Overview

overview

10

Static

static

10

Discord pronuke.exe

windows7-x64

10

Discord pronuke.exe

windows10-2004-x64

Analysis

  • max time kernel
    2s
  • max time network
    3s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-05-2024 08:21

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    Discord pronuke.exe

  • Size

    534KB

  • MD5

    482c6ea5b1672d4447c5f6b32f07615f

  • SHA1

    60308524ff9ced8796f6f8287a793427e9a167a9

  • SHA256

    38d5caeb7f6e8a77103481b4510dcfe5ece6e4b7f74ec543204a3b7ce1448aa2

  • SHA512

    a7190024f7b17514f6ba8b48a0dbf9460f05e2c3f8889091c97850cc7c5615fd0bdb32800dc01aca989cc8bdcfbdc0a39150aac14ead6becdc31d9f32ef8a829

  • SSDEEP

    12288:k+xLZf8sMEk/v+TV19BlG3lo0cnHyA7tgwGy:kG58sMtH57qHysf

Score
10/10
quasarvenomratoffice04ratrootkitspywarestealertrojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

BOSSIX-41718.portmap.host:4000

BOSSIX-41718.portmap.host:41718
Mutex

VNM_MUTEX_VzF5UQyFwcYIcCbWFq

Attributes
  • encryption_key

    3wMtwLAsuOIKsB6yumla

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

  • subdirectory

    SubDir

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Discord pronuke.exe
    "C:\Users\Admin\AppData\Local\Temp\Discord pronuke.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5092
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pWXacmJ4abjw.bat" "
      2⤵
        PID:1688

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/5092-0-0x00007FFE12FF0000-0x00007FFE131E5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/5092-1-0x0000000000200000-0x000000000028C000-memory.dmp

      Filesize

      560KB

      Download

    • memory/5092-2-0x0000000005300000-0x00000000058A4000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/5092-3-0x0000000004C50000-0x0000000004CE2000-memory.dmp

      Filesize

      584KB

      Download

    • memory/5092-4-0x00007FFE12FF0000-0x00007FFE131E5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/5092-5-0x0000000004DC0000-0x0000000004E26000-memory.dmp

      Filesize

      408KB

      Download

    • memory/5092-6-0x00000000059B0000-0x00000000059C2000-memory.dmp

      Filesize

      72KB

      Download

    • memory/5092-7-0x0000000005EF0000-0x0000000005F2C000-memory.dmp

      Filesize

      240KB

      Download