Overview

overview

10

Static

static

e4b0894af3...1c.exe

windows7_x64

10

e4b0894af3...1c.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    160s
  • max time network
    238s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12-05-2022 01:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e4b0894af3fb7948dd92288339cf2fda627c26ec25b4d37c1620f6c005c0c01c.exe

  • Size

    303KB

  • MD5

    a500424ebd54b1e006ccad65266562e3

  • SHA1

    18be3591da1c3d79aee29026c30c67567e3b2bad

  • SHA256

    e4b0894af3fb7948dd92288339cf2fda627c26ec25b4d37c1620f6c005c0c01c

  • SHA512

    c197f02534c15b82f81def7d60349fba1e72c0b82d8b11fe64856a7ae7833e9d9d70d723bac8e1809ceda2cc9c76eb87025199230ba08ebc89bde2f6b71931ec

Score
10/10
quasarvenomratoffice04ratrootkitspywarestealersuricatatrojan

Malware Config

Extracted

Family

quasar

Mutex

Attributes
  • encryption_key

  • install_name

  • log_directory

  • reconnect_delay

    3000

  • startup_key

  • subdirectory

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

myconect.ddns.net:6606

Mutex

VNM_MUTEX_bW2Pm17MwUNvIYeCrf

Attributes
  • encryption_key

    skMcIyTXgvAaYya6lzLD

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

  • subdirectory

    SubDir

Signatures

  • Contains code to disable Windows Defender 4 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar Payload 4 IoCs
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat
  • suricata: ET MALWARE Common RAT Connectivity Check Observed

    suricata: ET MALWARE Common RAT Connectivity Check Observed

    suricata
  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 1 IoCs
    evasion
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4b0894af3fb7948dd92288339cf2fda627c26ec25b4d37c1620f6c005c0c01c.exe
    "C:\Users\Admin\AppData\Local\Temp\e4b0894af3fb7948dd92288339cf2fda627c26ec25b4d37c1620f6c005c0c01c.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1000
    • \??\c:\windows\system32\cmstp.exe
      "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\llzyc3jj.inf
      2⤵
        PID:2016
    • C:\Windows\system32\cmd.exe
      cmd /c start C:\Windows\temp\oll0vnyx.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1368
      • C:\Windows\temp\oll0vnyx.exe
        C:\Windows\temp\oll0vnyx.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious use of AdjustPrivilegeToken
        PID:1524
    • C:\Windows\system32\taskkill.exe
      taskkill /IM cmstp.exe /F
      1⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1172

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Temp\oll0vnyx.exe
      Filesize

      534KB

      MD5

      e4dc9cb250120aebeee969906d1a7a22

      SHA1

      c0f9d3a2531cc25e212d9adbf8614903d8a6247e

      SHA256

      14de179b37e9958b3a1d22f22b0bb545be1cb166aeaf5a4892ccd616ee7e544f

      SHA512

      21461e4fdc16ba99ae24a1f2fa39465678e851591d7402c762a04bf286b9ec8230a0acd147f0c9d54fb6a3428be1851c4d75f46b6cf917a44b3b399e8897667b

      Download Submit

    • C:\Windows\temp\llzyc3jj.inf
      Filesize

      606B

      MD5

      ad76f118b0278581d2a703bd00f651f9

      SHA1

      5213ec16e7ee6e501d057df259ca447277757502

      SHA256

      b2626c0b59d178165ca851615716fdcad47fc8d87fc32a2ed9b5af0503727398

      SHA512

      248e7d45248a559386d48c87440a7d89d99256aca7dff7e56811a88aed79dbb2cbd191d9feb96b4ed072270beb4d887420fcbbbb3ab4ba6a23a46925cc4e0e4d

      Download Submit

    • C:\Windows\temp\oll0vnyx.exe
      Filesize

      534KB

      MD5

      e4dc9cb250120aebeee969906d1a7a22

      SHA1

      c0f9d3a2531cc25e212d9adbf8614903d8a6247e

      SHA256

      14de179b37e9958b3a1d22f22b0bb545be1cb166aeaf5a4892ccd616ee7e544f

      SHA512

      21461e4fdc16ba99ae24a1f2fa39465678e851591d7402c762a04bf286b9ec8230a0acd147f0c9d54fb6a3428be1851c4d75f46b6cf917a44b3b399e8897667b

      Download Submit

    • memory/1000-54-0x00000000010E0000-0x0000000001132000-memory.dmp

      Filesize

      328KB

      Download

    • memory/1000-55-0x0000000000DC0000-0x0000000000E4E000-memory.dmp

      Filesize

      568KB

      Download

    • memory/1000-59-0x000000001AF16000-0x000000001AF35000-memory.dmp

      Filesize

      124KB

      Download

    • memory/1524-63-0x00000000008F0000-0x000000000097C000-memory.dmp

      Filesize

      560KB

      Download

    • memory/1524-64-0x00000000765C1000-0x00000000765C3000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2016-58-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

      Filesize

      8KB

      Download