quasar | a9855a152712675a87916aeb25ad5e0c296b251df5c124957cc4cac2f8394f50

General

Target

estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Size

798KB
MD5

4c4dfb410229ae29494d7053d2e05d66
SHA1

fb51f3d30ab1780cc93bb47aff9fae4fe92bc0a3
SHA256

7b620a850f9af37d6abc81ef1a7a72da6b8ca2d696b9a83ebe8e4b8f99a77f23
SHA512

cc5fde78dc8cb6032046e7fb302a561eda90e7dac1532f63d41e8efcf8c7cb077bb3da35e9755ac19da7a8cbe90a4a592a491bd49657f80288fb5ff071841029
SSDEEP

24576:OxsgdEeOsRu/W+VRm0/CnUPjVwKHb94YMFniyyA:OxTdZOsRu/m6AUPCKHRMFnyA

Score

10^/10

quasar defense_evasion evasion execution impact persistence ransomware spyware trojan

Malware Config

Signatures

Contains code to disable Windows Defender 5 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/2160-19-0x0000000000400000-0x000000000045C000-memory.dmp	disable_win_def
behavioral1/memory/2160-15-0x0000000000400000-0x000000000045C000-memory.dmp	disable_win_def
behavioral1/memory/2160-12-0x0000000000400000-0x000000000045C000-memory.dmp	disable_win_def
behavioral1/memory/2160-9-0x0000000000400000-0x000000000045C000-memory.dmp	disable_win_def
behavioral1/memory/2160-17-0x0000000000400000-0x000000000045C000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 9 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

estadodecuenta332652referenciaembargorentdawwwdiangovco.exeVespre.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Vespre.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Vespre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Vespre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Vespre.exe

Modifies security service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

estadodecuenta332652referenciaembargorentdawwwdiangovco.exeVespre.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\WinDefend\Start = "4"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	Vespre.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\WinDefend\Start = "4"	Vespre.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2160-19-0x0000000000400000-0x000000000045C000-memory.dmp	family_quasar
behavioral1/memory/2160-15-0x0000000000400000-0x000000000045C000-memory.dmp	family_quasar
behavioral1/memory/2160-12-0x0000000000400000-0x000000000045C000-memory.dmp	family_quasar
behavioral1/memory/2160-9-0x0000000000400000-0x000000000045C000-memory.dmp	family_quasar
behavioral1/memory/2160-17-0x0000000000400000-0x000000000045C000-memory.dmp	family_quasar

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Vespre.exeestadodecuenta332652referenciaembargorentdawwwdiangovco.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Vespre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Vespre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Vespre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

estadodecuenta332652referenciaembargorentdawwwdiangovco.exeVespre.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "1"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "1"	Vespre.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Executes dropped EXE 2 IoCs

Processes:

Vespre.exeVespre.exe

pid process

1972 Vespre.exe
948 Vespre.exe
Loads dropped DLL 1 IoCs

Processes:

estadodecuenta332652referenciaembargorentdawwwdiangovco.exe

pid process

2160 estadodecuenta332652referenciaembargorentdawwwdiangovco.exe

pid	process
1972	Vespre.exe
948	Vespre.exe

pid	process
2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

estadodecuenta332652referenciaembargorentdawwwdiangovco.exeVespre.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "1"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	Vespre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "1"	Vespre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Vespre.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

estadodecuenta332652referenciaembargorentdawwwdiangovco.exeVespre.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\estadodecuenta332652referenciaembargorentdawwwdiangovco.exe\""	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\estadodecuenta332652referenciaembargorentdawwwdiangovco.exe\""	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Roaming\\GPret\\Vespre.exe\""	Vespre.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Roaming\\GPret\\Vespre.exe\""	Vespre.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

estadodecuenta332652referenciaembargorentdawwwdiangovco.exeVespre.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Vespre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Vespre.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

4 pastebin.com
5 pastebin.com
16 pastebin.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 ip-api.com

flow	ioc
4	pastebin.com
5	pastebin.com
16	pastebin.com

flow	ioc
13	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

estadodecuenta332652referenciaembargorentdawwwdiangovco.exeVespre.exe

description	pid	process	target process
PID 2896 set thread context of 2160	2896	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
PID 1972 set thread context of 948	1972	Vespre.exe	Vespre.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2532 schtasks.exe
2128 schtasks.exe
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

2932 vssadmin.exe
1296 vssadmin.exe

pid	process
2532	schtasks.exe
2128	schtasks.exe

pid	process
2932	vssadmin.exe
1296	vssadmin.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Vespre.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Vespre.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Vespre.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Vespre.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e210f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Vespre.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

2168 powershell.exe
576 powershell.exe

pid	process
2168	powershell.exe
576	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

estadodecuenta332652referenciaembargorentdawwwdiangovco.exevssvc.exepowershell.exeVespre.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Token: SeBackupPrivilege	2680	vssvc.exe
Token: SeRestorePrivilege	2680	vssvc.exe
Token: SeAuditPrivilege	2680	vssvc.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	948	Vespre.exe
Token: SeDebugPrivilege	576	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Vespre.exe

pid process

948 Vespre.exe

pid	process
948	Vespre.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

estadodecuenta332652referenciaembargorentdawwwdiangovco.exeestadodecuenta332652referenciaembargorentdawwwdiangovco.exeVespre.exeVespre.exe

description	pid	process	target process
PID 2896 wrote to memory of 2160	2896	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
PID 2896 wrote to memory of 2160	2896	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
PID 2896 wrote to memory of 2160	2896	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
PID 2896 wrote to memory of 2160	2896	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
PID 2896 wrote to memory of 2160	2896	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
PID 2896 wrote to memory of 2160	2896	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
PID 2896 wrote to memory of 2160	2896	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
PID 2896 wrote to memory of 2160	2896	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
PID 2896 wrote to memory of 2160	2896	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
PID 2160 wrote to memory of 2532	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	schtasks.exe
PID 2160 wrote to memory of 2532	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	schtasks.exe
PID 2160 wrote to memory of 2532	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	schtasks.exe
PID 2160 wrote to memory of 2532	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	schtasks.exe
PID 2160 wrote to memory of 3056	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	schtasks.exe
PID 2160 wrote to memory of 3056	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	schtasks.exe
PID 2160 wrote to memory of 3056	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	schtasks.exe
PID 2160 wrote to memory of 3056	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	schtasks.exe
PID 2160 wrote to memory of 2932	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	vssadmin.exe
PID 2160 wrote to memory of 2932	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	vssadmin.exe
PID 2160 wrote to memory of 2932	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	vssadmin.exe
PID 2160 wrote to memory of 2932	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	vssadmin.exe
PID 2160 wrote to memory of 2168	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	powershell.exe
PID 2160 wrote to memory of 2168	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	powershell.exe
PID 2160 wrote to memory of 2168	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	powershell.exe
PID 2160 wrote to memory of 2168	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	powershell.exe
PID 2160 wrote to memory of 1972	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	Vespre.exe
PID 2160 wrote to memory of 1972	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	Vespre.exe
PID 2160 wrote to memory of 1972	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	Vespre.exe
PID 2160 wrote to memory of 1972	2160	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe	Vespre.exe
PID 1972 wrote to memory of 948	1972	Vespre.exe	Vespre.exe
PID 1972 wrote to memory of 948	1972	Vespre.exe	Vespre.exe
PID 1972 wrote to memory of 948	1972	Vespre.exe	Vespre.exe
PID 1972 wrote to memory of 948	1972	Vespre.exe	Vespre.exe
PID 1972 wrote to memory of 948	1972	Vespre.exe	Vespre.exe
PID 1972 wrote to memory of 948	1972	Vespre.exe	Vespre.exe
PID 1972 wrote to memory of 948	1972	Vespre.exe	Vespre.exe
PID 1972 wrote to memory of 948	1972	Vespre.exe	Vespre.exe
PID 1972 wrote to memory of 948	1972	Vespre.exe	Vespre.exe
PID 948 wrote to memory of 2128	948	Vespre.exe	schtasks.exe
PID 948 wrote to memory of 2128	948	Vespre.exe	schtasks.exe
PID 948 wrote to memory of 2128	948	Vespre.exe	schtasks.exe
PID 948 wrote to memory of 2128	948	Vespre.exe	schtasks.exe
PID 948 wrote to memory of 484	948	Vespre.exe	schtasks.exe
PID 948 wrote to memory of 484	948	Vespre.exe	schtasks.exe
PID 948 wrote to memory of 484	948	Vespre.exe	schtasks.exe
PID 948 wrote to memory of 484	948	Vespre.exe	schtasks.exe
PID 948 wrote to memory of 1296	948	Vespre.exe	vssadmin.exe
PID 948 wrote to memory of 1296	948	Vespre.exe	vssadmin.exe
PID 948 wrote to memory of 1296	948	Vespre.exe	vssadmin.exe
PID 948 wrote to memory of 1296	948	Vespre.exe	vssadmin.exe
PID 948 wrote to memory of 576	948	Vespre.exe	powershell.exe
PID 948 wrote to memory of 576	948	Vespre.exe	powershell.exe
PID 948 wrote to memory of 576	948	Vespre.exe	powershell.exe
PID 948 wrote to memory of 576	948	Vespre.exe	powershell.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

estadodecuenta332652referenciaembargorentdawwwdiangovco.exeVespre.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Vespre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Vespre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Vespre.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	estadodecuenta332652referenciaembargorentdawwwdiangovco.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
"C:\Users\Admin\AppData\Local\Temp\estadodecuenta332652referenciaembargorentdawwwdiangovco.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2896

C:\Users\Admin\AppData\Local\Temp\estadodecuenta332652referenciaembargorentdawwwdiangovco.exe
"C:\Users\Admin\AppData\Local\Temp\estadodecuenta332652referenciaembargorentdawwwdiangovco.exe"
2⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2160

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "\Microsoft\Windows\System\Dev34\Files\iceTelemetryLogtte" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Local\Temp\estadodecuenta332652referenciaembargorentdawwwdiangovco.exe" /f
3⤵
- Creates scheduled task(s)
PID:2532

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /delete /tn "iceTelemetryLogtte" /f
3⤵
PID:3056

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin" delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:2932

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
"C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
"C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe"
4⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:948

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "\Microsoft\Windows\System\Dev34\Files\iceTelemetryLogtte" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe" /f
5⤵
- Creates scheduled task(s)
PID:2128

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /delete /tn "iceTelemetryLogtte" /f
5⤵
PID:484

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin" delete shadows /all /quiet
5⤵
- Interacts with shadow copies
PID:1296

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:576

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Windows Management Instrumentation

1

T1047

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

4

T1562

Disable or Modify Tools

4

T1562.001

Indicator Removal

2

T1070

File Deletion

Modify Registry

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GPret\settings.xml

Filesize
84B

MD5
0670ea91a3ff99e765de101bacc1ce56

SHA1
3b83e99ae94105ffe78aab1b4e2dab1187b4b0f7

SHA256
7dc01c0f1c1d2aa56555d951562ebc455718d3ca7c8e25bd59d42ad5b46b2f2b

SHA512
4063b047638fd8cf8927bd360e2426416a6f154a986ad9f6b2c2d6278f7aab41f96c0c9e32c042d3d32fc6779d204012890f76e389681f6f63985b4f93a6d84d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\54AIQUR5MND4R7YUE5OV.temp

Filesize
7KB

MD5
3d3b6bcba212571c550380ba66a5ddeb

SHA1
da9838ce53a765f664b6f33812617c7ca1d697b5

SHA256
954bd2b58c0089bf384ce5e31de76e822a4b6e0ffe1c196961820b7ced00b0d4

SHA512
9cf3977aaa4dcf6d83c8e28ddfe96a60d60e6188acfc75a07aa205ba8976c7cd4841a81fcacf8326fd524a2cd62a2b3b485ae2bd8e9e7fae25cf9b6792c8b804

Download Submit
\Users\Admin\AppData\Roaming\GPret\Vespre.exe

Filesize
798KB

MD5
4c4dfb410229ae29494d7053d2e05d66

SHA1
fb51f3d30ab1780cc93bb47aff9fae4fe92bc0a3

SHA256
7b620a850f9af37d6abc81ef1a7a72da6b8ca2d696b9a83ebe8e4b8f99a77f23

SHA512
cc5fde78dc8cb6032046e7fb302a561eda90e7dac1532f63d41e8efcf8c7cb077bb3da35e9755ac19da7a8cbe90a4a592a491bd49657f80288fb5ff071841029

Download Submit
memory/948-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1972-54-0x00000000005C0000-0x00000000005D6000-memory.dmp

Filesize
88KB

Download
memory/1972-52-0x0000000000EE0000-0x0000000000FAE000-memory.dmp

Filesize
824KB

Download
memory/2160-20-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2160-12-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2160-8-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2160-19-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2160-15-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2160-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2160-53-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2160-17-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2160-22-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2160-7-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2160-9-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2896-21-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2896-6-0x0000000005270000-0x000000000530E000-memory.dmp

Filesize
632KB

Download
memory/2896-5-0x0000000000680000-0x0000000000696000-memory.dmp

Filesize
88KB

Download
memory/2896-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/2896-4-0x0000000000630000-0x0000000000640000-memory.dmp

Filesize
64KB

Download
memory/2896-3-0x0000000000610000-0x0000000000630000-memory.dmp

Filesize
128KB

Download
memory/2896-2-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2896-1-0x0000000000FD0000-0x000000000109E000-memory.dmp

Filesize
824KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads