quasar | 329b98802dad1219886d6912d0d5303f7d8012ff2c27fe0bd917b5b069865903

Analysis

max time kernel
46s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 17:30

Target

329b98802dad1219886d6912d0d5303f7d8012ff2c27fe0bd917b5b069865903.exe
Size

1.0MB
MD5

fc6cd521af42d5423b8ce0e53ae67703
SHA1

49a14b2ba77028b1dfb8167bdafdd2908c40f861
SHA256

329b98802dad1219886d6912d0d5303f7d8012ff2c27fe0bd917b5b069865903
SHA512

0de482d1f6ae53197da70045f84f2071e3a17b9cc90a4e3b7c68c1210590fe5f6eb4ec86d1c233e4c0c4662fb639c861bed0c869509ddf9cf53b9b3b4b841bab
SSDEEP

24576:ucvkTM6qPOgKbORmiNbbAb21NUJ2k+U1kYC80Oy2dj08:pvkT9Q+4miNG217k9Z5x

Score

10^/10

Family

quasar

Version

2.1.0.0

Botnet

Office04

127.0.0.1:4782

rat94522.ddnsking.com:4000

Mutex

VNM_MUTEX_c2q7y2ayYutZ2XaYe7

Attributes

Contains code to disable Windows Defender 5 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/files/0x000500000001daff-146.dat	disable_win_def
behavioral2/files/0x000500000001daff-147.dat	disable_win_def
behavioral2/memory/1984-148-0x0000000000380000-0x000000000040C000-memory.dmp	disable_win_def
behavioral2/files/0x0008000000022e1d-153.dat	disable_win_def
behavioral2/files/0x0008000000022e1d-154.dat	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

Modify Registry

Modify Existing Service

Disabling Security Tools

Processes:

file1.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	file1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	file1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	file1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	file1.exe

Quasar RAT 3 IoCs

Quasar is an open source Remote Access Tool.

Processes:

329b98802dad1219886d6912d0d5303f7d8012ff2c27fe0bd917b5b069865903.exe

description	flow	ioc	Process
Key value queried		\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	329b98802dad1219886d6912d0d5303f7d8012ff2c27fe0bd917b5b069865903.exe
	14	ip-api.com