quasar | 93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb

General

Target

93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe
Size

867KB
MD5

dac30ab400ec6be2daa29718ea6d0a3e
SHA1

06320ebc648623885645657fd2a72a728f2441cd
SHA256

93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb
SHA512

67f360d49625822199c133981c4077d88d9ec2347386858f33d08d6b6f37c15af0c56cf9772e0fb819072ab4b63b13eb334237ccd727ce91cad9b68ab47ec58c
SSDEEP

12288:3ARp0gFW4q6AD9/Gz8hQOFPA/OcMowPzQvEXpqCctQHNM:2igFW4qbx/GY7Y/jw7tICct4a

Score

10^/10

quasar venomrat asdf evasion persistence rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

asdf

C2

checkme12.freeddns.org:1604

Mutex

VNM_MUTEX_yidaALoSEROfTPWHwX

Attributes

encryption_key
TbfVFQWqb0uiZoBjJ9E9
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
UPX

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/4560-134-0x0000000000000000-mapping.dmp	disable_win_def
behavioral1/memory/4560-135-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

RegSvcs.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	RegSvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	RegSvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	RegSvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	RegSvcs.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4560-134-0x0000000000000000-mapping.dmp	family_quasar
behavioral1/memory/4560-135-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat
Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

3600 Client.exe

pid	process
3600	Client.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Venom Client Startup = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\""	RegSvcs.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

25 ip-api.com
32 api.ipify.org

flow	ioc
25	ip-api.com
32	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe

description	pid	process	target process
PID 3068 set thread context of 4560	3068	93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe	RegSvcs.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2192 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2220 PING.EXE

pid	process
2192	schtasks.exe

pid	process
2220	PING.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exeRegSvcs.exe

pid	process
3540	powershell.exe
3540	powershell.exe
4560	RegSvcs.exe
4560	RegSvcs.exe
4560	RegSvcs.exe
4560	RegSvcs.exe
4560	RegSvcs.exe
4560	RegSvcs.exe
4560	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RegSvcs.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4560 RegSvcs.exe
Token: SeDebugPrivilege 3540 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe

pid process

3068 93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe

description	pid	process
Token: SeDebugPrivilege	4560	RegSvcs.exe
Token: SeDebugPrivilege	3540	powershell.exe

pid	process
3068	93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exeRegSvcs.execmd.execmd.exe

description	pid	process	target process
PID 3068 wrote to memory of 4560	3068	93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe	RegSvcs.exe
PID 3068 wrote to memory of 4560	3068	93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe	RegSvcs.exe
PID 3068 wrote to memory of 4560	3068	93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe	RegSvcs.exe
PID 3068 wrote to memory of 4560	3068	93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe	RegSvcs.exe
PID 3068 wrote to memory of 4560	3068	93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe	RegSvcs.exe
PID 3068 wrote to memory of 4560	3068	93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe	RegSvcs.exe
PID 3068 wrote to memory of 4560	3068	93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe	RegSvcs.exe
PID 3068 wrote to memory of 4560	3068	93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe	RegSvcs.exe
PID 4560 wrote to memory of 2192	4560	RegSvcs.exe	schtasks.exe
PID 4560 wrote to memory of 2192	4560	RegSvcs.exe	schtasks.exe
PID 4560 wrote to memory of 2192	4560	RegSvcs.exe	schtasks.exe
PID 4560 wrote to memory of 3600	4560	RegSvcs.exe	Client.exe
PID 4560 wrote to memory of 3600	4560	RegSvcs.exe	Client.exe
PID 4560 wrote to memory of 3600	4560	RegSvcs.exe	Client.exe
PID 4560 wrote to memory of 3540	4560	RegSvcs.exe	powershell.exe
PID 4560 wrote to memory of 3540	4560	RegSvcs.exe	powershell.exe
PID 4560 wrote to memory of 3540	4560	RegSvcs.exe	powershell.exe
PID 4560 wrote to memory of 4828	4560	RegSvcs.exe	cmd.exe
PID 4560 wrote to memory of 4828	4560	RegSvcs.exe	cmd.exe
PID 4560 wrote to memory of 4828	4560	RegSvcs.exe	cmd.exe
PID 4828 wrote to memory of 4820	4828	cmd.exe	cmd.exe
PID 4828 wrote to memory of 4820	4828	cmd.exe	cmd.exe
PID 4828 wrote to memory of 4820	4828	cmd.exe	cmd.exe
PID 4560 wrote to memory of 3316	4560	RegSvcs.exe	cmd.exe
PID 4560 wrote to memory of 3316	4560	RegSvcs.exe	cmd.exe
PID 4560 wrote to memory of 3316	4560	RegSvcs.exe	cmd.exe
PID 3316 wrote to memory of 2340	3316	cmd.exe	chcp.com
PID 3316 wrote to memory of 2340	3316	cmd.exe	chcp.com
PID 3316 wrote to memory of 2340	3316	cmd.exe	chcp.com
PID 3316 wrote to memory of 2220	3316	cmd.exe	PING.EXE
PID 3316 wrote to memory of 2220	3316	cmd.exe	PING.EXE
PID 3316 wrote to memory of 2220	3316	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe
"C:\Users\Admin\AppData\Local\Temp\93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2192
- - C:\Users\Admin\AppData\Roaming\UPX\Client.exe
    "C:\Users\Admin\AppData\Roaming\UPX\Client.exe"
    3⤵
    - Executes dropped EXE
    PID:3600
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\M5ePEiByM3aq.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:2340
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:2220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\M5ePEiByM3aq.bat

Filesize
216B

MD5
71876beb56bef585c552da673f11afb7

SHA1
cacc45473861cf80b350bf12581eb2fcfb28ebc8

SHA256
7eb834f582db6010504eea301aa2537e6c0d6d8b1305d2553501b6cf2485cd5d

SHA512
410f9dcf3f2da1ad4884ecf8c599b5d8fd775775d0001639870bb11fc70086d87ccd98e27e6dbd8cbe3e01765012588bb8e9c89931b5fdb6414a9cd4c8f78c9a

Download Submit
C:\Users\Admin\AppData\Roaming\UPX\Client.exe

Filesize
44KB

MD5
9d352bc46709f0cb5ec974633a0c3c94

SHA1
1969771b2f022f9a86d77ac4d4d239becdf08d07

SHA256
2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390

SHA512
13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

Download Submit
C:\Users\Admin\AppData\Roaming\UPX\Client.exe

Filesize
44KB

MD5
9d352bc46709f0cb5ec974633a0c3c94

SHA1
1969771b2f022f9a86d77ac4d4d239becdf08d07

SHA256
2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390

SHA512
13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

Download Submit
memory/2192-140-0x0000000000000000-mapping.dmp

Download
memory/2220-167-0x0000000000000000-mapping.dmp

Download
memory/2340-166-0x0000000000000000-mapping.dmp

Download
memory/3316-164-0x0000000000000000-mapping.dmp

Download
memory/3540-150-0x0000000005840000-0x00000000058A6000-memory.dmp

Filesize
408KB

Download
memory/3540-154-0x0000000000A20000-0x0000000000A3E000-memory.dmp

Filesize
120KB

Download
memory/3540-143-0x0000000000000000-mapping.dmp

Download
memory/3540-161-0x00000000074E0000-0x00000000074E8000-memory.dmp

Filesize
32KB

Download
memory/3540-160-0x0000000007590000-0x00000000075AA000-memory.dmp

Filesize
104KB

Download
memory/3540-159-0x00000000074A0000-0x00000000074AE000-memory.dmp

Filesize
56KB

Download
memory/3540-147-0x0000000004A40000-0x0000000004A76000-memory.dmp

Filesize
216KB

Download
memory/3540-148-0x00000000051A0000-0x00000000057C8000-memory.dmp

Filesize
6.2MB

Download
memory/3540-149-0x0000000005030000-0x0000000005052000-memory.dmp

Filesize
136KB

Download
memory/3540-158-0x00000000074F0000-0x0000000007586000-memory.dmp

Filesize
600KB

Download
memory/3540-151-0x0000000005FC0000-0x0000000005FDE000-memory.dmp

Filesize
120KB

Download
memory/3540-152-0x0000000000A40000-0x0000000000A72000-memory.dmp

Filesize
200KB

Download
memory/3540-153-0x0000000070280000-0x00000000702CC000-memory.dmp

Filesize
304KB

Download
memory/3540-157-0x0000000006560000-0x000000000656A000-memory.dmp

Filesize
40KB

Download
memory/3540-155-0x00000000078E0000-0x0000000007F5A000-memory.dmp

Filesize
6.5MB

Download
memory/3540-156-0x0000000006390000-0x00000000063AA000-memory.dmp

Filesize
104KB

Download
memory/3600-141-0x0000000000000000-mapping.dmp

Download
memory/3600-146-0x0000000002F80000-0x0000000002FBC000-memory.dmp

Filesize
240KB

Download
memory/3600-145-0x0000000000D10000-0x0000000000D1E000-memory.dmp

Filesize
56KB

Download
memory/4560-134-0x0000000000000000-mapping.dmp

Download
memory/4560-139-0x0000000005730000-0x0000000005742000-memory.dmp

Filesize
72KB

Download
memory/4560-138-0x0000000005240000-0x00000000052A6000-memory.dmp

Filesize
408KB

Download
memory/4560-137-0x00000000051A0000-0x0000000005232000-memory.dmp

Filesize
584KB

Download
memory/4560-136-0x0000000005750000-0x0000000005CF4000-memory.dmp

Filesize
5.6MB

Download
memory/4560-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4820-163-0x0000000000000000-mapping.dmp

Download
memory/4828-162-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads