quasar | 8d6cb8b53bb014815990250638364db29445ef2d2db6eab813933f8f12e60ff4

Analysis

max time kernel
7s
max time network
11s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 00:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ItroublveTSC-master/ItroublveTSC.exe
Size 2.0MB
Sample240426-a3z2eage79
SHA256 c6820f426b28b93295ca3b768780e8b372424fb72e94b5d0c094b030f53d4721
MD5 7c2da2ae36228b8b66ec5e5029e90d08
SHA1 d636baf89fd305a1f694611097ac6e7bcb1f244c
SHA512 93cbc698211b0ab0f96ab3f0eb8d393bcd04580418e08fc6df9b935a7cdd091b619a0edab4771b4c887264b0eef6846e6e08a7be24a8681848a1885206a29960
SSDEEP 49152:DL+qgtiXBVLcHD/QmJqRsVEzCeePMAnUD:OzcBVYHDjcyVMukAUD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar venomrat office04 evasion rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

zaidtheboii-50153.portmap.host:50153

Mutex

VNM_MUTEX_fNWmZ9wa8oprRXUo73

Attributes

encryption_key
PJRTtGrfOi1c09c0GCYT
install_name
OneDrive.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft One Drive
subdirectory
Microsoft One Drive

Signatures

Contains code to disable Windows Defender 3 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/files/0x000d000000012324-12.dat	disable_win_def
behavioral1/memory/2556-18-0x0000000001190000-0x0000000001220000-memory.dmp	disable_win_def
behavioral1/memory/2528-30-0x00000000003E0000-0x0000000000470000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Microsoft OneDrive.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Microsoft OneDrive.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Microsoft OneDrive.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Microsoft OneDrive.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012324-12.dat	family_quasar
behavioral1/memory/2556-18-0x0000000001190000-0x0000000001220000-memory.dmp	family_quasar
behavioral1/memory/2528-30-0x00000000003E0000-0x0000000000470000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Deletes itself 1 IoCs

pid	Process
596	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
3068	ItroublveTSC.exe
2556	Microsoft OneDrive.exe
2528	OneDrive.exe

Loads dropped DLL 8 IoCs

pid	Process
2940	ItroublveTSC.exe
2940	ItroublveTSC.exe
2556	Microsoft OneDrive.exe
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe
1684	WerFault.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	Microsoft OneDrive.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	Microsoft OneDrive.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe	Microsoft OneDrive.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe	Microsoft OneDrive.exe
File created	C:\Windows\SysWOW64\Microsoft One Drive\r77-x64.dll	Microsoft OneDrive.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1684	2528	WerFault.exe	33

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2460	schtasks.exe
1984	schtasks.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
924	PING.EXE
552	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2864	powershell.exe
2556	Microsoft OneDrive.exe
2556	Microsoft OneDrive.exe
2556	Microsoft OneDrive.exe
2556	Microsoft OneDrive.exe
2556	Microsoft OneDrive.exe
2556	Microsoft OneDrive.exe
2556	Microsoft OneDrive.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	ItroublveTSC.exe
Token: SeDebugPrivilege	2556	Microsoft OneDrive.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2528	OneDrive.exe
Token: SeDebugPrivilege	2528	OneDrive.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	ItroublveTSC.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3068	ItroublveTSC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2528	OneDrive.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 3068	2940	ItroublveTSC.exe	28
PID 2940 wrote to memory of 3068	2940	ItroublveTSC.exe	28
PID 2940 wrote to memory of 3068	2940	ItroublveTSC.exe	28
PID 2940 wrote to memory of 3068	2940	ItroublveTSC.exe	28
PID 2940 wrote to memory of 2556	2940	ItroublveTSC.exe	29
PID 2940 wrote to memory of 2556	2940	ItroublveTSC.exe	29
PID 2940 wrote to memory of 2556	2940	ItroublveTSC.exe	29
PID 2940 wrote to memory of 2556	2940	ItroublveTSC.exe	29
PID 2556 wrote to memory of 2460	2556	Microsoft OneDrive.exe	31
PID 2556 wrote to memory of 2460	2556	Microsoft OneDrive.exe	31
PID 2556 wrote to memory of 2460	2556	Microsoft OneDrive.exe	31
PID 2556 wrote to memory of 2460	2556	Microsoft OneDrive.exe	31
PID 2556 wrote to memory of 2528	2556	Microsoft OneDrive.exe	33
PID 2556 wrote to memory of 2528	2556	Microsoft OneDrive.exe	33
PID 2556 wrote to memory of 2528	2556	Microsoft OneDrive.exe	33
PID 2556 wrote to memory of 2528	2556	Microsoft OneDrive.exe	33
PID 2556 wrote to memory of 2864	2556	Microsoft OneDrive.exe	34
PID 2556 wrote to memory of 2864	2556	Microsoft OneDrive.exe	34
PID 2556 wrote to memory of 2864	2556	Microsoft OneDrive.exe	34
PID 2556 wrote to memory of 2864	2556	Microsoft OneDrive.exe	34
PID 2528 wrote to memory of 1984	2528	OneDrive.exe	36
PID 2528 wrote to memory of 1984	2528	OneDrive.exe	36
PID 2528 wrote to memory of 1984	2528	OneDrive.exe	36
PID 2528 wrote to memory of 1984	2528	OneDrive.exe	36
PID 2528 wrote to memory of 312	2528	OneDrive.exe	38
PID 2528 wrote to memory of 312	2528	OneDrive.exe	38
PID 2528 wrote to memory of 312	2528	OneDrive.exe	38
PID 2528 wrote to memory of 312	2528	OneDrive.exe	38
PID 2528 wrote to memory of 1684	2528	OneDrive.exe	40
PID 2528 wrote to memory of 1684	2528	OneDrive.exe	40
PID 2528 wrote to memory of 1684	2528	OneDrive.exe	40
PID 2528 wrote to memory of 1684	2528	OneDrive.exe	40
PID 312 wrote to memory of 2564	312	cmd.exe	41
PID 312 wrote to memory of 2564	312	cmd.exe	41
PID 312 wrote to memory of 2564	312	cmd.exe	41
PID 312 wrote to memory of 2564	312	cmd.exe	41
PID 312 wrote to memory of 924	312	cmd.exe	42
PID 312 wrote to memory of 924	312	cmd.exe	42
PID 312 wrote to memory of 924	312	cmd.exe	42
PID 312 wrote to memory of 924	312	cmd.exe	42
PID 2556 wrote to memory of 2064	2556	Microsoft OneDrive.exe	43
PID 2556 wrote to memory of 2064	2556	Microsoft OneDrive.exe	43
PID 2556 wrote to memory of 2064	2556	Microsoft OneDrive.exe	43
PID 2556 wrote to memory of 2064	2556	Microsoft OneDrive.exe	43
PID 2064 wrote to memory of 596	2064	cmd.exe	45
PID 2064 wrote to memory of 596	2064	cmd.exe	45
PID 2064 wrote to memory of 596	2064	cmd.exe	45
PID 2064 wrote to memory of 596	2064	cmd.exe	45
PID 2556 wrote to memory of 1272	2556	Microsoft OneDrive.exe	46
PID 2556 wrote to memory of 1272	2556	Microsoft OneDrive.exe	46
PID 2556 wrote to memory of 1272	2556	Microsoft OneDrive.exe	46
PID 2556 wrote to memory of 1272	2556	Microsoft OneDrive.exe	46
PID 1272 wrote to memory of 1496	1272	cmd.exe	48
PID 1272 wrote to memory of 1496	1272	cmd.exe	48
PID 1272 wrote to memory of 1496	1272	cmd.exe	48
PID 1272 wrote to memory of 1496	1272	cmd.exe	48
PID 1272 wrote to memory of 552	1272	cmd.exe	49
PID 1272 wrote to memory of 552	1272	cmd.exe	49
PID 1272 wrote to memory of 552	1272	cmd.exe	49
PID 1272 wrote to memory of 552	1272	cmd.exe	49

C:\Users\Admin\AppData\Local\Temp\ItroublveTSC-master\ItroublveTSC.exe
"C:\Users\Admin\AppData\Local\Temp\ItroublveTSC-master\ItroublveTSC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Roaming\ItroublveTSC.exe
  "C:\Users\Admin\AppData\Roaming\ItroublveTSC.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3068
- C:\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Microsoft One Drive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2460
- - C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe
    "C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Microsoft One Drive" /sc ONLOGON /tr "C:\Windows\SysWOW64\Microsoft One Drive\OneDrive.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:1984
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\klBjzeYUceSa.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:312
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2564
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 1440
      4⤵
      Loads dropped DLL
      Program crash
      PID:1684
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      Deletes itself
      PID:596
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\Ubh8bZ2xxsQD.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 68KB
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar2C65.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar2C65.tmp
Size 177KB
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ubh8bZ2xxsQD.bat

Path C:\Users\Admin\AppData\Local\Temp\Ubh8bZ2xxsQD.bat
Size 215B
SHA256 f34294e1881077106be42010321b74b94fdd9e17e50aee9f0adb84e618ca9d23
MD5 b8d69eb824525d4323b0aeae11666c87
SHA1 67d93a9655e336885906fa680c35b5d5f5418b9d
SHA512 cb19594c8243d7b08d55a6d9cc23518cffc66b0f42e2892ddaea444a8cc131a67bedf942904bc816d363ee1d11c1fcd3208d6a3971e78258db2585e379979278
MD5 SHA1 SHA512

Submit Download

klBjzeYUceSa.bat

Path C:\Users\Admin\AppData\Local\Temp\klBjzeYUceSa.bat
Size 211B
SHA256 6cc55d2f02f197c676946bc87efa9cd81d504a552beb8b4b901c364493af8c30
MD5 672056a69a3e11379d4aa4d1ae863604
SHA1 f888ede81eca74b72ffcd6ce7ff96202d3f15ca2
SHA512 47b737d6f7fb8fc0eb81a61f10f33fb823c630bd7bf43a2a7367f71c919e1117a34c5803a2ed2ae06a440f8548ee3de0811ed7b32c9dfc2f51fe670ff6df0bb6
MD5 SHA1 SHA512

Submit Download

ItroublveTSC.exe

Path C:\Users\Admin\AppData\Roaming\ItroublveTSC.exe
Size 3.9MB
SHA256 584bf67e7c8e93629e175733fe42907e60916047e68f1b4973d4cbf3dd2c22d6
MD5 53f43b1e9d99d6a356a332d9073b4736
SHA1 71e6c5a216a66b2b523b1b022d44c10b276c6195
SHA512 e7c5e4b26309e38dd1dd52b4f509c94fb9f50453e4d5c2ba895b02c48457a15c384866fdeb57185b628f10873ed6a6e6936ad170827f4855c9c5eca15ab8f959
SSDEEP 24576:EDEykfXykf5ykfqykfGykfKykf+ykf2aztwClwUykfqykf/ykf:EoDPDBDiD+DSD2D+gHwUDiDnD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft OneDrive.exe

Path \Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe
Size 550KB
SHA256 a34954a87d0f4354a21e40ea0e9a9eee4420f47987d40be854ea7b98d6d36226
MD5 3fce051fde9fbd1302b4ee16f604553b
SHA1 e137d2e6fa0007ddd0bf3a1215a68b37ef2ed653
SHA512 cb07f753043b7705b0e32bbf4e1ae8ddf6176851562dea567e75a4715b1beb4031d35a43b6bf0bc45d5b2da7430be0d87b6ae61b5b2e07c7c8950bb0247e4a5c
SSDEEP 12288:vjxIhDXIsMCw6IAr0CKfiSHp+vwcZJIgwC7p:v9+IsMCDIAricBIgD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2528-30-0x00000000003E0000-0x0000000000470000-memory.dmp

Download

memory/2528-32-0x0000000004950000-0x0000000004990000-memory.dmp

Download

memory/2528-31-0x0000000072A40000-0x000000007312E000-memory.dmp

Download

memory/2556-121-0x0000000072A40000-0x000000007312E000-memory.dmp

Download

memory/2556-18-0x0000000001190000-0x0000000001220000-memory.dmp

Download

memory/2556-20-0x0000000072A40000-0x000000007312E000-memory.dmp

Download

memory/2556-22-0x0000000004BE0000-0x0000000004C20000-memory.dmp

Download

memory/2864-38-0x0000000002C50000-0x0000000002C90000-memory.dmp

Download

memory/2864-35-0x000000006F2C0000-0x000000006F86B000-memory.dmp

Download

memory/2864-36-0x0000000002C50000-0x0000000002C90000-memory.dmp

Download

memory/2864-37-0x000000006F2C0000-0x000000006F86B000-memory.dmp

Download

memory/2864-39-0x000000006F2C0000-0x000000006F86B000-memory.dmp

Download

memory/2940-0-0x0000000074B20000-0x00000000750CB000-memory.dmp

Download

memory/2940-17-0x0000000074B20000-0x00000000750CB000-memory.dmp

Download

memory/2940-2-0x0000000000C50000-0x0000000000C90000-memory.dmp

Download

memory/2940-1-0x0000000074B20000-0x00000000750CB000-memory.dmp

Download

memory/3068-23-0x0000000000980000-0x00000000009C0000-memory.dmp

Download

memory/3068-21-0x0000000072A40000-0x000000007312E000-memory.dmp

Download

memory/3068-19-0x0000000000D10000-0x00000000010F6000-memory.dmp

Download