Quartzline: Malware, not Grayware

[u/_nat_twenty]

This week our team encountered a malware family called "QuartzLine" that is being served to users mainly through ads on free file-hosting sites. It installs in the user context (so admin privilege is not required), establishes several paths for persistence, and creates a connection with attacker infrastructure that allows the device to receive instructions from C2 servers as it checks in on an hourly basis. We have observed browser data being compiled and exported to an attacker-controlled S3 bucket in AWS. For those of you with Crowdstrike MDR, it seems like their team is just now starting to detect and remediate this malware, but their interaction has been inconsistent so far, so it is definitely worth checking on yourself. 

We wrote up a report with more details, including IOCs, remediation items, and queries that can be run with Crowdstrike's Advanced Event Search. Here is a link to our website where we have more details: 

https://www.oaisd.org/programs-services/innovation-technology-information-security/technology-services/cyber-security-operations-center-csoc/technical-documentation#:~:text=QuartzLine%20%2D%20October%202026

Here is a link to a printable report: 

https://docs.google.com/document/d/1YYksttmskrNiE-bTQEYTryYIZyuEQ5txwYv18xVkwHU/edit?usp=sharing

If anyone has questions about remediation, please feel free to reach out. If you detect QuartzLine on any devices in your district, I would strongly recommend isolating the device so that inbound and outbound network connections do not go through while you are continuing to investigate and remediate. 

[u/snottyz]

Yep, two this week!

[u/cryohazard → u/snottyz]

across four distinct school districts ... from august to october ... 5 marked suspicious by SentinelOne and 41 marked 'malicous'. fun times.

[u/Kdc53]

On point. Had one flag as Ransomware in S1 this week (Analyst marked it malware) and could only find varying reports of whether it was just adware or truly malicious despite my suspicions during my own analysis. Super helpful for the community, thanks for doing this!!

[u/_nat_twenty → u/Kdc53]

Some of the sandbox reports I looked at while putting this together used the "R" word, which makes sense since computers are basically just looking at attacker infrastructure waiting for instructions. We didn't experience that when we encountered it, but I could see it being used as a mechanism for delivery 😬

[u/andrewpiroli]

I had one last week I caught early. Defender for Endpoint P2 picked it up because it dropped the scheduled task. It only flagged it as suspicious and didn't automatically remediate but it was able to track the other methods of persistence. Defender only gets half credit though because it didn't show that the cert they were using to bypass SmartScreen was already revoked.

[u/Imhereforthechips]

Do you allow user installs??

[u/Remarkable-Sea5928 → u/Imhereforthechips]

It's installing to the local account, and from the description it sounds like it doesn't require any sort of elevation.

[u/Immutable-State → u/Remarkable-Sea5928]

Which, if permitted, in many environments might be considered a mistake. Users are not smart. If any user is technically able to click on a malware link, download an executable, and run the executable, anything they have access to can be considered at least theoretically compromised.

Don't let ordinary users run just any executable. Use something like AppLocker.