Alex Morgan — Threat Intelligence Analyst
Key Takeaways
- Malicious emails leveraging social engineering were used to gain initial access to the victim’s environment.
- The Quasar RAT was identified as the primary malicious payload acting as a remote access tool for the threat actor.
- Indicators of compromise (IoCs) linked to the C2 infrastructure were detailed, showcasing the actor’s operational security measures.
Executive Summary
During our investigation into a recent incident involving the deployment of a Remote Access Trojan (RAT) known as Quasar, we observed a sophisticated attack chain initiated through a targeted email campaign. This incident resulted in unauthorized access to sensitive organizational data, highlighting the importance of robust email filtering and user training.
Initial Access
The attack commenced with a phishing email crafted to look like an official communication from a trusted source within the victim’s industry. The email contained a malicious attachment disguised as a legitimate document. Upon execution, this attachment triggered a PowerShell command that downloaded the Quasar RAT from an external server. The initial command delivered was executed through a base64-decoded payload, making it difficult to detect at first glance.
Execution & Persistence
Once the Quasar RAT was installed, it established persistence by creating an entry in the Windows Registry. The specific path used was HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and the value was set to launch the malware at user login. This allowed the actor to maintain access even after the initial infection vector had been cleared.
Command and Control
Our analysis revealed that the Quasar RAT communicated with its command and control (C2) infrastructure over HTTP on port 8080, utilizing a dynamic IP address that changed regularly to evade detection. The initial beaconing was observed within minutes of infection, indicating a rushed attempt to establish a stable connection. The C2 server employed a simple yet effective encryption method for its communications, which added an additional layer of complexity for network monitoring.
Lateral Movement & Discovery
Following successful installation and C2 connection, the actor leveraged both T1075 – Pass the Hash and T1086 – PowerShell techniques to facilitate lateral movement across the network. They utilized PowerShell to enumerate user login sessions and identify other vulnerable machines on the network. Some key commands noted during the investigation included Get-WmiObject -Class Win32_NetworkConnection, which allowed them to gather information about active sessions on connected devices.
Impact & Objectives
The primary objective appeared to be data exfiltration, with targeted files being compressed and prepared for transmission back to the compromised C2 server. The threat actor demonstrated planning and sophistication, suggesting an intent to harvest sensitive business information. Our investigation also highlighted additional payloads that were prepared for deployment on secondary systems, suggesting a multi-faceted approach to the attack.
MITRE ATT&CK Mapping
- T1566 – Phishing: Initial access through phishing email with a malicious attachment.
- T1203 – Exploitation for Client Execution: Utilization of an exploited attachment to execute the Quasar RAT.
- T1047 – Windows Management Instrumentation: Use of PowerShell to execute commands and gather information for lateral movement.
Detection Opportunities
- Implementing email security solutions that scan attachments and employ behavior-based detection on potentially malicious payloads.
- Monitoring for unusual registry modifications that could indicate the persistence mechanisms employed by the Quasar RAT.
- Using network monitoring tools to identify abnormal outbound HTTP traffic patterns, especially on non-standard ports like 8080.
Analyst Notes
This incident underscores the importance of not only technical controls but also user awareness in preventing phishing attacks. Regular updates to email filtering rules and training sessions for employees can help mitigate risks associated with social engineering tactics. Furthermore, our findings suggest a need for an enhanced focus on monitoring tools that can quickly detect unusual registry changes and lateral movement activities.
Source: Original Report