6Ik7hWs8VE+DFifQu2WuV11N37JQR29uwCNMyRBGEmM02YHy36zxs8cjolbQO1HaNfAKfevaezg8czVT7XAgI72i27By9HfruniOU2xjpa1ZlHKGEi7GrYSplhZcflqbYrYdEy15VQ382yt3zkJo7DYkvGIhL2D4tt176o2yF7bm/EaLn8ID5qexn2oubC5o8HCe+KtnkfS4ARLmdpJg4U6pcZUbEbd7enqJ6LAUTJ7Gi3+NFXtPRm0lT5PRYemLHIcNaNjQIDAQABozIwMDAdBgNVHQ4EFgQUkztLutpnSBqQonmJDkIlJzumy2AwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAPw0vebSaYmKRfSaRE1e2YgOVyx+WZgXuPUUY7YjGpwYNRkjgtPNgsMtZDS3jXhhXBsyKsKGDcnS51Gz5c9wV4YxjoZRzXnIom0Ia1WXfifdugNvIRkKgNS3kn0SfHUjgjktUtZxAfUqiGJn2QipIDB5b+tEBG5J9PYWmNC+3205Z5cl9Ti9KgXN3FKf+/slRaE3ACPJlTdRIg3S5u7uFIKtEUkSE1WuhQi6Lyms2a0rILI3e53o+YmpSys1YOafIDUP8UboM9ktsJY4V3zcFheChn15IE+a8LJYcRAIsJbjPCw2Jo/z6R3+XY/U7nFyS5tU9oIjtDpndOOErtnVgiMeGNPmkEY3SvkEYjS8TXovcSJa00nj+yHapZxrzn9MYFYyP1lIlmhnnU+RnY5jhQVlnhccExAAb7BKXnuVI2EraVaz9wxHEUnD/3kzJj7gSvd1Ja/cqzjUb56fU4volehkDVt+XD+udV3KndKDCCwx0JEo4d/u+PHA9Q14Lw13dNWGL4zS7vqOzHYPGkeONKbq3RusCL6rzq7VcCQtg7CrB/cfuBx3cWGbM58uuLIQwoYmHrWqZo9UA7FNsodRUz+bwVokS90KzHSORD1bTc7VfotLt0P95UTm58zfgHd7CCqbjCNdaVU6JisRdkRwKr/r79j9z306SIvr1Qs6bRZw="}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Quasar | Yara detected Quasar RAT | Joe Security | ||
JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
MAL_QuasarRAT_May19_1 | Detects QuasarRAT malware | Florian Roth |
| |
INDICATOR_SUSPICIOUS_GENInfoStealer | Detects executables containing common artifcats observed in infostealers | ditekSHen |
| |
MALWARE_Win_QuasarStealer | Detects Quasar infostealer | ditekshen |
| |
Click to see the 10 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Quasar | Yara detected Quasar RAT | Joe Security | ||
JoeSecurity_Quasar | Yara detected Quasar RAT | Joe Security | ||
JoeSecurity_Quasar | Yara detected Quasar RAT | Joe Security | ||
JoeSecurity_Quasar | Yara detected Quasar RAT | Joe Security | ||
JoeSecurity_Quasar | Yara detected Quasar RAT | Joe Security | ||
Click to see the 5 entries |
System Summary |
---|
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-02-05T22:29:31.367233+0100 | 2035595 | 1 | Domain Observed Used for C2 Detected | 87.228.57.81 | 4782 | 192.168.2.17 | 49721 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: |
Source: | Malware Configuration Extractor: |