quasar | 7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba

General

Target

2lz.exe
Size

5.9MB
MD5

12f9b68ed66fed9a1e3c1c2319c837c6
SHA1

e423cbd003c718b6fa268de83806dae6a9fe88c3
SHA256

7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba
SHA512

b649639d2363f135f694f8d5968a6b7adabd76ef793a3fb9313b1c142a0e749be33a5831c4d0cbc32ea170a2100f693755b378280f252dd50bd1ddf008b1ba53
SSDEEP

98304:pMI+LjNr86mjj/UYviu26bbyKS2myX0rPgIh:p8Vmj72wblTmyEgG

Score

10^/10

quasar venomrat windows security rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

windows security

C2

quasarrat220-24487.portmap.io:24487

Mutex

VNM_MUTEX_mOPqShedZxvAqgLrWL

Attributes

encryption_key
7mvA2TfKjvMIY0zZeMKF
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE	disable_win_def
behavioral1/memory/2692-16-0x0000000001350000-0x00000000013DC000-memory.dmp	disable_win_def

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE	family_quasar
behavioral1/memory/2692-16-0x0000000001350000-0x00000000013DC000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat
Executes dropped EXE 3 IoCs

Processes:

PAYPAL.EXEWINDOWS SECURITY.EXEWINDOWS SECURITY.EXE

pid process

2296 PAYPAL.EXE
2692 WINDOWS SECURITY.EXE
2728 WINDOWS SECURITY.EXE
Loads dropped DLL 8 IoCs

Processes:

2lz.exeWerFault.execmd.exe

pid process

1056 2lz.exe
1056 2lz.exe
2984 WerFault.exe
2984 WerFault.exe
2984 WerFault.exe
2984 WerFault.exe
2984 WerFault.exe
2672 cmd.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2984 2692 WerFault.exe WINDOWS SECURITY.EXE
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2640 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2480 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

WINDOWS SECURITY.EXE

pid process

2728 WINDOWS SECURITY.EXE

pid	process
2296	PAYPAL.EXE
2692	WINDOWS SECURITY.EXE
2728	WINDOWS SECURITY.EXE

pid	process
1056	2lz.exe
1056	2lz.exe
2984	WerFault.exe
2984	WerFault.exe
2984	WerFault.exe
2984	WerFault.exe
2984	WerFault.exe
2672	cmd.exe

flow	ioc
2	ip-api.com

pid	pid_target	process	target process
2984	2692	WerFault.exe	WINDOWS SECURITY.EXE

pid	process
2640	schtasks.exe

pid	process
2480	PING.EXE

pid	process
2728	WINDOWS SECURITY.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WINDOWS SECURITY.EXEWINDOWS SECURITY.EXE

description	pid	process
Token: SeDebugPrivilege	2692	WINDOWS SECURITY.EXE
Token: SeDebugPrivilege	2692	WINDOWS SECURITY.EXE
Token: SeDebugPrivilege	2728	WINDOWS SECURITY.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

PAYPAL.EXEWINDOWS SECURITY.EXE

pid process

2296 PAYPAL.EXE
2692 WINDOWS SECURITY.EXE

pid	process
2296	PAYPAL.EXE
2692	WINDOWS SECURITY.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

2lz.exeWINDOWS SECURITY.EXEcmd.exe

description	pid	process	target process
PID 1056 wrote to memory of 2296	1056	2lz.exe	PAYPAL.EXE
PID 1056 wrote to memory of 2296	1056	2lz.exe	PAYPAL.EXE
PID 1056 wrote to memory of 2296	1056	2lz.exe	PAYPAL.EXE
PID 1056 wrote to memory of 2296	1056	2lz.exe	PAYPAL.EXE
PID 1056 wrote to memory of 2692	1056	2lz.exe	WINDOWS SECURITY.EXE
PID 1056 wrote to memory of 2692	1056	2lz.exe	WINDOWS SECURITY.EXE
PID 1056 wrote to memory of 2692	1056	2lz.exe	WINDOWS SECURITY.EXE
PID 1056 wrote to memory of 2692	1056	2lz.exe	WINDOWS SECURITY.EXE
PID 2692 wrote to memory of 2640	2692	WINDOWS SECURITY.EXE	schtasks.exe
PID 2692 wrote to memory of 2640	2692	WINDOWS SECURITY.EXE	schtasks.exe
PID 2692 wrote to memory of 2640	2692	WINDOWS SECURITY.EXE	schtasks.exe
PID 2692 wrote to memory of 2640	2692	WINDOWS SECURITY.EXE	schtasks.exe
PID 2692 wrote to memory of 2672	2692	WINDOWS SECURITY.EXE	cmd.exe
PID 2692 wrote to memory of 2672	2692	WINDOWS SECURITY.EXE	cmd.exe
PID 2692 wrote to memory of 2672	2692	WINDOWS SECURITY.EXE	cmd.exe
PID 2692 wrote to memory of 2672	2692	WINDOWS SECURITY.EXE	cmd.exe
PID 2692 wrote to memory of 2984	2692	WINDOWS SECURITY.EXE	WerFault.exe
PID 2692 wrote to memory of 2984	2692	WINDOWS SECURITY.EXE	WerFault.exe
PID 2692 wrote to memory of 2984	2692	WINDOWS SECURITY.EXE	WerFault.exe
PID 2692 wrote to memory of 2984	2692	WINDOWS SECURITY.EXE	WerFault.exe
PID 2672 wrote to memory of 2980	2672	cmd.exe	chcp.com
PID 2672 wrote to memory of 2980	2672	cmd.exe	chcp.com
PID 2672 wrote to memory of 2980	2672	cmd.exe	chcp.com
PID 2672 wrote to memory of 2980	2672	cmd.exe	chcp.com
PID 2672 wrote to memory of 2480	2672	cmd.exe	PING.EXE
PID 2672 wrote to memory of 2480	2672	cmd.exe	PING.EXE
PID 2672 wrote to memory of 2480	2672	cmd.exe	PING.EXE
PID 2672 wrote to memory of 2480	2672	cmd.exe	PING.EXE
PID 2672 wrote to memory of 2728	2672	cmd.exe	WINDOWS SECURITY.EXE
PID 2672 wrote to memory of 2728	2672	cmd.exe	WINDOWS SECURITY.EXE
PID 2672 wrote to memory of 2728	2672	cmd.exe	WINDOWS SECURITY.EXE
PID 2672 wrote to memory of 2728	2672	cmd.exe	WINDOWS SECURITY.EXE

C:\Users\Admin\AppData\Local\Temp\2lz.exe
"C:\Users\Admin\AppData\Local\Temp\2lz.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\PAYPAL.EXE
  "C:\Users\Admin\AppData\Local\Temp\PAYPAL.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2296
- C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE
  "C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\ee1nVad2WqfG.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:2980
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE
      "C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 1460
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE

Filesize
534KB

MD5
9e14775490cee79c73cb45c2f24f7a73

SHA1
ddd6c7485a5e64a66a0a7598777abdafa7a63950

SHA256
d53df5b6b080ba24773ca16c7a8b70eeb783ead278712e0c5b44abc84805e60e

SHA512
1c0aec61a64400bcf18f6f0e5a950c68b7a25492b07290e3793a759f616c1b361ed6472d260d0f379b691567216a1f9e53af53b2dc89711df618a4463c8d0317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ee1nVad2WqfG.bat

Filesize
213B

MD5
a771a5c5de4e6aadd4b986e50818e411

SHA1
ac0272098a827034e41a1b19130c14d65b30d401

SHA256
0cd8408390165d51acdac544a8ccb8f90f6fa4f90f22e4f1d00321ed89fd1286

SHA512
1a5460e3feeb3262a046508864c16c6cb6440aca07d88ca93af40164e2f3aed4ec542c34dcc493fb93aee84b0f1144629595b43f0cf447d1c1ae385dc0d35baf

Download Submit
\Users\Admin\AppData\Local\Temp\PAYPAL.EXE

Filesize
5.3MB

MD5
341b34b571af06277c2f3b4156bd86df

SHA1
ba120240400cc6dcf0e92e732d4f460f3763102b

SHA256
9a579053ee79c9ee45e29ac1887aba8cb87936c01026b5f3d830456547adc441

SHA512
2cbb482d2e087e18b7461c9a317aa249adf12821de17d6dd59f3c17e01394047df31e875a551d23d32a64a46f8db46003c2feced7e967dd159bc65d3bff76e66

Download Submit
memory/1056-12-0x0000000002E40000-0x000000000356B000-memory.dmp

Filesize
7.2MB

Download
memory/2296-14-0x0000000000400000-0x0000000000B2B000-memory.dmp

Filesize
7.2MB

Download
memory/2296-15-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2296-34-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2692-16-0x0000000001350000-0x00000000013DC000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads