quasar | a1b00fd448ba5ec440a0bbd9b477288807dbf759b15c6f781a87226b79083f2d

General

Target

05159daa9939d1b218bcd18d07055665.exe
Size

13.0MB
MD5

05159daa9939d1b218bcd18d07055665
SHA1

ff502ce30b8137501711c8b7efe9244cff090cd8
SHA256

a1b00fd448ba5ec440a0bbd9b477288807dbf759b15c6f781a87226b79083f2d
SHA512

b8df847c873cde712b7d524b2fe13d61bb35522b6cf47fadf477b1742998cca6b8ef22ed2818b6aa71517772ad3bab31c74ca32680536c655dc289cea2e4fdc7
SSDEEP

24576:CVDWxGj2lcr3QYRnnLru9Gw1GbGCnAYgaBXA4sEM25/MXfBaeBs0w3Ak5uFUZwnH:

Score

10^/10

quasar venom client evasion spyware trojan

Malware Config

Extracted

Family

quasar

Version

2.7.0.0

Botnet

Venom Client

C2

127.0.0.1:4782

Mutex

l3btHxEeSzq4eOd1Xn

Attributes

encryption_key
QLpk8Rk5kZNzYEIHJl2g
install_name
Venom.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3856-24-0x0000000000400000-0x0000000000510000-memory.dmp	family_quasar

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

05159daa9939d1b218bcd18d07055665.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	05159daa9939d1b218bcd18d07055665.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Resources\Themes\aero\Shell\UDd5UTb29G4w724\svchost.exe = "0"	05159daa9939d1b218bcd18d07055665.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

05159daa9939d1b218bcd18d07055665.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	05159daa9939d1b218bcd18d07055665.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Resources\Themes\aero\Shell\UDd5UTb29G4w724\svchost.exe = "0"	05159daa9939d1b218bcd18d07055665.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	05159daa9939d1b218bcd18d07055665.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

21 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

05159daa9939d1b218bcd18d07055665.exe

description pid process target process

PID 5028 set thread context of 3368 5028 05159daa9939d1b218bcd18d07055665.exe 05159daa9939d1b218bcd18d07055665.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3344 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

05159daa9939d1b218bcd18d07055665.exe

description pid process

Token: SeDebugPrivilege 5028 05159daa9939d1b218bcd18d07055665.exe

flow	ioc
21	ip-api.com

description	pid	process	target process
PID 5028 set thread context of 3368	5028	05159daa9939d1b218bcd18d07055665.exe	05159daa9939d1b218bcd18d07055665.exe

pid	process
3344	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	5028	05159daa9939d1b218bcd18d07055665.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

05159daa9939d1b218bcd18d07055665.exe

description	pid	process	target process
PID 5028 wrote to memory of 1724	5028	05159daa9939d1b218bcd18d07055665.exe	05159daa9939d1b218bcd18d07055665.exe
PID 5028 wrote to memory of 1724	5028	05159daa9939d1b218bcd18d07055665.exe	05159daa9939d1b218bcd18d07055665.exe
PID 5028 wrote to memory of 1724	5028	05159daa9939d1b218bcd18d07055665.exe	05159daa9939d1b218bcd18d07055665.exe
PID 5028 wrote to memory of 1244	5028	05159daa9939d1b218bcd18d07055665.exe	05159daa9939d1b218bcd18d07055665.exe
PID 5028 wrote to memory of 1244	5028	05159daa9939d1b218bcd18d07055665.exe	05159daa9939d1b218bcd18d07055665.exe
PID 5028 wrote to memory of 1244	5028	05159daa9939d1b218bcd18d07055665.exe	05159daa9939d1b218bcd18d07055665.exe
PID 5028 wrote to memory of 3368	5028	05159daa9939d1b218bcd18d07055665.exe	05159daa9939d1b218bcd18d07055665.exe
PID 5028 wrote to memory of 3368	5028	05159daa9939d1b218bcd18d07055665.exe	05159daa9939d1b218bcd18d07055665.exe
PID 5028 wrote to memory of 3368	5028	05159daa9939d1b218bcd18d07055665.exe	05159daa9939d1b218bcd18d07055665.exe
PID 5028 wrote to memory of 3368	5028	05159daa9939d1b218bcd18d07055665.exe	05159daa9939d1b218bcd18d07055665.exe
PID 5028 wrote to memory of 3368	5028	05159daa9939d1b218bcd18d07055665.exe	05159daa9939d1b218bcd18d07055665.exe
PID 5028 wrote to memory of 3368	5028	05159daa9939d1b218bcd18d07055665.exe	05159daa9939d1b218bcd18d07055665.exe
PID 5028 wrote to memory of 3368	5028	05159daa9939d1b218bcd18d07055665.exe	05159daa9939d1b218bcd18d07055665.exe
PID 5028 wrote to memory of 3368	5028	05159daa9939d1b218bcd18d07055665.exe	05159daa9939d1b218bcd18d07055665.exe

C:\Users\Admin\AppData\Local\Temp\05159daa9939d1b218bcd18d07055665.exe
"C:\Users\Admin\AppData\Local\Temp\05159daa9939d1b218bcd18d07055665.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028

C:\Users\Admin\AppData\Local\Temp\05159daa9939d1b218bcd18d07055665.exe
C:\Users\Admin\AppData\Local\Temp\05159daa9939d1b218bcd18d07055665.exe
2⤵
PID:1724

C:\Users\Admin\AppData\Local\Temp\05159daa9939d1b218bcd18d07055665.exe
C:\Users\Admin\AppData\Local\Temp\05159daa9939d1b218bcd18d07055665.exe
2⤵
- Windows security bypass
- Windows security modification
PID:3368

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\05159daa9939d1b218bcd18d07055665.exe" -Force
3⤵
PID:464

C:\Users\Admin\AppData\Local\Temp\05159daa9939d1b218bcd18d07055665.exe
C:\Users\Admin\AppData\Local\Temp\05159daa9939d1b218bcd18d07055665.exe
3⤵
PID:3856

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Venom.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:3344

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Execution.vbs
4⤵
PID:3980

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\UDd5UTb29G4w724\svchost.exe" -Force
3⤵
PID:2732

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\UDd5UTb29G4w724\svchost.exe" -Force
3⤵
PID:4032

C:\Users\Admin\AppData\Local\Temp\05159daa9939d1b218bcd18d07055665.exe
C:\Users\Admin\AppData\Local\Temp\05159daa9939d1b218bcd18d07055665.exe
2⤵
PID:1244

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4632

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Execution.vbs"
2⤵
PID:3848

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/464-79-0x00000000075B0000-0x0000000007653000-memory.dmp

Filesize
652KB

Download
memory/464-111-0x0000000007930000-0x000000000793E000-memory.dmp

Filesize
56KB

Download
memory/464-109-0x0000000007900000-0x0000000007911000-memory.dmp

Filesize
68KB

Download
memory/464-119-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/464-76-0x0000000007540000-0x000000000755E000-memory.dmp

Filesize
120KB

Download
memory/464-78-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/464-114-0x0000000007A20000-0x0000000007A28000-memory.dmp

Filesize
32KB

Download
memory/464-113-0x0000000007A40000-0x0000000007A5A000-memory.dmp

Filesize
104KB

Download
memory/464-61-0x00000000063D0000-0x00000000063EE000-memory.dmp

Filesize
120KB

Download
memory/464-21-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/464-62-0x0000000006480000-0x00000000064CC000-memory.dmp

Filesize
304KB

Download
memory/464-66-0x0000000071EE0000-0x0000000071F2C000-memory.dmp

Filesize
304KB

Download
memory/464-112-0x0000000007940000-0x0000000007954000-memory.dmp

Filesize
80KB

Download
memory/464-64-0x000000007FBE0000-0x000000007FBF0000-memory.dmp

Filesize
64KB

Download
memory/464-23-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/464-65-0x0000000007560000-0x0000000007592000-memory.dmp

Filesize
200KB

Download
memory/464-22-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2732-124-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/2732-27-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/2732-25-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/2732-26-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/2732-92-0x0000000071EE0000-0x0000000071F2C000-memory.dmp

Filesize
304KB

Download
memory/3368-17-0x000000000A610000-0x000000000A6A2000-memory.dmp

Filesize
584KB

Download
memory/3368-20-0x00000000080B0000-0x00000000080BA000-memory.dmp

Filesize
40KB

Download
memory/3368-10-0x00000000058D0000-0x00000000058E0000-memory.dmp

Filesize
64KB

Download
memory/3368-12-0x0000000009B60000-0x000000000A104000-memory.dmp

Filesize
5.6MB

Download
memory/3368-33-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/3368-11-0x0000000009440000-0x00000000095A6000-memory.dmp

Filesize
1.4MB

Download
memory/3368-8-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/3368-5-0x0000000000400000-0x0000000000892000-memory.dmp

Filesize
4.6MB

Download
memory/3856-107-0x0000000007180000-0x00000000071BC000-memory.dmp

Filesize
240KB

Download
memory/3856-35-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/3856-126-0x0000000005C20000-0x0000000005C30000-memory.dmp

Filesize
64KB

Download
memory/3856-63-0x0000000006B00000-0x0000000006B12000-memory.dmp

Filesize
72KB

Download
memory/3856-24-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/3856-125-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/4032-15-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/4032-19-0x0000000005260000-0x0000000005888000-memory.dmp

Filesize
6.2MB

Download
memory/4032-91-0x0000000000F90000-0x0000000000FA0000-memory.dmp

Filesize
64KB

Download
memory/4032-90-0x0000000000F90000-0x0000000000FA0000-memory.dmp

Filesize
64KB

Download
memory/4032-18-0x0000000000F90000-0x0000000000FA0000-memory.dmp

Filesize
64KB

Download
memory/4032-104-0x0000000007450000-0x000000000746A000-memory.dmp

Filesize
104KB

Download
memory/4032-105-0x0000000000F90000-0x0000000000FA0000-memory.dmp

Filesize
64KB

Download
memory/4032-106-0x00000000074C0000-0x00000000074CA000-memory.dmp

Filesize
40KB

Download
memory/4032-94-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/4032-77-0x0000000071EE0000-0x0000000071F2C000-memory.dmp

Filesize
304KB

Download
memory/4032-14-0x0000000002800000-0x0000000002836000-memory.dmp

Filesize
216KB

Download
memory/4032-108-0x00000000076D0000-0x0000000007766000-memory.dmp

Filesize
600KB

Download
memory/4032-93-0x0000000007A90000-0x000000000810A000-memory.dmp

Filesize
6.5MB

Download
memory/4032-84-0x000000007FC60000-0x000000007FC70000-memory.dmp

Filesize
64KB

Download
memory/4032-41-0x0000000005C20000-0x0000000005C86000-memory.dmp

Filesize
408KB

Download
memory/4032-16-0x0000000000F90000-0x0000000000FA0000-memory.dmp

Filesize
64KB

Download
memory/4032-51-0x0000000005CC0000-0x0000000006014000-memory.dmp

Filesize
3.3MB

Download
memory/4032-34-0x00000000059A0000-0x00000000059C2000-memory.dmp

Filesize
136KB

Download
memory/4032-40-0x0000000005B40000-0x0000000005BA6000-memory.dmp

Filesize
408KB

Download
memory/4032-120-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/5028-3-0x0000000007180000-0x0000000007190000-memory.dmp

Filesize
64KB

Download
memory/5028-0-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/5028-4-0x0000000007190000-0x0000000007634000-memory.dmp

Filesize
4.6MB

Download
memory/5028-2-0x0000000006430000-0x00000000064CC000-memory.dmp

Filesize
624KB

Download
memory/5028-9-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/5028-1-0x0000000000D90000-0x0000000001A96000-memory.dmp

Filesize
13.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads