quasar | 5b11f30be6e3bfb808c25d07b492cfa12840fd0efa795d8af397feba045d1c59

Analysis

max time kernel
42s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4942e9c13479bc1a62bdb07b23474e3c.exe
Size

639KB
MD5

4942e9c13479bc1a62bdb07b23474e3c
SHA1

d7a7283939a2fa4506b47fa809431b9cc4d2559e
SHA256

5b11f30be6e3bfb808c25d07b492cfa12840fd0efa795d8af397feba045d1c59
SHA512

8c8edd299922fcfa100e3e725d1b09259a86e41546361273c386177a3e2a765ffc76169a5b9d142efb4c5335bee3805c1f908c7f4edae0f0a33f2631a037eb59
SSDEEP

12288:66bJhnrd2Qsm/+/dnGz7O0Y244sMYcoFMVyMg+Yy1Wcwemn58WgxWM:6kJhngpn9kNsMwbMgkK58WgQM

Score

10^/10

quasar venomrat sep05 evasion persistence rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

SEP05

23.105.131.187:7812

Mutex

VNM_MUTEX_ea14HLQ5adxyrFdD2X

Attributes

encryption_key
jUWfdDb1toPE0KAlGJWH
install_name
Windows Security.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update Service
subdirectory
Windows Security Update

Signatures

Contains code to disable Windows Defender 5 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/2764-18-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/2764-16-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/2764-13-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/2764-10-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/2764-9-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

4942e9c13479bc1a62bdb07b23474e3c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	4942e9c13479bc1a62bdb07b23474e3c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	4942e9c13479bc1a62bdb07b23474e3c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	4942e9c13479bc1a62bdb07b23474e3c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	4942e9c13479bc1a62bdb07b23474e3c.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2764-18-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/2764-16-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/2764-13-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/2764-10-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/2764-9-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat
Executes dropped EXE 2 IoCs

Processes:

Windows Security.exeWindows Security.exe

pid process

2904 Windows Security.exe
1172 Windows Security.exe
Loads dropped DLL 3 IoCs

Processes:

4942e9c13479bc1a62bdb07b23474e3c.exeWindows Security.exe

pid process

2764 4942e9c13479bc1a62bdb07b23474e3c.exe
2904 Windows Security.exe
2904 Windows Security.exe

pid	process
2904	Windows Security.exe
1172	Windows Security.exe

pid	process
2764	4942e9c13479bc1a62bdb07b23474e3c.exe
2904	Windows Security.exe
2904	Windows Security.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

4942e9c13479bc1a62bdb07b23474e3c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	4942e9c13479bc1a62bdb07b23474e3c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	4942e9c13479bc1a62bdb07b23474e3c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4942e9c13479bc1a62bdb07b23474e3c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jEWDfCdAGM = "C:\\Users\\Admin\\AppData\\Roaming\\EcGASfXzFi\\SgBSNdRiPF.exe"	4942e9c13479bc1a62bdb07b23474e3c.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
8 api.ipify.org
10 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

4942e9c13479bc1a62bdb07b23474e3c.exe

description pid process target process

PID 2288 set thread context of 2764 2288 4942e9c13479bc1a62bdb07b23474e3c.exe 4942e9c13479bc1a62bdb07b23474e3c.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2756 schtasks.exe
1072 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2492 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Windows Security.exe

pid process

2904 Windows Security.exe
2904 Windows Security.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4942e9c13479bc1a62bdb07b23474e3c.exeWindows Security.exe

description pid process

Token: SeDebugPrivilege 2764 4942e9c13479bc1a62bdb07b23474e3c.exe
Token: SeDebugPrivilege 2904 Windows Security.exe

flow	ioc
2	ip-api.com
8	api.ipify.org
10	ip-api.com

description	pid	process	target process
PID 2288 set thread context of 2764	2288	4942e9c13479bc1a62bdb07b23474e3c.exe	4942e9c13479bc1a62bdb07b23474e3c.exe

pid	process
2756	schtasks.exe
1072	schtasks.exe

pid	process
2492	PING.EXE

pid	process
2904	Windows Security.exe
2904	Windows Security.exe

description	pid	process
Token: SeDebugPrivilege	2764	4942e9c13479bc1a62bdb07b23474e3c.exe
Token: SeDebugPrivilege	2904	Windows Security.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

4942e9c13479bc1a62bdb07b23474e3c.exe4942e9c13479bc1a62bdb07b23474e3c.exeWindows Security.exe

description	pid	process	target process
PID 2288 wrote to memory of 2764	2288	4942e9c13479bc1a62bdb07b23474e3c.exe	4942e9c13479bc1a62bdb07b23474e3c.exe
PID 2288 wrote to memory of 2764	2288	4942e9c13479bc1a62bdb07b23474e3c.exe	4942e9c13479bc1a62bdb07b23474e3c.exe
PID 2288 wrote to memory of 2764	2288	4942e9c13479bc1a62bdb07b23474e3c.exe	4942e9c13479bc1a62bdb07b23474e3c.exe
PID 2288 wrote to memory of 2764	2288	4942e9c13479bc1a62bdb07b23474e3c.exe	4942e9c13479bc1a62bdb07b23474e3c.exe
PID 2288 wrote to memory of 2764	2288	4942e9c13479bc1a62bdb07b23474e3c.exe	4942e9c13479bc1a62bdb07b23474e3c.exe
PID 2288 wrote to memory of 2764	2288	4942e9c13479bc1a62bdb07b23474e3c.exe	4942e9c13479bc1a62bdb07b23474e3c.exe
PID 2288 wrote to memory of 2764	2288	4942e9c13479bc1a62bdb07b23474e3c.exe	4942e9c13479bc1a62bdb07b23474e3c.exe
PID 2288 wrote to memory of 2764	2288	4942e9c13479bc1a62bdb07b23474e3c.exe	4942e9c13479bc1a62bdb07b23474e3c.exe
PID 2288 wrote to memory of 2764	2288	4942e9c13479bc1a62bdb07b23474e3c.exe	4942e9c13479bc1a62bdb07b23474e3c.exe
PID 2764 wrote to memory of 2756	2764	4942e9c13479bc1a62bdb07b23474e3c.exe	schtasks.exe
PID 2764 wrote to memory of 2756	2764	4942e9c13479bc1a62bdb07b23474e3c.exe	schtasks.exe
PID 2764 wrote to memory of 2756	2764	4942e9c13479bc1a62bdb07b23474e3c.exe	schtasks.exe
PID 2764 wrote to memory of 2756	2764	4942e9c13479bc1a62bdb07b23474e3c.exe	schtasks.exe
PID 2764 wrote to memory of 2904	2764	4942e9c13479bc1a62bdb07b23474e3c.exe	Windows Security.exe
PID 2764 wrote to memory of 2904	2764	4942e9c13479bc1a62bdb07b23474e3c.exe	Windows Security.exe
PID 2764 wrote to memory of 2904	2764	4942e9c13479bc1a62bdb07b23474e3c.exe	Windows Security.exe
PID 2764 wrote to memory of 2904	2764	4942e9c13479bc1a62bdb07b23474e3c.exe	Windows Security.exe
PID 2764 wrote to memory of 3016	2764	4942e9c13479bc1a62bdb07b23474e3c.exe	powershell.exe
PID 2764 wrote to memory of 3016	2764	4942e9c13479bc1a62bdb07b23474e3c.exe	powershell.exe
PID 2764 wrote to memory of 3016	2764	4942e9c13479bc1a62bdb07b23474e3c.exe	powershell.exe
PID 2764 wrote to memory of 3016	2764	4942e9c13479bc1a62bdb07b23474e3c.exe	powershell.exe
PID 2904 wrote to memory of 1172	2904	Windows Security.exe	Windows Security.exe
PID 2904 wrote to memory of 1172	2904	Windows Security.exe	Windows Security.exe
PID 2904 wrote to memory of 1172	2904	Windows Security.exe	Windows Security.exe
PID 2904 wrote to memory of 1172	2904	Windows Security.exe	Windows Security.exe
PID 2904 wrote to memory of 1940	2904	Windows Security.exe	Windows Security.exe
PID 2904 wrote to memory of 1940	2904	Windows Security.exe	Windows Security.exe
PID 2904 wrote to memory of 1940	2904	Windows Security.exe	Windows Security.exe
PID 2904 wrote to memory of 1940	2904	Windows Security.exe	Windows Security.exe
PID 2904 wrote to memory of 1940	2904	Windows Security.exe	Windows Security.exe
PID 2904 wrote to memory of 1940	2904	Windows Security.exe	Windows Security.exe

C:\Users\Admin\AppData\Local\Temp\4942e9c13479bc1a62bdb07b23474e3c.exe
"C:\Users\Admin\AppData\Local\Temp\4942e9c13479bc1a62bdb07b23474e3c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Local\Temp\4942e9c13479bc1a62bdb07b23474e3c.exe
  "C:\Users\Admin\AppData\Local\Temp\4942e9c13479bc1a62bdb07b23474e3c.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Loads dropped DLL
  - Windows security modification
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Windows Update Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\4942e9c13479bc1a62bdb07b23474e3c.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2756
- - C:\Users\Admin\AppData\Roaming\Windows Security Update\Windows Security.exe
    "C:\Users\Admin\AppData\Roaming\Windows Security Update\Windows Security.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Users\Admin\AppData\Roaming\Windows Security Update\Windows Security.exe
      "C:\Users\Admin\AppData\Roaming\Windows Security Update\Windows Security.exe"
      4⤵
      PID:1940
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows Update Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Security Update\Windows Security.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:1072
  - - C:\Users\Admin\AppData\Roaming\Windows Security Update\Windows Security.exe
      "C:\Users\Admin\AppData\Roaming\Windows Security Update\Windows Security.exe"
      4⤵
      Executes dropped EXE
      PID:1172
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    PID:1240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      PID:912
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\KmzLoGCI0k6d.bat" "
    3⤵
    PID:1656
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:1312
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\4942e9c13479bc1a62bdb07b23474e3c.exe
      "C:\Users\Admin\AppData\Local\Temp\4942e9c13479bc1a62bdb07b23474e3c.exe"
      4⤵
      PID:3004

C:\Users\Admin\AppData\Local\Temp\4942e9c13479bc1a62bdb07b23474e3c.exe
"C:\Users\Admin\AppData\Local\Temp\4942e9c13479bc1a62bdb07b23474e3c.exe"
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-69-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/1940-70-0x00000000048A0000-0x00000000048E0000-memory.dmp

Filesize
256KB

Download
memory/1940-42-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1940-51-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/1940-52-0x00000000048A0000-0x00000000048E0000-memory.dmp

Filesize
256KB

Download
memory/2076-133-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2076-142-0x00000000007E0000-0x0000000000820000-memory.dmp

Filesize
256KB

Download
memory/2076-143-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2076-141-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2076-144-0x00000000007E0000-0x0000000000820000-memory.dmp

Filesize
256KB

Download
memory/2288-15-0x0000000074430000-0x0000000074B1E000-memory.dmp

Filesize
6.9MB

Download
memory/2288-2-0x0000000004930000-0x0000000004970000-memory.dmp

Filesize
256KB

Download
memory/2288-1-0x0000000000D00000-0x0000000000DA6000-memory.dmp

Filesize
664KB

Download
memory/2288-0-0x0000000074430000-0x0000000074B1E000-memory.dmp

Filesize
6.9MB

Download
memory/2288-4-0x00000000008D0000-0x00000000008DA000-memory.dmp

Filesize
40KB

Download
memory/2764-10-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2764-5-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2764-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2764-7-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2764-22-0x0000000004B60000-0x0000000004BA0000-memory.dmp

Filesize
256KB

Download
memory/2764-9-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2764-19-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-21-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-13-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2764-125-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-18-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2764-16-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2764-20-0x0000000004B60000-0x0000000004BA0000-memory.dmp

Filesize
256KB

Download
memory/2904-30-0x0000000000BA0000-0x0000000000C46000-memory.dmp

Filesize
664KB

Download
memory/2904-50-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2904-32-0x0000000004790000-0x00000000047D0000-memory.dmp

Filesize
256KB

Download
memory/2904-31-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/3004-127-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/3004-126-0x0000000000320000-0x00000000003C6000-memory.dmp

Filesize
664KB

Download
memory/3004-138-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/3004-128-0x00000000044C0000-0x0000000004500000-memory.dmp

Filesize
256KB

Download
memory/3016-60-0x000000006EED0000-0x000000006F47B000-memory.dmp

Filesize
5.7MB

Download
memory/3016-59-0x00000000027D0000-0x0000000002810000-memory.dmp

Filesize
256KB

Download
memory/3016-58-0x00000000027D0000-0x0000000002810000-memory.dmp

Filesize
256KB

Download
memory/3016-55-0x000000006EED0000-0x000000006F47B000-memory.dmp

Filesize
5.7MB

Download
memory/3016-57-0x000000006EED0000-0x000000006F47B000-memory.dmp

Filesize
5.7MB

Download
memory/3016-56-0x00000000027D0000-0x0000000002810000-memory.dmp

Filesize
256KB

Download