quasar | e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215

Analysis

max time kernel
151s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
11-05-2022 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
Size

488KB
MD5

0f9120aa260daa1849a56062f8b6a492
SHA1

a56e35f6cc5424936a56827d307253c56a937a0e
SHA256

e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215
SHA512

ae52b328521f6a550951ac0c53745034f985230dcd850d0881079d1a2f50b865c30e646271dd4230f3d07db34bf6515b434bcf0f085f8e703533ae14180f81dc

Score

10^/10

quasar venomrat office04 rat rootkit spyware stealer suricata trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
install_name
log_directory
reconnect_delay
3000
startup_key
subdirectory

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

193.161.193.99:25334

Mutex

VNM_MUTEX_3gEHJWUppmmJSCirO4

Attributes

encryption_key
WrqRQZrwZ1NbyFhWiYhM
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 7 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/memory/2320-132-0x0000000000400000-0x00000000004A9000-memory.dmp	disable_win_def
behavioral2/memory/2320-130-0x0000000000400000-0x00000000004A9000-memory.dmp	disable_win_def
behavioral2/memory/2320-134-0x0000000000400000-0x00000000004A9000-memory.dmp	disable_win_def
behavioral2/memory/2320-135-0x0000000000400000-0x00000000004A9000-memory.dmp	disable_win_def
behavioral2/files/0x00070000000231b9-145.dat	disable_win_def
behavioral2/files/0x00070000000231b9-146.dat	disable_win_def
behavioral2/memory/4500-147-0x00000000009F0000-0x0000000000A7C000-memory.dmp	disable_win_def

Quasar Payload 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2320-132-0x0000000000400000-0x00000000004A9000-memory.dmp	family_quasar
behavioral2/memory/2320-130-0x0000000000400000-0x00000000004A9000-memory.dmp	family_quasar
behavioral2/memory/2320-134-0x0000000000400000-0x00000000004A9000-memory.dmp	family_quasar
behavioral2/memory/2320-135-0x0000000000400000-0x00000000004A9000-memory.dmp	family_quasar
behavioral2/files/0x00070000000231b9-145.dat	family_quasar
behavioral2/files/0x00070000000231b9-146.dat	family_quasar
behavioral2/memory/4500-147-0x00000000009F0000-0x0000000000A7C000-memory.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat
suricata: ET MALWARE W32/Quasar 1.3/Venom RAT Connectivity Check 3
suricata: ET MALWARE W32/Quasar 1.3/Venom RAT Connectivity Check 3
suricata

Executes dropped EXE 1 IoCs

Processes:

ge5qupjk.exe

pid	Process
4500	ge5qupjk.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
35	ip-api.com
40	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe

pid	Process
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

Processes:

taskkill.exe

pid	Process
2192	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe

pid	Process
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exetaskkill.exege5qupjk.exe

description	pid	Process
Token: SeDebugPrivilege	2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
Token: SeDebugPrivilege	2192	taskkill.exe
Token: SeDebugPrivilege	4500	ge5qupjk.exe
Token: SeDebugPrivilege	4500	ge5qupjk.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe

pid	Process
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exeDllHost.execmd.exe

description	pid	Process	procid_target
PID 2320 wrote to memory of 3420	2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe	81
PID 2320 wrote to memory of 3420	2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe	81
PID 2320 wrote to memory of 3420	2320	e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe	81
PID 4160 wrote to memory of 5104	4160	DllHost.exe	83
PID 4160 wrote to memory of 5104	4160	DllHost.exe	83
PID 4160 wrote to memory of 5104	4160	DllHost.exe	83
PID 5104 wrote to memory of 4500	5104	cmd.exe	85
PID 5104 wrote to memory of 4500	5104	cmd.exe	85
PID 5104 wrote to memory of 4500	5104	cmd.exe	85
PID 4160 wrote to memory of 2192	4160	DllHost.exe	86
PID 4160 wrote to memory of 2192	4160	DllHost.exe	86
PID 4160 wrote to memory of 2192	4160	DllHost.exe	86

C:\Users\Admin\AppData\Local\Temp\e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe
"C:\Users\Admin\AppData\Local\Temp\e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- \??\c:\windows\SysWOW64\cmstp.exe
  "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\oabovbw2.inf
  2⤵
  PID:3420

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start C:\Windows\temp\ge5qupjk.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\temp\ge5qupjk.exe
    C:\Windows\temp\ge5qupjk.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4500
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\ge5qupjk.exe

Filesize
534KB

MD5
f9173b96d6fe649de1d4ab61ab76beb4

SHA1
403bf6cc3f682b575beb79186cef5b38bc2fe59f

SHA256
228ade38d24df70b545682076a142874ad4385528179a90c585d574c1aad2aac

SHA512
6060bc2ef5295df71bf78b29bfd7d5576d5299df9553ec5d41852455cbcfa3f9bcb50ad16b13337aff3b68b34387855675948276343d65ae03d5eac4e8470700

Download Submit
C:\Windows\temp\ge5qupjk.exe

Filesize
534KB

MD5
f9173b96d6fe649de1d4ab61ab76beb4

SHA1
403bf6cc3f682b575beb79186cef5b38bc2fe59f

SHA256
228ade38d24df70b545682076a142874ad4385528179a90c585d574c1aad2aac

SHA512
6060bc2ef5295df71bf78b29bfd7d5576d5299df9553ec5d41852455cbcfa3f9bcb50ad16b13337aff3b68b34387855675948276343d65ae03d5eac4e8470700

Download Submit
C:\Windows\temp\oabovbw2.inf

Filesize
606B

MD5
a40606b7b474f2fc64b6f4305d513f8e

SHA1
1498766949a76ef415e0fbc4dd5d006ed50f41db

SHA256
51d829e5868f323ed9e40c93acff015bfa30dac6951fc0807efb46a394ec685f

SHA512
a145daa3228f5a29bc6db93706527fd59131890aaf4e2c90accddd5514d5f6640e4bbe439503e331c497a2224db99901e4e504e03e791dfb896647d04c8b16c9

Download Submit
memory/2192-148-0x0000000000000000-mapping.dmp

Download
memory/2320-135-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2320-130-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2320-136-0x00000000733D0000-0x0000000073459000-memory.dmp

Filesize
548KB

Download
memory/2320-137-0x0000000004B80000-0x0000000005124000-memory.dmp

Filesize
5.6MB

Download
memory/2320-138-0x0000000005170000-0x0000000005202000-memory.dmp

Filesize
584KB

Download
memory/2320-139-0x00000000775B0000-0x0000000077B63000-memory.dmp

Filesize
5.7MB

Download
memory/2320-134-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2320-142-0x00000000029C0000-0x00000000029CA000-memory.dmp

Filesize
40KB

Download
memory/2320-131-0x0000000002110000-0x0000000002157000-memory.dmp

Filesize
284KB

Download
memory/2320-132-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2320-133-0x0000000076070000-0x0000000076285000-memory.dmp

Filesize
2.1MB

Download
memory/3420-140-0x0000000000000000-mapping.dmp

Download
memory/4500-147-0x00000000009F0000-0x0000000000A7C000-memory.dmp

Filesize
560KB

Download
memory/4500-144-0x0000000000000000-mapping.dmp

Download
memory/4500-149-0x0000000005540000-0x00000000055A6000-memory.dmp

Filesize
408KB

Download
memory/4500-150-0x0000000006110000-0x0000000006122000-memory.dmp

Filesize
72KB

Download
memory/5104-143-0x0000000000000000-mapping.dmp

Download