Overview

overview

10

Static

static

1

ren_installer.exe.vbs

windows7-x64

10

ren_installer.exe.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    178s
  • max time network
    185s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-05-2023 10:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ren_installer.exe.vbs

  • Size

    4.4MB

  • MD5

    536ac26b63fe850c37ba9bed94792656

  • SHA1

    2ed38ec15f4d9c2f3f62b9e76f7e867708be52a2

  • SHA256

    ecb6ddd0b697ef6d270088b45d347254cc79cda47ad7bde0b02ac50f4b668ea0

  • SHA512

    95eda90758885dddc514cf7a71bb186fa566827d1dceeee1dafb554dc6081fb3f794b276612154679df3c86c1537114b9003543420bdab761d2eeb04e1b47900

  • SSDEEP

    24576:NLSIeHVl7qq8Kpz3e4WlOnNHYadMpdJp2n1WT1L4whffYob7zdqx0nllmZw3/PLe:RYp7SThIEHcsleGEZZAn7i4Ch

Score
10/10
quasarreservicesspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

ReServices

C2

185.65.134.175:55498

Mutex

86e242cc-399d-4e30-a743-e89f0418f106

Attributes
  • encryption_key

    B451C26057A2AEFC83990793720D2316EA48C49A

  • install_name

    renservice.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    renservice

  • subdirectory

    servicerenk

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Kills process with taskkill 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ren_installer.exe.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3836
    • C:\Users\Admin\AppData\Local\Temp\ren_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\ren_installer.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3280
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "renservice" /sc ONLOGON /tr "C:\Windows\system32\servicerenk\renservice.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:4460
      • C:\Windows\system32\servicerenk\renservice.exe
        "C:\Windows\system32\servicerenk\renservice.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2460
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks" /create /tn "renservice" /sc ONLOGON /tr "C:\Windows\system32\servicerenk\renservice.exe" /rl HIGHEST /f
          4⤵
          • Creates scheduled task(s)
          PID:3328
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /K CHCP 437
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1792
          • C:\Windows\system32\chcp.com
            CHCP 437
            5⤵
              PID:3940
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im svchost.exe
              5⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4924
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2696

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    3
    T1012

    System Information Discovery

    3
    T1082

    Peripheral Device Discovery

    1
    T1120

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\ren_installer.exe
      Filesize

      3.1MB

      MD5

      10c9f8a8e8c8c9797643d9b1edb01cc1

      SHA1

      defcd4e8bba01bb730572dff40fad78e053f337a

      SHA256

      0809e0c6095acabdcb816728c39fc818741c3197c4635d7a53a926f2f8df7557

      SHA512

      a3c1e18ed24bcc03385a6cb7e50bae9c475c93f0a9af88ac731e9c1923b314ea60e79bd4b9b420b31050ea2d67ac6746cb7d3b2edba7056e91fd665f12311849

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\ren_installer.exe
      Filesize

      3.1MB

      MD5

      10c9f8a8e8c8c9797643d9b1edb01cc1

      SHA1

      defcd4e8bba01bb730572dff40fad78e053f337a

      SHA256

      0809e0c6095acabdcb816728c39fc818741c3197c4635d7a53a926f2f8df7557

      SHA512

      a3c1e18ed24bcc03385a6cb7e50bae9c475c93f0a9af88ac731e9c1923b314ea60e79bd4b9b420b31050ea2d67ac6746cb7d3b2edba7056e91fd665f12311849

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\ren_installer.exe
      Filesize

      3.1MB

      MD5

      10c9f8a8e8c8c9797643d9b1edb01cc1

      SHA1

      defcd4e8bba01bb730572dff40fad78e053f337a

      SHA256

      0809e0c6095acabdcb816728c39fc818741c3197c4635d7a53a926f2f8df7557

      SHA512

      a3c1e18ed24bcc03385a6cb7e50bae9c475c93f0a9af88ac731e9c1923b314ea60e79bd4b9b420b31050ea2d67ac6746cb7d3b2edba7056e91fd665f12311849

      Download Submit
    • C:\Windows\System32\servicerenk\renservice.exe
      Filesize

      3.1MB

      MD5

      10c9f8a8e8c8c9797643d9b1edb01cc1

      SHA1

      defcd4e8bba01bb730572dff40fad78e053f337a

      SHA256

      0809e0c6095acabdcb816728c39fc818741c3197c4635d7a53a926f2f8df7557

      SHA512

      a3c1e18ed24bcc03385a6cb7e50bae9c475c93f0a9af88ac731e9c1923b314ea60e79bd4b9b420b31050ea2d67ac6746cb7d3b2edba7056e91fd665f12311849

      Download Submit
    • C:\Windows\system32\servicerenk\renservice.exe
      Filesize

      3.1MB

      MD5

      10c9f8a8e8c8c9797643d9b1edb01cc1

      SHA1

      defcd4e8bba01bb730572dff40fad78e053f337a

      SHA256

      0809e0c6095acabdcb816728c39fc818741c3197c4635d7a53a926f2f8df7557

      SHA512

      a3c1e18ed24bcc03385a6cb7e50bae9c475c93f0a9af88ac731e9c1923b314ea60e79bd4b9b420b31050ea2d67ac6746cb7d3b2edba7056e91fd665f12311849

      Download Submit
    • memory/2460-171-0x000000001BFB0000-0x000000001BFC0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2460-170-0x000000001CA40000-0x000000001CA7C000-memory.dmp
      Filesize

      240KB

      Download
    • memory/2460-169-0x000000001C980000-0x000000001C992000-memory.dmp
      Filesize

      72KB

      Download
    • memory/2460-168-0x000000001CAC0000-0x000000001CB72000-memory.dmp
      Filesize

      712KB

      Download
    • memory/2460-167-0x000000001C9B0000-0x000000001CA00000-memory.dmp
      Filesize

      320KB

      Download
    • memory/2460-166-0x000000001BFB0000-0x000000001BFC0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2696-144-0x0000026F3F0B0000-0x0000026F3F0B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2696-134-0x0000026F3F0B0000-0x0000026F3F0B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2696-133-0x0000026F3F0B0000-0x0000026F3F0B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2696-135-0x0000026F3F0B0000-0x0000026F3F0B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2696-139-0x0000026F3F0B0000-0x0000026F3F0B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2696-145-0x0000026F3F0B0000-0x0000026F3F0B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2696-140-0x0000026F3F0B0000-0x0000026F3F0B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2696-143-0x0000026F3F0B0000-0x0000026F3F0B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2696-141-0x0000026F3F0B0000-0x0000026F3F0B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2696-142-0x0000026F3F0B0000-0x0000026F3F0B1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3280-158-0x0000000000020000-0x0000000000344000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/3280-159-0x000000001AFB0000-0x000000001AFC0000-memory.dmp
      Filesize

      64KB

      Download