quasar | 93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb

Analysis

max time kernel
63s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2022, 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dac30ab400ec6be2daa29718ea6d0a3e.exe
Size

867KB
MD5

dac30ab400ec6be2daa29718ea6d0a3e
SHA1

06320ebc648623885645657fd2a72a728f2441cd
SHA256

93361aea837c73c75f9067700572262e69d1cfbfa6634e7ea8f249701e1fdebb
SHA512

67f360d49625822199c133981c4077d88d9ec2347386858f33d08d6b6f37c15af0c56cf9772e0fb819072ab4b63b13eb334237ccd727ce91cad9b68ab47ec58c
SSDEEP

12288:3ARp0gFW4q6AD9/Gz8hQOFPA/OcMowPzQvEXpqCctQHNM:2igFW4qbx/GY7Y/jw7tICct4a

Score

10^/10

quasar venomrat asdf evasion rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

asdf

checkme12.freeddns.org:1604

Mutex

VNM_MUTEX_yidaALoSEROfTPWHwX

Attributes

encryption_key
TbfVFQWqb0uiZoBjJ9E9
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
UPX

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/4628-134-0x0000000000000000-mapping.dmp	disable_win_def
behavioral2/memory/4628-135-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	RegSvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	RegSvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	RegSvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	RegSvcs.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4628-134-0x0000000000000000-mapping.dmp	family_quasar
behavioral2/memory/4628-135-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Executes dropped EXE 1 IoCs

pid	Process
884	Client.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 696 set thread context of 4628	696	dac30ab400ec6be2daa29718ea6d0a3e.exe	81

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4576	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1360	PING.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3192	powershell.exe
3192	powershell.exe
4628	RegSvcs.exe
4628	RegSvcs.exe
4628	RegSvcs.exe
4628	RegSvcs.exe
4628	RegSvcs.exe
4628	RegSvcs.exe
4628	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4628	RegSvcs.exe
Token: SeDebugPrivilege	3192	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
696	dac30ab400ec6be2daa29718ea6d0a3e.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 4628	696	dac30ab400ec6be2daa29718ea6d0a3e.exe	81
PID 696 wrote to memory of 4628	696	dac30ab400ec6be2daa29718ea6d0a3e.exe	81
PID 696 wrote to memory of 4628	696	dac30ab400ec6be2daa29718ea6d0a3e.exe	81
PID 696 wrote to memory of 4628	696	dac30ab400ec6be2daa29718ea6d0a3e.exe	81
PID 696 wrote to memory of 4628	696	dac30ab400ec6be2daa29718ea6d0a3e.exe	81
PID 696 wrote to memory of 4628	696	dac30ab400ec6be2daa29718ea6d0a3e.exe	81
PID 696 wrote to memory of 4628	696	dac30ab400ec6be2daa29718ea6d0a3e.exe	81
PID 696 wrote to memory of 4628	696	dac30ab400ec6be2daa29718ea6d0a3e.exe	81
PID 4628 wrote to memory of 4576	4628	RegSvcs.exe	85
PID 4628 wrote to memory of 4576	4628	RegSvcs.exe	85
PID 4628 wrote to memory of 4576	4628	RegSvcs.exe	85
PID 4628 wrote to memory of 884	4628	RegSvcs.exe	87
PID 4628 wrote to memory of 884	4628	RegSvcs.exe	87
PID 4628 wrote to memory of 884	4628	RegSvcs.exe	87
PID 4628 wrote to memory of 3192	4628	RegSvcs.exe	89
PID 4628 wrote to memory of 3192	4628	RegSvcs.exe	89
PID 4628 wrote to memory of 3192	4628	RegSvcs.exe	89
PID 4628 wrote to memory of 4300	4628	RegSvcs.exe	94
PID 4628 wrote to memory of 4300	4628	RegSvcs.exe	94
PID 4628 wrote to memory of 4300	4628	RegSvcs.exe	94
PID 4300 wrote to memory of 1960	4300	cmd.exe	96
PID 4300 wrote to memory of 1960	4300	cmd.exe	96
PID 4300 wrote to memory of 1960	4300	cmd.exe	96
PID 4628 wrote to memory of 4784	4628	RegSvcs.exe	98
PID 4628 wrote to memory of 4784	4628	RegSvcs.exe	98
PID 4628 wrote to memory of 4784	4628	RegSvcs.exe	98
PID 4784 wrote to memory of 820	4784	cmd.exe	100
PID 4784 wrote to memory of 820	4784	cmd.exe	100
PID 4784 wrote to memory of 820	4784	cmd.exe	100
PID 4784 wrote to memory of 1360	4784	cmd.exe	101
PID 4784 wrote to memory of 1360	4784	cmd.exe	101
PID 4784 wrote to memory of 1360	4784	cmd.exe	101
PID 4784 wrote to memory of 1696	4784	cmd.exe	102
PID 4784 wrote to memory of 1696	4784	cmd.exe	102
PID 4784 wrote to memory of 1696	4784	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\dac30ab400ec6be2daa29718ea6d0a3e.exe
"C:\Users\Admin\AppData\Local\Temp\dac30ab400ec6be2daa29718ea6d0a3e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4576
- - C:\Users\Admin\AppData\Roaming\UPX\Client.exe
    "C:\Users\Admin\AppData\Roaming\UPX\Client.exe"
    3⤵
    - Executes dropped EXE
    PID:884
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\v8mvSo8j2hYg.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:820
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:1360
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:1696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

Filesize
1KB

MD5
10eab9c2684febb5327b6976f2047587

SHA1
a12ed54146a7f5c4c580416aecb899549712449e

SHA256
f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928

SHA512
7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50

Download Submit
C:\Users\Admin\AppData\Local\Temp\v8mvSo8j2hYg.bat

Filesize
216B

MD5
7ad57d45ccea056eada4e5199eb69c8b

SHA1
fd0654a529df5f1e4519163d3552165d16be38d3

SHA256
f66a53af94370927ffad4d564e3e61dda37839cd48f9ab5bbfb5cef7e76cae24

SHA512
35a33200429a29f8a6ff9a99df69c754cb2b52fa6bd84c02a026d18184ecd62d461e1405bea2eeea47fa2fc432f2002115c9c6cf06663964aad2761917144049

Download Submit
C:\Users\Admin\AppData\Roaming\UPX\Client.exe

Filesize
44KB

MD5
9d352bc46709f0cb5ec974633a0c3c94

SHA1
1969771b2f022f9a86d77ac4d4d239becdf08d07

SHA256
2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390

SHA512
13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

Download Submit
C:\Users\Admin\AppData\Roaming\UPX\Client.exe

Filesize
44KB

MD5
9d352bc46709f0cb5ec974633a0c3c94

SHA1
1969771b2f022f9a86d77ac4d4d239becdf08d07

SHA256
2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390

SHA512
13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

Download Submit
memory/884-147-0x0000000002DE0000-0x0000000002E1C000-memory.dmp

Filesize
240KB

Download
memory/884-146-0x0000000000A60000-0x0000000000A6E000-memory.dmp

Filesize
56KB

Download
memory/3192-152-0x0000000006810000-0x000000000682E000-memory.dmp

Filesize
120KB

Download
memory/3192-154-0x000000006FA80000-0x000000006FACC000-memory.dmp

Filesize
304KB

Download
memory/3192-162-0x0000000007E40000-0x0000000007E48000-memory.dmp

Filesize
32KB

Download
memory/3192-148-0x0000000002E70000-0x0000000002EA6000-memory.dmp

Filesize
216KB

Download
memory/3192-149-0x0000000005A80000-0x00000000060A8000-memory.dmp

Filesize
6.2MB

Download
memory/3192-150-0x00000000057F0000-0x0000000005812000-memory.dmp

Filesize
136KB

Download
memory/3192-151-0x00000000059D0000-0x0000000005A36000-memory.dmp

Filesize
408KB

Download
memory/3192-153-0x0000000006DE0000-0x0000000006E12000-memory.dmp

Filesize
200KB

Download
memory/3192-161-0x0000000007E60000-0x0000000007E7A000-memory.dmp

Filesize
104KB

Download
memory/3192-155-0x0000000006DC0000-0x0000000006DDE000-memory.dmp

Filesize
120KB

Download
memory/3192-156-0x0000000008160000-0x00000000087DA000-memory.dmp

Filesize
6.5MB

Download
memory/3192-157-0x0000000007B20000-0x0000000007B3A000-memory.dmp

Filesize
104KB

Download
memory/3192-158-0x0000000007B90000-0x0000000007B9A000-memory.dmp

Filesize
40KB

Download
memory/3192-159-0x0000000007DA0000-0x0000000007E36000-memory.dmp

Filesize
600KB

Download
memory/3192-160-0x0000000007D50000-0x0000000007D5E000-memory.dmp

Filesize
56KB

Download
memory/4628-140-0x0000000006810000-0x000000000684C000-memory.dmp

Filesize
240KB

Download
memory/4628-139-0x00000000063E0000-0x00000000063F2000-memory.dmp

Filesize
72KB

Download
memory/4628-138-0x00000000057E0000-0x0000000005846000-memory.dmp

Filesize
408KB

Download
memory/4628-137-0x0000000005440000-0x00000000054D2000-memory.dmp

Filesize
584KB

Download
memory/4628-136-0x00000000058F0000-0x0000000005E94000-memory.dmp

Filesize
5.6MB

Download
memory/4628-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download