Analysis

  • max time kernel
    141s
  • max time network
    168s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    03-05-2022 20:03

General

  • Target

    Rusher Hack/Data/Installer.exe

  • Size

    683KB

  • MD5

    497e3b749e37fa682a0cf5f5ec869296

  • SHA1

    b6405eb80e48a075489dae999c3291eff5246112

  • SHA256

    288cf51166bb6407c0f13c70a31fefba81ca381bc79dda54af39370ee479d47c

  • SHA512

    86d137a1d8dd452c94c42293b2d2c05d3a10c017c2f1f6f18b2ca54c75925fcd0745d5e59e9deb9d533aeaf824a1e727513a2bf852d96c68e2c1f252ce84fd93

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

$77systemtelemtry

C2

192.168.0.44:80

67.61.188.107:80

Mutex

VNM_MUTEX_OplgS6EDrflEgnBXyU

Attributes
  • encryption_key

    tfNbPwosWP6IOHXzQKKG

  • install_name

    windowsrc.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Registry Handler

  • subdirectory

    bin

Signatures

  • Contains code to disable Windows Defender 6 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Quasar Payload 6 IoCs
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

  • suricata: ET MALWARE Common RAT Connectivity Check Observed

    suricata: ET MALWARE Common RAT Connectivity Check Observed

  • suricata: ET MALWARE W32/Quasar 1.3/Venom RAT Connectivity Check 3

    suricata: ET MALWARE W32/Quasar 1.3/Venom RAT Connectivity Check 3

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Rusher Hack\Data\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Rusher Hack\Data\Installer.exe"
    1⤵
    • Loads dropped DLL
    • Windows security modification
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Windows Registry Handler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Rusher Hack\Data\Installer.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:776
    • C:\Users\Admin\AppData\Roaming\bin\windowsrc.exe
      "C:\Users\Admin\AppData\Roaming\bin\windowsrc.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "Windows Registry Handler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\bin\windowsrc.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:1964
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1692
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1772
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
        3⤵
          PID:1288
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\MrCL47UO3F2n.bat" "
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1172
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          3⤵
            PID:1636
          • C:\Windows\SysWOW64\PING.EXE
            ping -n 10 localhost
            3⤵
            • Runs ping.exe
            PID:1052
          • C:\Users\Admin\AppData\Local\Temp\Rusher Hack\Data\Installer.exe
            "C:\Users\Admin\AppData\Local\Temp\Rusher Hack\Data\Installer.exe"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1276

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\MrCL47UO3F2n.bat

        Filesize

        223B

        MD5

        4fd88a341b9e54cb66607424a51e68dd

        SHA1

        b9bbaa1f3cbd4aab286f2af14897de55141b8802

        SHA256

        a741b0b727f0a3e53a2a0a9311c331927de4db406090ed62ddcaa105babb3ac0

        SHA512

        e2a7193dba40b51d27403df595c24dc1d144954a9fbd41890425203646fa32318a7b1a459e9670b6f92ae0fbea9e9b8092a4dbdae64da1a5bc754fe31cbc0c81

      • C:\Users\Admin\AppData\Roaming\bin\windowsrc.exe

        Filesize

        683KB

        MD5

        497e3b749e37fa682a0cf5f5ec869296

        SHA1

        b6405eb80e48a075489dae999c3291eff5246112

        SHA256

        288cf51166bb6407c0f13c70a31fefba81ca381bc79dda54af39370ee479d47c

        SHA512

        86d137a1d8dd452c94c42293b2d2c05d3a10c017c2f1f6f18b2ca54c75925fcd0745d5e59e9deb9d533aeaf824a1e727513a2bf852d96c68e2c1f252ce84fd93

      • C:\Users\Admin\AppData\Roaming\bin\windowsrc.exe

        Filesize

        683KB

        MD5

        497e3b749e37fa682a0cf5f5ec869296

        SHA1

        b6405eb80e48a075489dae999c3291eff5246112

        SHA256

        288cf51166bb6407c0f13c70a31fefba81ca381bc79dda54af39370ee479d47c

        SHA512

        86d137a1d8dd452c94c42293b2d2c05d3a10c017c2f1f6f18b2ca54c75925fcd0745d5e59e9deb9d533aeaf824a1e727513a2bf852d96c68e2c1f252ce84fd93

      • \Users\Admin\AppData\Roaming\bin\windowsrc.exe

        Filesize

        683KB

        MD5

        497e3b749e37fa682a0cf5f5ec869296

        SHA1

        b6405eb80e48a075489dae999c3291eff5246112

        SHA256

        288cf51166bb6407c0f13c70a31fefba81ca381bc79dda54af39370ee479d47c

        SHA512

        86d137a1d8dd452c94c42293b2d2c05d3a10c017c2f1f6f18b2ca54c75925fcd0745d5e59e9deb9d533aeaf824a1e727513a2bf852d96c68e2c1f252ce84fd93

      • memory/1276-74-0x0000000000830000-0x00000000008E0000-memory.dmp

        Filesize

        704KB

      • memory/1692-66-0x000000006E740000-0x000000006ECEB000-memory.dmp

        Filesize

        5.7MB

      • memory/1864-54-0x00000000002D0000-0x0000000000380000-memory.dmp

        Filesize

        704KB

      • memory/1864-55-0x0000000075A61000-0x0000000075A63000-memory.dmp

        Filesize

        8KB

      • memory/1948-61-0x0000000000EE0000-0x0000000000F90000-memory.dmp

        Filesize

        704KB