quasar | 0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72

Analysis

max time kernel
43s
max time network
115s
platform
windows7_x64
resource
win7-20220414-en
submitted
16-05-2022 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe
Size

555KB
MD5

ccf59a9ca800d77f057cdc4f521495c1
SHA1

7cdab49311072b2de9adc80c44bb60c323367321
SHA256

0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72
SHA512

7ba18a18d3af162ea408746b362d6d56027b76c3f3208e87cea43aa9023ac39e1fa000c95d8e02c45e974674dc327f26f3d6a4ce0b36b1ccb226036ed104596a

Score

10^/10

quasar venomrat office04 rat rootkit spyware stealer suricata trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

Mju-49682.portmap.io:49682

Mutex

VNM_MUTEX_c2q7y2ayYutZ2XaYe7

Attributes

encryption_key
SuO52LCbOLZpyY12QyzT
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 7 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/992-59-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/992-60-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/992-61-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/992-62-0x0000000000486C1E-mapping.dmp	disable_win_def
behavioral1/memory/992-64-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/992-66-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/1768-80-0x0000000000486C1E-mapping.dmp	disable_win_def

Quasar Payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/992-59-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/992-60-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/992-61-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/992-62-0x0000000000486C1E-mapping.dmp	family_quasar
behavioral1/memory/992-64-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/992-66-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/1768-80-0x0000000000486C1E-mapping.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe

description	pid	Process	procid_target
PID 2040 set thread context of 992	2040	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	27
PID 1916 set thread context of 1768	1916	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1548	992	WerFault.exe	27

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
672	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe

pid	Process
1768	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe

description	pid	Process
Token: SeDebugPrivilege	992	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe
Token: SeDebugPrivilege	992	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe
Token: SeDebugPrivilege	1768	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe

pid	Process
992	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.execmd.exe0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe

description	pid	Process	procid_target
PID 2040 wrote to memory of 992	2040	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	27
PID 2040 wrote to memory of 992	2040	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	27
PID 2040 wrote to memory of 992	2040	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	27
PID 2040 wrote to memory of 992	2040	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	27
PID 2040 wrote to memory of 992	2040	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	27
PID 2040 wrote to memory of 992	2040	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	27
PID 2040 wrote to memory of 992	2040	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	27
PID 2040 wrote to memory of 992	2040	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	27
PID 2040 wrote to memory of 992	2040	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	27
PID 992 wrote to memory of 1888	992	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	29
PID 992 wrote to memory of 1888	992	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	29
PID 992 wrote to memory of 1888	992	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	29
PID 992 wrote to memory of 1888	992	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	29
PID 992 wrote to memory of 1548	992	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	31
PID 992 wrote to memory of 1548	992	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	31
PID 992 wrote to memory of 1548	992	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	31
PID 992 wrote to memory of 1548	992	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	31
PID 1888 wrote to memory of 1044	1888	cmd.exe	32
PID 1888 wrote to memory of 1044	1888	cmd.exe	32
PID 1888 wrote to memory of 1044	1888	cmd.exe	32
PID 1888 wrote to memory of 1044	1888	cmd.exe	32
PID 1888 wrote to memory of 672	1888	cmd.exe	33
PID 1888 wrote to memory of 672	1888	cmd.exe	33
PID 1888 wrote to memory of 672	1888	cmd.exe	33
PID 1888 wrote to memory of 672	1888	cmd.exe	33
PID 1888 wrote to memory of 1916	1888	cmd.exe	34
PID 1888 wrote to memory of 1916	1888	cmd.exe	34
PID 1888 wrote to memory of 1916	1888	cmd.exe	34
PID 1888 wrote to memory of 1916	1888	cmd.exe	34
PID 1916 wrote to memory of 1768	1916	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	35
PID 1916 wrote to memory of 1768	1916	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	35
PID 1916 wrote to memory of 1768	1916	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	35
PID 1916 wrote to memory of 1768	1916	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	35
PID 1916 wrote to memory of 1768	1916	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	35
PID 1916 wrote to memory of 1768	1916	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	35
PID 1916 wrote to memory of 1768	1916	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	35
PID 1916 wrote to memory of 1768	1916	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	35
PID 1916 wrote to memory of 1768	1916	0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe	35

C:\Users\Admin\AppData\Local\Temp\0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe
"C:\Users\Admin\AppData\Local\Temp\0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe
  "C:\Users\Admin\AppData\Local\Temp\0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\5GtMf8fUzVZU.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:1044
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:672
  - - C:\Users\Admin\AppData\Local\Temp\0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe
      "C:\Users\Admin\AppData\Local\Temp\0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1476
    3⤵
    - Program crash
    PID:1548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5GtMf8fUzVZU.bat

Filesize
261B

MD5
cf72a860db45374382cb8a5bc1e6b6e7

SHA1
bf038a4e3faac0a8ce3562b360f33f268016006f

SHA256
be0a1c4b06596de57d0f96a8b20402d6cea3cbe9d84cc37510db9c433100fd6f

SHA512
a33c1e7b38d09e93ffc0c5f9363390129b8adcce2ae8ccc883d052a4d404acdf803360e0cfeae4b52f1789342872aadfe8d3adfc7f97b79eb8129385b1bd16ab

Download Submit
memory/672-72-0x0000000000000000-mapping.dmp

Download
memory/992-59-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/992-66-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/992-56-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/992-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/992-61-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/992-62-0x0000000000486C1E-mapping.dmp

Download
memory/992-64-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/992-57-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/992-67-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1044-71-0x0000000000000000-mapping.dmp

Download
memory/1548-70-0x0000000000000000-mapping.dmp

Download
memory/1768-80-0x0000000000486C1E-mapping.dmp

Download
memory/1888-68-0x0000000000000000-mapping.dmp

Download
memory/1916-73-0x0000000000000000-mapping.dmp

Download
memory/2040-54-0x0000000000B00000-0x0000000000B92000-memory.dmp

Filesize
584KB

Download
memory/2040-55-0x00000000001D0000-0x00000000001D8000-memory.dmp

Filesize
32KB

Download