quasar | 29533c09c2ca85885835c2c3cbe3cba61b4310f14c170cc52bfc0d1bbf1779f5

General

Target

29533c09c2ca85885835c2c3cbe3cba61b4310f14c170cc52bfc0d1bbf1779f5.exe
Size

615KB
MD5

76869ef841f2820d0bbadddc46fc3c9a
SHA1

e827d9b426e4ef75f31e6e9d81f47e70da3ac3a2
SHA256

29533c09c2ca85885835c2c3cbe3cba61b4310f14c170cc52bfc0d1bbf1779f5
SHA512

582047f529fae9eacf9b4c762904b21c1d430d219e77b9bc65730e89c00be5f666a452f95cd1b0af067480eb9abd4446bf9431aa4afe2a4f68ad8226d1c11995
SSDEEP

6144:QYhWwTVvvVDzRW1BHH3g1NWT+AKYEM+gW4SmSMX0zCVsVwX+v456/bT8GoaEKwae:dhHTVXFRW1ZpK2bNV0CgwuX8GmkAh

Score

10^/10

quasar venomrat rat evasion rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

RAT

C2

23.105.131.178:7812

Mutex

VNM_MUTEX_It9SqdFDNndEItXfKp

Attributes

encryption_key
txgQXKaATimN7DY8jnPH
install_name
Windows Defender Security.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
Microsoft

Signatures

Contains code to disable Windows Defender 5 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe	disable_win_def
C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe	disable_win_def
behavioral2/memory/4452-137-0x0000000000700000-0x000000000078C000-memory.dmp	disable_win_def
C:\Users\Admin\AppData\Roaming\Microsoft\Windows Defender Security.exe	disable_win_def
C:\Users\Admin\AppData\Roaming\Microsoft\Windows Defender Security.exe	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

Windows Defender Security.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	Windows Defender Security.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Windows Defender Security.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Windows Defender Security.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Windows Defender Security.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe	family_quasar
C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe	family_quasar
behavioral2/memory/4452-137-0x0000000000700000-0x000000000078C000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\Microsoft\Windows Defender Security.exe	family_quasar
C:\Users\Admin\AppData\Roaming\Microsoft\Windows Defender Security.exe	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat
Executes dropped EXE 2 IoCs

Processes:

Windows Defender Security.exeWindows Defender Security.exe

pid process

4452 Windows Defender Security.exe
4476 Windows Defender Security.exe

pid	process
4452	Windows Defender Security.exe
4476	Windows Defender Security.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

29533c09c2ca85885835c2c3cbe3cba61b4310f14c170cc52bfc0d1bbf1779f5.exeWindows Defender Security.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	29533c09c2ca85885835c2c3cbe3cba61b4310f14c170cc52bfc0d1bbf1779f5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Windows Defender Security.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

Windows Defender Security.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	Windows Defender Security.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	Windows Defender Security.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4336 schtasks.exe
5064 schtasks.exe

flow	ioc
14	ip-api.com

pid	process
4336	schtasks.exe
5064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exeWindows Defender Security.exe

pid	process
4516	powershell.exe
4516	powershell.exe
4452	Windows Defender Security.exe
4452	Windows Defender Security.exe
4452	Windows Defender Security.exe
4452	Windows Defender Security.exe
4452	Windows Defender Security.exe
4452	Windows Defender Security.exe
4452	Windows Defender Security.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Windows Defender Security.exepowershell.exeWindows Defender Security.exe

description	pid	process
Token: SeDebugPrivilege	4452	Windows Defender Security.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeDebugPrivilege	4476	Windows Defender Security.exe
Token: SeDebugPrivilege	4476	Windows Defender Security.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Windows Defender Security.exe

pid process

4476 Windows Defender Security.exe

pid	process
4476	Windows Defender Security.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

29533c09c2ca85885835c2c3cbe3cba61b4310f14c170cc52bfc0d1bbf1779f5.exeWindows Defender Security.exeWindows Defender Security.execmd.exe

description	pid	process	target process
PID 4788 wrote to memory of 4452	4788	29533c09c2ca85885835c2c3cbe3cba61b4310f14c170cc52bfc0d1bbf1779f5.exe	Windows Defender Security.exe
PID 4788 wrote to memory of 4452	4788	29533c09c2ca85885835c2c3cbe3cba61b4310f14c170cc52bfc0d1bbf1779f5.exe	Windows Defender Security.exe
PID 4788 wrote to memory of 4452	4788	29533c09c2ca85885835c2c3cbe3cba61b4310f14c170cc52bfc0d1bbf1779f5.exe	Windows Defender Security.exe
PID 4452 wrote to memory of 4336	4452	Windows Defender Security.exe	schtasks.exe
PID 4452 wrote to memory of 4336	4452	Windows Defender Security.exe	schtasks.exe
PID 4452 wrote to memory of 4336	4452	Windows Defender Security.exe	schtasks.exe
PID 4452 wrote to memory of 4476	4452	Windows Defender Security.exe	Windows Defender Security.exe
PID 4452 wrote to memory of 4476	4452	Windows Defender Security.exe	Windows Defender Security.exe
PID 4452 wrote to memory of 4476	4452	Windows Defender Security.exe	Windows Defender Security.exe
PID 4452 wrote to memory of 4516	4452	Windows Defender Security.exe	powershell.exe
PID 4452 wrote to memory of 4516	4452	Windows Defender Security.exe	powershell.exe
PID 4452 wrote to memory of 4516	4452	Windows Defender Security.exe	powershell.exe
PID 4476 wrote to memory of 5064	4476	Windows Defender Security.exe	schtasks.exe
PID 4476 wrote to memory of 5064	4476	Windows Defender Security.exe	schtasks.exe
PID 4476 wrote to memory of 5064	4476	Windows Defender Security.exe	schtasks.exe
PID 4452 wrote to memory of 3508	4452	Windows Defender Security.exe	cmd.exe
PID 4452 wrote to memory of 3508	4452	Windows Defender Security.exe	cmd.exe
PID 4452 wrote to memory of 3508	4452	Windows Defender Security.exe	cmd.exe
PID 4452 wrote to memory of 3172	4452	Windows Defender Security.exe	cmd.exe
PID 4452 wrote to memory of 3172	4452	Windows Defender Security.exe	cmd.exe
PID 4452 wrote to memory of 3172	4452	Windows Defender Security.exe	cmd.exe
PID 3508 wrote to memory of 1104	3508	cmd.exe	cmd.exe
PID 3508 wrote to memory of 1104	3508	cmd.exe	cmd.exe
PID 3508 wrote to memory of 1104	3508	cmd.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\29533c09c2ca85885835c2c3cbe3cba61b4310f14c170cc52bfc0d1bbf1779f5.exe
"C:\Users\Admin\AppData\Local\Temp\29533c09c2ca85885835c2c3cbe3cba61b4310f14c170cc52bfc0d1bbf1779f5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe
  "C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Checks computer location settings
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4336
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows Defender Security.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows Defender Security.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows Defender Security.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:5064
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      PID:1104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\N27roeOjKGtn.bat" "
    3⤵
    PID:3172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Modify Existing Service

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\N27roeOjKGtn.bat

Filesize
219B

MD5
9df2ef8a241be2f48c8503334cb49571

SHA1
0fa959f3973559793a70c117921b5c8b09836973

SHA256
0cf377c571fc415476cc06204238084ab7f319aa1097c93ff10fe94009905a7d

SHA512
2b7596c28d8255f5b0697c63cbdc20d549d9116ac202393f1bb6aa3bb9d91d9dea8823ba81334c3b6799d3cc41e28df2023611efae91a35666c7b400c841468b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows Defender Security.exe

Filesize
535KB

MD5
0bd3018c9c566328497be54c7d882159

SHA1
8d90c23ee373ab935ba930f25c96374762c4a5a6

SHA256
026971c3fba531247627dd9f3f7d51c566d8df28a52332bd3d0eb8ca55d96176

SHA512
90cfde84ae14de5151c4950b8f8fe05d108a9716f3e0c104e2793a9c8bbb6a4385fe24a1bd9bc020cd061a128bb258ef44ef8679ac4b0e8a280107b22ed9e8cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows Defender Security.exe

Filesize
535KB

MD5
0bd3018c9c566328497be54c7d882159

SHA1
8d90c23ee373ab935ba930f25c96374762c4a5a6

SHA256
026971c3fba531247627dd9f3f7d51c566d8df28a52332bd3d0eb8ca55d96176

SHA512
90cfde84ae14de5151c4950b8f8fe05d108a9716f3e0c104e2793a9c8bbb6a4385fe24a1bd9bc020cd061a128bb258ef44ef8679ac4b0e8a280107b22ed9e8cc

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe

Filesize
535KB

MD5
0bd3018c9c566328497be54c7d882159

SHA1
8d90c23ee373ab935ba930f25c96374762c4a5a6

SHA256
026971c3fba531247627dd9f3f7d51c566d8df28a52332bd3d0eb8ca55d96176

SHA512
90cfde84ae14de5151c4950b8f8fe05d108a9716f3e0c104e2793a9c8bbb6a4385fe24a1bd9bc020cd061a128bb258ef44ef8679ac4b0e8a280107b22ed9e8cc

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Defender Security.exe

Filesize
535KB

MD5
0bd3018c9c566328497be54c7d882159

SHA1
8d90c23ee373ab935ba930f25c96374762c4a5a6

SHA256
026971c3fba531247627dd9f3f7d51c566d8df28a52332bd3d0eb8ca55d96176

SHA512
90cfde84ae14de5151c4950b8f8fe05d108a9716f3e0c104e2793a9c8bbb6a4385fe24a1bd9bc020cd061a128bb258ef44ef8679ac4b0e8a280107b22ed9e8cc

Download Submit
memory/1104-167-0x0000000000000000-mapping.dmp

Download
memory/3172-166-0x0000000000000000-mapping.dmp

Download
memory/3508-165-0x0000000000000000-mapping.dmp

Download
memory/4336-143-0x0000000000000000-mapping.dmp

Download
memory/4452-138-0x0000000005670000-0x0000000005C14000-memory.dmp

Filesize
5.6MB

Download
memory/4452-137-0x0000000000700000-0x000000000078C000-memory.dmp

Filesize
560KB

Download
memory/4452-140-0x00000000051D0000-0x0000000005236000-memory.dmp

Filesize
408KB

Download
memory/4452-139-0x00000000050C0000-0x0000000005152000-memory.dmp

Filesize
584KB

Download
memory/4452-133-0x0000000000000000-mapping.dmp

Download
memory/4452-142-0x0000000006250000-0x000000000628C000-memory.dmp

Filesize
240KB

Download
memory/4452-141-0x0000000005E20000-0x0000000005E32000-memory.dmp

Filesize
72KB

Download
memory/4476-154-0x0000000006210000-0x000000000621A000-memory.dmp

Filesize
40KB

Download
memory/4476-144-0x0000000000000000-mapping.dmp

Download
memory/4516-150-0x0000000004A90000-0x0000000004AB2000-memory.dmp

Filesize
136KB

Download
memory/4516-159-0x0000000006D30000-0x0000000006D4A000-memory.dmp

Filesize
104KB

Download
memory/4516-152-0x0000000005A30000-0x0000000005A4E000-memory.dmp

Filesize
120KB

Download
memory/4516-147-0x0000000000000000-mapping.dmp

Download
memory/4516-148-0x0000000004450000-0x0000000004486000-memory.dmp

Filesize
216KB

Download
memory/4516-155-0x0000000006020000-0x0000000006052000-memory.dmp

Filesize
200KB

Download
memory/4516-156-0x000000006FFF0000-0x000000007003C000-memory.dmp

Filesize
304KB

Download
memory/4516-157-0x0000000005FE0000-0x0000000005FFE000-memory.dmp

Filesize
120KB

Download
memory/4516-158-0x0000000007380000-0x00000000079FA000-memory.dmp

Filesize
6.5MB

Download
memory/4516-151-0x00000000051F0000-0x0000000005256000-memory.dmp

Filesize
408KB

Download
memory/4516-160-0x0000000006DA0000-0x0000000006DAA000-memory.dmp

Filesize
40KB

Download
memory/4516-161-0x0000000006FB0000-0x0000000007046000-memory.dmp

Filesize
600KB

Download
memory/4516-162-0x0000000006F60000-0x0000000006F6E000-memory.dmp

Filesize
56KB

Download
memory/4516-163-0x0000000007070000-0x000000000708A000-memory.dmp

Filesize
104KB

Download
memory/4516-164-0x0000000007050000-0x0000000007058000-memory.dmp

Filesize
32KB

Download
memory/4516-149-0x0000000004AD0000-0x00000000050F8000-memory.dmp

Filesize
6.2MB

Download
memory/4788-132-0x0000000074D40000-0x00000000752F1000-memory.dmp

Filesize
5.7MB

Download
memory/4788-136-0x0000000074D40000-0x00000000752F1000-memory.dmp

Filesize
5.7MB

Download
memory/5064-153-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads