quasar | 77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1

General

Target

77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe
Size

724KB
MD5

e6a103fe244837f1d9b3aef62ac0d29f
SHA1

b14829bd20c77dcf84edea4625d7320897983e20
SHA256

77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1
SHA512

9d04008c4c5fc4994b1f42a6e5e03473e941215ea62f47cae321202f078dd5e3b1ce914549cab090b372e03db62d8399f621695e219f592094e27d7613009bed

Score

10^/10

quasar venomrat office04 rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

0.tcp.ngrok.io:13005

Mutex

VNM_MUTEX_ljpH86m9yQvMdFiQrM

Attributes

encryption_key
7gt3Jirz0rwSn4uB1QfR
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/4952-128-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def

Quasar Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4952-128-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4932 set thread context of 4952	4932	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	79

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe
Token: SeDebugPrivilege	4952	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4952	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4952	4932	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	79
PID 4932 wrote to memory of 4952	4932	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	79
PID 4932 wrote to memory of 4952	4932	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	79
PID 4932 wrote to memory of 4952	4932	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	79
PID 4932 wrote to memory of 4952	4932	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	79
PID 4932 wrote to memory of 4952	4932	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	79
PID 4932 wrote to memory of 4952	4932	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	79
PID 4932 wrote to memory of 4952	4932	77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe	79

C:\Users\Admin\AppData\Local\Temp\77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe
"C:\Users\Admin\AppData\Local\Temp\77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe
  "C:\Users\Admin\AppData\Local\Temp\77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1.exe.log

Filesize
410B

MD5
3bbb825ef1319deb378787046587112b

SHA1
67da95f0031be525b4cf10645632ca34d66b913b

SHA256
d9c6d00fad02f7a9ef0fcddc298ffd58b17020fb12b1336d5733237cbfadb1e0

SHA512
7771ae543e188d544e1bb6c65e0453a6777c1c39790a355f4cce652a815bfaf94dd426de3db910a67bd06e463ac0143d9e2ca44d2b12af7f0d84c27b4a09cc54

Download Submit
memory/4932-124-0x00000000003B0000-0x000000000046E000-memory.dmp

Filesize
760KB

Download
memory/4932-125-0x000000000AA30000-0x000000000AFD4000-memory.dmp

Filesize
5.6MB

Download
memory/4932-126-0x000000000A620000-0x000000000A6B2000-memory.dmp

Filesize
584KB

Download
memory/4952-128-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4952-130-0x0000000005470000-0x00000000054D6000-memory.dmp

Filesize
408KB

Download
memory/4952-131-0x0000000005FF0000-0x0000000006002000-memory.dmp

Filesize
72KB

Download
memory/4952-132-0x0000000006550000-0x000000000658C000-memory.dmp

Filesize
240KB

Download
memory/4952-133-0x00000000068E0000-0x00000000068EA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing