Analysis
- max time kernel
148s - max time network
164s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
09/01/2024, 18:53
General
- Target 4ef1927705d28faf8456c200397d0af6.exe
- Size 792KB
- Sample240109-xjs53shfa4
- SHA256 cd5a8de963a29d07bb003a8d03fa7ba38e5004641fe8138885c967db46bef0fc
Malware Config
Extracted
-
quasar
-
2.1.0.0
-
Office04
-
192.168.1.154:4782
-
VNM_MUTEX_ph9lkMeWS6xgznetvP
-
encryption_key
2ABr09PX2FCCobHek8sv
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
-
subdirectory
SubDir
Signatures
- Contains code to disable Windows Defender 3 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 3 IoCs
- VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ef1927705d28faf8456c200397d0af6.exe"C:\Users\Admin\AppData\Local\Temp\4ef1927705d28faf8456c200397d0af6.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\4ef1927705d28faf8456c200397d0af6.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TlIea1i3zqmj.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\4ef1927705d28faf8456c200397d0af6.exe"C:\Users\Admin\AppData\Local\Temp\4ef1927705d28faf8456c200397d0af6.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
4ef1927705d28faf8456c200397d0af6.exe.log
TlIea1i3zqmj.bat
__PSScriptPolicyTest_vwul0ibe.kh3.ps1
Client.exe
Client.exe
memory/2068-6-0x00000000064F0000-0x0000000006502000-memory.dmp
memory/2068-3-0x00000000053F0000-0x0000000005482000-memory.dmp
memory/2068-7-0x0000000006930000-0x000000000696C000-memory.dmp
memory/2068-5-0x0000000005490000-0x00000000054F6000-memory.dmp
memory/2068-4-0x0000000005540000-0x0000000005550000-memory.dmp
memory/2068-0-0x00000000750C0000-0x0000000075870000-memory.dmp
memory/2068-62-0x00000000750C0000-0x0000000075870000-memory.dmp
memory/2068-63-0x0000000005540000-0x0000000005550000-memory.dmp
memory/2068-1-0x00000000008D0000-0x000000000099C000-memory.dmp
memory/2068-2-0x0000000005900000-0x0000000005EA4000-memory.dmp
memory/2068-71-0x00000000750C0000-0x0000000075870000-memory.dmp
memory/3944-74-0x0000000004F30000-0x0000000004F40000-memory.dmp
memory/3944-73-0x00000000750C0000-0x0000000075870000-memory.dmp
memory/3944-75-0x00000000750C0000-0x0000000075870000-memory.dmp
memory/3944-76-0x0000000004F30000-0x0000000004F40000-memory.dmp
memory/4800-49-0x00000000065F0000-0x00000000065FA000-memory.dmp
memory/4800-66-0x0000000004E50000-0x0000000004E60000-memory.dmp
memory/4800-64-0x00000000750C0000-0x0000000075870000-memory.dmp
memory/4800-16-0x0000000004E50000-0x0000000004E60000-memory.dmp
memory/4800-12-0x00000000750C0000-0x0000000075870000-memory.dmp
memory/4804-46-0x0000000006950000-0x000000000696E000-memory.dmp
memory/4804-58-0x00000000079F0000-0x00000000079F8000-memory.dmp
memory/4804-35-0x0000000006970000-0x00000000069A2000-memory.dmp
memory/4804-34-0x000000007F820000-0x000000007F830000-memory.dmp
memory/4804-36-0x00000000704C0000-0x000000007050C000-memory.dmp
memory/4804-50-0x0000000007D10000-0x000000000838A000-memory.dmp
memory/4804-51-0x00000000076D0000-0x00000000076EA000-memory.dmp
memory/4804-52-0x0000000007740000-0x000000000774A000-memory.dmp
memory/4804-53-0x0000000007950000-0x00000000079E6000-memory.dmp
memory/4804-54-0x00000000078D0000-0x00000000078E1000-memory.dmp
memory/4804-55-0x0000000007900000-0x000000000790E000-memory.dmp
memory/4804-56-0x0000000007910000-0x0000000007924000-memory.dmp
memory/4804-57-0x0000000007A10000-0x0000000007A2A000-memory.dmp
memory/4804-47-0x0000000006A00000-0x0000000006AA3000-memory.dmp
memory/4804-61-0x00000000750C0000-0x0000000075870000-memory.dmp
memory/4804-33-0x0000000004DB0000-0x0000000004DC0000-memory.dmp
memory/4804-32-0x0000000006400000-0x000000000644C000-memory.dmp
memory/4804-31-0x00000000063C0000-0x00000000063DE000-memory.dmp
memory/4804-30-0x0000000005D40000-0x0000000006094000-memory.dmp
memory/4804-20-0x0000000005BB0000-0x0000000005C16000-memory.dmp
memory/4804-19-0x0000000005A90000-0x0000000005AB2000-memory.dmp
memory/4804-18-0x0000000005430000-0x0000000005A58000-memory.dmp
memory/4804-14-0x0000000004DB0000-0x0000000004DC0000-memory.dmp
memory/4804-17-0x0000000004DB0000-0x0000000004DC0000-memory.dmp
memory/4804-15-0x0000000004DC0000-0x0000000004DF6000-memory.dmp
memory/4804-13-0x00000000750C0000-0x0000000075870000-memory.dmp