quasar | a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1

General

Target

a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe
Size

1.0MB
MD5

d9ae9f8e6be0c1d7c70a1d1b86f44a8c
SHA1

1564057c68ed04ffe76aa192e867ed40cd868840
SHA256

a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1
SHA512

d13a512177f86e9a3de60c6b525175005870d5c1536f9e2af80da0c881314d3833b7140e777c65950d71053907f4608237f595490372e5e003fc9c3925786e2b

Score

10^/10

quasar venom client spyware trojan

Malware Config

Extracted

Family

quasar

Version

2.8.0.1

Botnet

Venom Client

C2

192.168.0.149:4455

Mutex

PNMCyu2XSzVny0gdTw

Attributes

encryption_key
aPDdCEtQpHs1yTAHJZ1B
install_name
Venom.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory

Signatures

Quasar Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1516-57-0x0000000000400000-0x00000000004EC000-memory.dmp	family_quasar
behavioral1/memory/1516-58-0x00000000004E614E-mapping.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Suspicious use of SetThreadContext 1 IoCs

Processes:

a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe

description	pid	process	target process
PID 1268 set thread context of 1516	1268	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09e66b3b4afd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f45a3407a6eee4cb6062dddd85478a600000000020000000000106600000001000020000000ec0664e3c01478b9ea1c08c26160a7fb1c6bf31087f69670cfdaf4caa448a7f1000000000e8000000002000020000000a34eaf7a594d427504406423a4432087f0fe5dd2a1b987b4bbe9901de8bb2d95200000000e996828884d9ca2fe0969f1bbb5eb9e55e895bac9483c3653d19a2daeb18fe040000000398106ce8939c3568e16789fd95ed611e8a7305a8e9210b865c0139a0f1be6f17fb6a656a91de5acec119c8581b5cac2d4b9eaff078e42fc54d9150c413edf91	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f45a3407a6eee4cb6062dddd85478a6000000000200000000001066000000010000200000008ed4c322b6cb50cd1c53bbbfc354ca42639a001082a17d25993343c3d7e28adc000000000e80000000020000200000005a77c9fc7b1e00c35308c6e0612444a7b2e1924f416d22e119feca4eb5b572f69000000005d2a847c823ec884f26174cb369ca9de93fdc8866ab3c14c80d52315ad28a49eedf5175205657947aed1b76356d0c524a159b9969adfcbd80037845d7707329a72932b876dacffdf0025f8f3e6672bc81f2ee4c8356d3ffc260035c0e4e69d83fcfd8e0d3393257a463d450d43bf738bbae6b23fdf91c30f9e6b1404c64a4984984d3d39f850cd35dfd87c02967e641400000009f98f7dd71e863a07c80aadb4a4450c35c1a42908651d217405980b13d2d4889ccfef51cdb0715cf31de77ee3ea62c90404023faca5b1fe0b737bdb1bc13c2c9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6F343F1-1BA7-11EC-A9D4-4221BC03B1B8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "339081797"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1568 iexplore.exe

pid	process
1568	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exeiexplore.exeIEXPLORE.EXE

pid	process
1268	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe
1568	iexplore.exe
1568	iexplore.exe
584	IEXPLORE.EXE
584	IEXPLORE.EXE
584	IEXPLORE.EXE
584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exea0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exeiexplore.exe

description	pid	process	target process
PID 1268 wrote to memory of 1516	1268	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe
PID 1268 wrote to memory of 1516	1268	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe
PID 1268 wrote to memory of 1516	1268	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe
PID 1268 wrote to memory of 1516	1268	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe
PID 1268 wrote to memory of 1516	1268	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe
PID 1268 wrote to memory of 1516	1268	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe
PID 1268 wrote to memory of 1516	1268	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe
PID 1268 wrote to memory of 1516	1268	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe
PID 1268 wrote to memory of 1516	1268	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe
PID 1516 wrote to memory of 1568	1516	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe	iexplore.exe
PID 1516 wrote to memory of 1568	1516	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe	iexplore.exe
PID 1516 wrote to memory of 1568	1516	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe	iexplore.exe
PID 1516 wrote to memory of 1568	1516	a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe	iexplore.exe
PID 1568 wrote to memory of 584	1568	iexplore.exe	IEXPLORE.EXE
PID 1568 wrote to memory of 584	1568	iexplore.exe	IEXPLORE.EXE
PID 1568 wrote to memory of 584	1568	iexplore.exe	IEXPLORE.EXE
PID 1568 wrote to memory of 584	1568	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe
"C:\Users\Admin\AppData\Local\Temp\a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268

C:\Users\Admin\AppData\Local\Temp\a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe
"C:\Users\Admin\AppData\Local\Temp\a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1568 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:584

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
ab5c36d10261c173c5896f3478cdc6b7

SHA1
87ac53810ad125663519e944bc87ded3979cbee4

SHA256
f8e90fb0557fe49d7702cfb506312ac0b24c97802f9c782696db6d47f434e8e9

SHA512
e83e4eae44e7a9cbcd267dbfc25a7f4f68b50591e3bbe267324b1f813c9220d565b284994ded5f7d2d371d50e1ebfa647176ec8de9716f754c6b5785c6e897fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
a1c6dbe4e849eb1bf7dd46cda733ec3e

SHA1
1948efd344a8b1fdedb06f84ef01a1702c1c732e

SHA256
754ded7e64a14dfc0fdc01c9d92f917b719cad5ffa6f3b7341bef1cb9f4cdb3b

SHA512
2686e2bb247c61c56ac737da6aa41a2df112c4447fde700b26d430fa986e59509dbd81bf6b7d07ebe2d5335d054e8aca026ebb595792ab0be23fac943813fb8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\wkz58mr\imagestore.dat
MD5
83fe8fa4d1605bb9c8f95143d0295502

SHA1
8fc64e2b7f9e856b19906392e6b39835aebde4fe

SHA256
5401bfc4a4f3d9be8562026f3a177bd93ffff74482ec5433cf7ab5f19cef3b73

SHA512
3d3f31f621693e4872b1ad99495f415d84ea8690f76fc6370d7d4f831f744c3b886e75b24a5f4f106a758989bf0718321c5953177ec55ec2f96288dd3e7fcc21

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WD2K4O01.txt
MD5
8987122932702e981a8442cdaf7de8d4

SHA1
97b56f732acc19330827f747b0bde2e936f20051

SHA256
a42d5a1893a1f232354285d87564c8e0080d88ff98b9742417523fb6ad554746

SHA512
ef9737afa4e4635e116593c0992ba6978bbef9fcb1aea44f3877dac5c94bf4cefb35cb59f3005bff491fd420bd45bee52a16c81a576f616636dfb8b2a660ef53

Download Submit
memory/584-61-0x0000000000000000-mapping.dmp

Download
memory/1516-57-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/1516-58-0x00000000004E614E-mapping.dmp

Download
memory/1516-59-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1568-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads