Analysis
-
max time kernel
150s -
max time network
73s -
platform
windows7_x64 -
resource
win7-20220414-en -
resource tags
arch:x64arch:x86image:win7-20220414-enlocale:en-usos:windows7-x64system -
submitted
18-07-2022 11:22
Behavioral task
behavioral1
Sample
bfaa90c6e3aacd9d9b83a4f8f0f74b0a.exe
Resource
win7-20220414-en
General
-
Target
bfaa90c6e3aacd9d9b83a4f8f0f74b0a.exe
-
Size
534KB
-
MD5
bfaa90c6e3aacd9d9b83a4f8f0f74b0a
-
SHA1
85cc249e2cbf60761fb6de586a442bfc81052e36
-
SHA256
6d00a6b8d581813e8af3114968274f89978b40d400c8eef2bf7e09192f5ec9e6
-
SHA512
29d83e5f0e82f94c75874c382dc0c002ed90627b8441066c2dc2575ec1f6aff3973bc72915b767d5e54688da6043a3bcd294d26445d865462a11ddb88f0912a5
Malware Config
Extracted
quasar
2.1.0.0
Office04
127.0.0.1:4782
VNM_MUTEX_c2q7y2ayYutZ2XaYe7
-
encryption_key
NTih4UsOfv91J9azm70k
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
-
subdirectory
SubDir
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/1208-54-0x0000000000830000-0x00000000008BC000-memory.dmp disable_win_def -
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1208-54-0x0000000000830000-0x00000000008BC000-memory.dmp family_quasar -
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata: ET MALWARE Common RAT Connectivity Check Observed
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
bfaa90c6e3aacd9d9b83a4f8f0f74b0a.exedescription pid process Token: SeDebugPrivilege 1208 bfaa90c6e3aacd9d9b83a4f8f0f74b0a.exe Token: SeDebugPrivilege 1208 bfaa90c6e3aacd9d9b83a4f8f0f74b0a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
bfaa90c6e3aacd9d9b83a4f8f0f74b0a.exepid process 1208 bfaa90c6e3aacd9d9b83a4f8f0f74b0a.exe