quasar | 9c8ea131bde14b5038358c608f55b0238e3610ceb8503b32527ae936221e862e

General

Target

9c8ea131bde14b5038358c608f55b0238e3610ceb8503b32527ae936221e862e.exe
Size

725KB
MD5

a7ab1b1d14ae721f0ed0b0b828feb078
SHA1

bcb83a1665a7a1436af50ef13d01e78303f349c0
SHA256

9c8ea131bde14b5038358c608f55b0238e3610ceb8503b32527ae936221e862e
SHA512

0d8e7cf0fe51b9f695debce7a37d721992f88f574095c96152fb15bff6c0ab1b1574495c793cc6a1446031c9c8069d2ff3c3bca7f8acc9e16dcd7168236a4118

Score

10^/10

quasar venomrat mundo rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Mundo

C2

201.111.223.252:6700

Mutex

VNM_MUTEX_KJflzK0oXUK0jjdJ05

Attributes

encryption_key
eSgMT4XlUNEBcxqW7GsH
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 3 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/files/0x000a0000000122d2-62.dat	disable_win_def
behavioral1/files/0x000a0000000122d2-64.dat	disable_win_def
behavioral1/memory/1664-65-0x0000000000FF0000-0x000000000107A000-memory.dmp	disable_win_def

Quasar Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000122d2-62.dat	family_quasar
behavioral1/files/0x000a0000000122d2-64.dat	family_quasar
behavioral1/memory/1664-65-0x0000000000FF0000-0x000000000107A000-memory.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Executes dropped EXE 2 IoCs

pid	Process
1104	NordVPN.exe
1664	Pe.exe

Loads dropped DLL 1 IoCs

pid	Process
956	9c8ea131bde14b5038358c608f55b0238e3610ceb8503b32527ae936221e862e.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
956	9c8ea131bde14b5038358c608f55b0238e3610ceb8503b32527ae936221e862e.exe
956	9c8ea131bde14b5038358c608f55b0238e3610ceb8503b32527ae936221e862e.exe
1104	NordVPN.exe
1104	NordVPN.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	9c8ea131bde14b5038358c608f55b0238e3610ceb8503b32527ae936221e862e.exe
Token: SeDebugPrivilege	1104	NordVPN.exe
Token: SeDebugPrivilege	1664	Pe.exe
Token: SeDebugPrivilege	1664	Pe.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1104	956	9c8ea131bde14b5038358c608f55b0238e3610ceb8503b32527ae936221e862e.exe	28
PID 956 wrote to memory of 1104	956	9c8ea131bde14b5038358c608f55b0238e3610ceb8503b32527ae936221e862e.exe	28
PID 956 wrote to memory of 1104	956	9c8ea131bde14b5038358c608f55b0238e3610ceb8503b32527ae936221e862e.exe	28
PID 1104 wrote to memory of 1664	1104	NordVPN.exe	29
PID 1104 wrote to memory of 1664	1104	NordVPN.exe	29
PID 1104 wrote to memory of 1664	1104	NordVPN.exe	29
PID 1104 wrote to memory of 1664	1104	NordVPN.exe	29

C:\Users\Admin\AppData\Local\Temp\9c8ea131bde14b5038358c608f55b0238e3610ceb8503b32527ae936221e862e.exe
"C:\Users\Admin\AppData\Local\Temp\9c8ea131bde14b5038358c608f55b0238e3610ceb8503b32527ae936221e862e.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\NordVPN.exe
  "C:\Users\Admin\AppData\Local\Temp\NordVPN.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Users\Admin\AppData\Local\Temp\Pe.exe
    "C:\Users\Admin\AppData\Local\Temp\Pe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NordVPN.exe

Filesize
683KB

MD5
d6ff667f9f439f8d9129e1072d44ae25

SHA1
49727eb49e6a5add20e051d46c9b6d3c69386644

SHA256
328757dc3ea4591650f4a238df9873fb9dd64cc4a7a27ef6858458044c5ea337

SHA512
761e9dfae3466cf5f8e0f911da4aa5c5f80bcf9be875a63235000b1a96815b051bc87c06cabe79a7aa5f3efeace0c6370bae06841a2ab9a3cad49581fffe44bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\NordVPN.exe

Filesize
683KB

MD5
d6ff667f9f439f8d9129e1072d44ae25

SHA1
49727eb49e6a5add20e051d46c9b6d3c69386644

SHA256
328757dc3ea4591650f4a238df9873fb9dd64cc4a7a27ef6858458044c5ea337

SHA512
761e9dfae3466cf5f8e0f911da4aa5c5f80bcf9be875a63235000b1a96815b051bc87c06cabe79a7aa5f3efeace0c6370bae06841a2ab9a3cad49581fffe44bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pe.exe

Filesize
526KB

MD5
c2f7ea121023823382bd0db241dc61e8

SHA1
afbe7c9bfe0e4515e022e0342cb8a2541602f675

SHA256
4fa410894274212479e682167d2182e16288a718b6afdf09c1f6620976fceca9

SHA512
6ec7e64a2b4c171161f9f342b5077819fbcd04e0d5ce190f5c3cdf655a7185323d8fb2ae9699d082f1f8e9d648e321b5b25d286c67e7b0b82ee0d88e24866d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pe.exe

Filesize
526KB

MD5
c2f7ea121023823382bd0db241dc61e8

SHA1
afbe7c9bfe0e4515e022e0342cb8a2541602f675

SHA256
4fa410894274212479e682167d2182e16288a718b6afdf09c1f6620976fceca9

SHA512
6ec7e64a2b4c171161f9f342b5077819fbcd04e0d5ce190f5c3cdf655a7185323d8fb2ae9699d082f1f8e9d648e321b5b25d286c67e7b0b82ee0d88e24866d77

Download Submit
\Users\Admin\AppData\Local\Temp\NordVPN.exe

Filesize
683KB

MD5
d6ff667f9f439f8d9129e1072d44ae25

SHA1
49727eb49e6a5add20e051d46c9b6d3c69386644

SHA256
328757dc3ea4591650f4a238df9873fb9dd64cc4a7a27ef6858458044c5ea337

SHA512
761e9dfae3466cf5f8e0f911da4aa5c5f80bcf9be875a63235000b1a96815b051bc87c06cabe79a7aa5f3efeace0c6370bae06841a2ab9a3cad49581fffe44bf

Download Submit
memory/956-54-0x0000000001120000-0x00000000011D8000-memory.dmp

Filesize
736KB

Download
memory/956-60-0x000000001ACF6000-0x000000001AD15000-memory.dmp

Filesize
124KB

Download
memory/1104-59-0x0000000000B50000-0x0000000000BFE000-memory.dmp

Filesize
696KB

Download
memory/1104-63-0x0000000002526000-0x0000000002545000-memory.dmp

Filesize
124KB

Download
memory/1664-65-0x0000000000FF0000-0x000000000107A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing