Analysis
-
max time kernel
141s -
max time network
168s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-05-2022 20:03
Static task
static1
Behavioral task
behavioral1
Sample
Rusher Hack/Data/Installer.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Rusher Hack/Data/Installer.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
Rusher Hack/RusherHackInstaller.exe
Resource
win7-20220414-en
General
-
Target
Rusher Hack/Data/Installer.exe
-
Size
683KB
-
MD5
497e3b749e37fa682a0cf5f5ec869296
-
SHA1
b6405eb80e48a075489dae999c3291eff5246112
-
SHA256
288cf51166bb6407c0f13c70a31fefba81ca381bc79dda54af39370ee479d47c
-
SHA512
86d137a1d8dd452c94c42293b2d2c05d3a10c017c2f1f6f18b2ca54c75925fcd0745d5e59e9deb9d533aeaf824a1e727513a2bf852d96c68e2c1f252ce84fd93
Malware Config
Extracted
quasar
2.1.0.0
$77systemtelemtry
192.168.0.44:80
67.61.188.107:80
VNM_MUTEX_OplgS6EDrflEgnBXyU
-
encryption_key
tfNbPwosWP6IOHXzQKKG
-
install_name
windowsrc.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Registry Handler
-
subdirectory
bin
Signatures
-
Contains code to disable Windows Defender 6 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/1864-54-0x00000000002D0000-0x0000000000380000-memory.dmp disable_win_def behavioral1/files/0x00080000000144ad-57.dat disable_win_def behavioral1/files/0x00080000000144ad-59.dat disable_win_def behavioral1/files/0x00080000000144ad-60.dat disable_win_def behavioral1/memory/1948-61-0x0000000000EE0000-0x0000000000F90000-memory.dmp disable_win_def behavioral1/memory/1276-74-0x0000000000830000-0x00000000008E0000-memory.dmp disable_win_def -
Quasar Payload 6 IoCs
resource yara_rule behavioral1/memory/1864-54-0x00000000002D0000-0x0000000000380000-memory.dmp family_quasar behavioral1/files/0x00080000000144ad-57.dat family_quasar behavioral1/files/0x00080000000144ad-59.dat family_quasar behavioral1/files/0x00080000000144ad-60.dat family_quasar behavioral1/memory/1948-61-0x0000000000EE0000-0x0000000000F90000-memory.dmp family_quasar behavioral1/memory/1276-74-0x0000000000830000-0x00000000008E0000-memory.dmp family_quasar -
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata: ET MALWARE Common RAT Connectivity Check Observed
-
suricata: ET MALWARE W32/Quasar 1.3/Venom RAT Connectivity Check 3
suricata: ET MALWARE W32/Quasar 1.3/Venom RAT Connectivity Check 3
-
Executes dropped EXE 1 IoCs
pid Process 1948 windowsrc.exe -
Loads dropped DLL 1 IoCs
pid Process 1864 Installer.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features Installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Installer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Registry Handler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Rusher Hack\\Data\\Installer.exe\"" Installer.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com 5 api.ipify.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 776 schtasks.exe 1964 schtasks.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Installer.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1052 PING.EXE -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1692 powershell.exe 1864 Installer.exe 1864 Installer.exe 1864 Installer.exe 1864 Installer.exe 1864 Installer.exe 1864 Installer.exe 1864 Installer.exe 1276 Installer.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1864 Installer.exe Token: SeDebugPrivilege 1948 windowsrc.exe Token: SeDebugPrivilege 1948 windowsrc.exe Token: SeDebugPrivilege 1692 powershell.exe Token: SeDebugPrivilege 1276 Installer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1948 windowsrc.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 1864 wrote to memory of 776 1864 Installer.exe 28 PID 1864 wrote to memory of 776 1864 Installer.exe 28 PID 1864 wrote to memory of 776 1864 Installer.exe 28 PID 1864 wrote to memory of 776 1864 Installer.exe 28 PID 1864 wrote to memory of 1948 1864 Installer.exe 30 PID 1864 wrote to memory of 1948 1864 Installer.exe 30 PID 1864 wrote to memory of 1948 1864 Installer.exe 30 PID 1864 wrote to memory of 1948 1864 Installer.exe 30 PID 1864 wrote to memory of 1692 1864 Installer.exe 31 PID 1864 wrote to memory of 1692 1864 Installer.exe 31 PID 1864 wrote to memory of 1692 1864 Installer.exe 31 PID 1864 wrote to memory of 1692 1864 Installer.exe 31 PID 1948 wrote to memory of 1964 1948 windowsrc.exe 33 PID 1948 wrote to memory of 1964 1948 windowsrc.exe 33 PID 1948 wrote to memory of 1964 1948 windowsrc.exe 33 PID 1948 wrote to memory of 1964 1948 windowsrc.exe 33 PID 1864 wrote to memory of 1772 1864 Installer.exe 35 PID 1864 wrote to memory of 1772 1864 Installer.exe 35 PID 1864 wrote to memory of 1772 1864 Installer.exe 35 PID 1864 wrote to memory of 1772 1864 Installer.exe 35 PID 1772 wrote to memory of 1288 1772 cmd.exe 37 PID 1772 wrote to memory of 1288 1772 cmd.exe 37 PID 1772 wrote to memory of 1288 1772 cmd.exe 37 PID 1772 wrote to memory of 1288 1772 cmd.exe 37 PID 1864 wrote to memory of 1172 1864 Installer.exe 38 PID 1864 wrote to memory of 1172 1864 Installer.exe 38 PID 1864 wrote to memory of 1172 1864 Installer.exe 38 PID 1864 wrote to memory of 1172 1864 Installer.exe 38 PID 1172 wrote to memory of 1636 1172 cmd.exe 40 PID 1172 wrote to memory of 1636 1172 cmd.exe 40 PID 1172 wrote to memory of 1636 1172 cmd.exe 40 PID 1172 wrote to memory of 1636 1172 cmd.exe 40 PID 1172 wrote to memory of 1052 1172 cmd.exe 41 PID 1172 wrote to memory of 1052 1172 cmd.exe 41 PID 1172 wrote to memory of 1052 1172 cmd.exe 41 PID 1172 wrote to memory of 1052 1172 cmd.exe 41 PID 1172 wrote to memory of 1276 1172 cmd.exe 42 PID 1172 wrote to memory of 1276 1172 cmd.exe 42 PID 1172 wrote to memory of 1276 1172 cmd.exe 42 PID 1172 wrote to memory of 1276 1172 cmd.exe 42 PID 1172 wrote to memory of 1276 1172 cmd.exe 42 PID 1172 wrote to memory of 1276 1172 cmd.exe 42 PID 1172 wrote to memory of 1276 1172 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rusher Hack\Data\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Rusher Hack\Data\Installer.exe"1⤵
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Registry Handler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Rusher Hack\Data\Installer.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:776
-
-
C:\Users\Admin\AppData\Roaming\bin\windowsrc.exe"C:\Users\Admin\AppData\Roaming\bin\windowsrc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Registry Handler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\bin\windowsrc.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:1964
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*3⤵PID:1288
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\MrCL47UO3F2n.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:1636
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
PID:1052
-
-
C:\Users\Admin\AppData\Local\Temp\Rusher Hack\Data\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Rusher Hack\Data\Installer.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
223B
MD54fd88a341b9e54cb66607424a51e68dd
SHA1b9bbaa1f3cbd4aab286f2af14897de55141b8802
SHA256a741b0b727f0a3e53a2a0a9311c331927de4db406090ed62ddcaa105babb3ac0
SHA512e2a7193dba40b51d27403df595c24dc1d144954a9fbd41890425203646fa32318a7b1a459e9670b6f92ae0fbea9e9b8092a4dbdae64da1a5bc754fe31cbc0c81
-
Filesize
683KB
MD5497e3b749e37fa682a0cf5f5ec869296
SHA1b6405eb80e48a075489dae999c3291eff5246112
SHA256288cf51166bb6407c0f13c70a31fefba81ca381bc79dda54af39370ee479d47c
SHA51286d137a1d8dd452c94c42293b2d2c05d3a10c017c2f1f6f18b2ca54c75925fcd0745d5e59e9deb9d533aeaf824a1e727513a2bf852d96c68e2c1f252ce84fd93
-
Filesize
683KB
MD5497e3b749e37fa682a0cf5f5ec869296
SHA1b6405eb80e48a075489dae999c3291eff5246112
SHA256288cf51166bb6407c0f13c70a31fefba81ca381bc79dda54af39370ee479d47c
SHA51286d137a1d8dd452c94c42293b2d2c05d3a10c017c2f1f6f18b2ca54c75925fcd0745d5e59e9deb9d533aeaf824a1e727513a2bf852d96c68e2c1f252ce84fd93
-
Filesize
683KB
MD5497e3b749e37fa682a0cf5f5ec869296
SHA1b6405eb80e48a075489dae999c3291eff5246112
SHA256288cf51166bb6407c0f13c70a31fefba81ca381bc79dda54af39370ee479d47c
SHA51286d137a1d8dd452c94c42293b2d2c05d3a10c017c2f1f6f18b2ca54c75925fcd0745d5e59e9deb9d533aeaf824a1e727513a2bf852d96c68e2c1f252ce84fd93