Analysis
-
max time kernel
50s -
max time network
281s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
-
submitted
19/09/2022, 03:51
General
-
Target
b8cfdd16f5bc4d13a805fe0fbc11fc0e569cd7e5d9b84255739baaceb3c3fe5a.exe
-
Size
2.7MB
-
MD5
181fdf4b2fd548b5563d1d34dfb7b691
-
SHA1
d60221a413122368890fb1d3dbd9cb3980e41104
-
SHA256
b8cfdd16f5bc4d13a805fe0fbc11fc0e569cd7e5d9b84255739baaceb3c3fe5a
-
SHA512
b45dad9e0c80b803733c376efc1241f745dde4c706af4059611f1143dfe8e368aa7ffdd298b053f3b529cc3a317d875bca40b79ac8f901d6d74e9297b8ac6e8b
-
SSDEEP
49152:DqusQxWfZ0IP92v9SQDNVK6aT0H0jvfVb5idvYSwYp6IzZAU+XoGgGT80HrQ:eOWfZhw9PJ06aTdjfV4vYSwQ6+mUZ2wD
Malware Config
Extracted
quasar
2.7.0.0
Venom Client
probka.ddns.net:4545
JlYM51eW4iZoFyLa2X
-
encryption_key
nygFK3eRf9rpU1TEw9ld
-
install_name
Venom.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8cfdd16f5bc4d13a805fe0fbc11fc0e569cd7e5d9b84255739baaceb3c3fe5a.exe"C:\Users\Admin\AppData\Local\Temp\b8cfdd16f5bc4d13a805fe0fbc11fc0e569cd7e5d9b84255739baaceb3c3fe5a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
6.9MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
6.9MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
5.0MB
-
Filesize
1.6MB
-
Filesize
584KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
408KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
72KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
248KB
-
Filesize
40KB