quasar | 77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1

General

Target

77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe
Size

724KB
MD5

e6a103fe244837f1d9b3aef62ac0d29f
SHA1

b14829bd20c77dcf84edea4625d7320897983e20
SHA256

77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1
SHA512

9d04008c4c5fc4994b1f42a6e5e03473e941215ea62f47cae321202f078dd5e3b1ce914549cab090b372e03db62d8399f621695e219f592094e27d7613009bed

Score

10^/10

quasar venomrat office04 rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

0.tcp.ngrok.io:13005

Mutex

VNM_MUTEX_ljpH86m9yQvMdFiQrM

Attributes

encryption_key
7gt3Jirz0rwSn4uB1QfR
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 6 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/284-63-0x0000000000486C6E-mapping.dmp	disable_win_def
behavioral1/memory/284-67-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/284-65-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/284-62-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/284-61-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/284-60-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def

Quasar Payload 6 IoCs

resource	yara_rule
behavioral1/memory/284-63-0x0000000000486C6E-mapping.dmp	family_quasar
behavioral1/memory/284-67-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/284-65-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/284-62-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/284-61-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/284-60-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 284	900	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	28

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	284	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe
Token: SeDebugPrivilege	284	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
284	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 284	900	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	28
PID 900 wrote to memory of 284	900	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	28
PID 900 wrote to memory of 284	900	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	28
PID 900 wrote to memory of 284	900	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	28
PID 900 wrote to memory of 284	900	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	28
PID 900 wrote to memory of 284	900	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	28
PID 900 wrote to memory of 284	900	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	28
PID 900 wrote to memory of 284	900	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	28
PID 900 wrote to memory of 284	900	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	28

C:\Users\Admin\AppData\Local\Temp\77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe
"C:\Users\Admin\AppData\Local\Temp\77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Temp\77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe
  "C:\Users\Admin\AppData\Local\Temp\77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/284-67-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/284-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/284-62-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/284-61-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/284-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/284-58-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/284-57-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/900-54-0x0000000001140000-0x00000000011FE000-memory.dmp

Filesize
760KB

Download
memory/900-55-0x00000000001F0000-0x00000000001F6000-memory.dmp

Filesize
24KB

Download
memory/900-56-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing