Analysis
- max time kernel
155s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
12/05/2022, 11:55
General
- Target fbc4fd5e3d3f2b5ccd26807e9e73498b3a3699e7efe35c624fbebcdc2c0c6314.exe
- Size 757KB
- Sample220512-n3x4psdec4
- SHA256 fbc4fd5e3d3f2b5ccd26807e9e73498b3a3699e7efe35c624fbebcdc2c0c6314
Malware Config
Extracted
-
quasar
- encryption_key
- install_name
- log_directory
-
reconnect_delay
3000
- startup_key
- subdirectory
Extracted
-
quasar
-
2.1.0.0
-
Office04
-
myconect.ddns.net:6606
-
VNM_MUTEX_bW2Pm17MwUNvIYeCrf
-
encryption_key
skMcIyTXgvAaYya6lzLD
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
-
subdirectory
SubDir
Signatures
- Contains code to disable Windows Defender 4 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Quasar Payload 4 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
- suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata: ET MALWARE Common RAT Connectivity Check Observed
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbc4fd5e3d3f2b5ccd26807e9e73498b3a3699e7efe35c624fbebcdc2c0c6314.exe"C:\Users\Admin\AppData\Local\Temp\fbc4fd5e3d3f2b5ccd26807e9e73498b3a3699e7efe35c624fbebcdc2c0c6314.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'lxxgldt snybyasm';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'lxxgldt snybyasm' -Value '"C:\Users\Admin\AppData\Roaming\fdfhhuxv ssqavqkxj\chome_exe.exe"' -PropertyType 'String'2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\lwk3u3ol.inf3⤵
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c start C:\Windows\temp\xmfvmhxj.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\xmfvmhxj.exeC:\Windows\temp\xmfvmhxj.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cmstp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
xmfvmhxj.exe
lwk3u3ol.inf
xmfvmhxj.exe
memory/204-138-0x0000000000400000-0x000000000048E000-memory.dmp
memory/3108-144-0x0000000005B60000-0x0000000005BC6000-memory.dmp
memory/3108-155-0x0000000006E40000-0x0000000006E62000-memory.dmp
memory/3108-139-0x0000000003010000-0x0000000003046000-memory.dmp
memory/3108-142-0x0000000005C30000-0x0000000006258000-memory.dmp
memory/3108-154-0x0000000006DF0000-0x0000000006E0A000-memory.dmp
memory/3108-143-0x0000000005930000-0x0000000005952000-memory.dmp
memory/3108-153-0x00000000078D0000-0x0000000007966000-memory.dmp
memory/3108-145-0x00000000062D0000-0x0000000006336000-memory.dmp
memory/3108-146-0x0000000006910000-0x000000000692E000-memory.dmp
memory/4392-131-0x0000000005AC0000-0x0000000006064000-memory.dmp
memory/4392-133-0x00000000055D0000-0x00000000055DA000-memory.dmp
memory/4392-132-0x00000000055F0000-0x0000000005682000-memory.dmp
memory/4392-130-0x0000000000A20000-0x0000000000AE4000-memory.dmp
memory/4392-134-0x0000000005820000-0x0000000005896000-memory.dmp
memory/4392-135-0x0000000005A30000-0x0000000005A4E000-memory.dmp
memory/5088-151-0x0000000000470000-0x00000000004FC000-memory.dmp
memory/5088-156-0x00000000053F0000-0x0000000005402000-memory.dmp
memory/5088-157-0x0000000005FF0000-0x000000000602C000-memory.dmp