quasar | 7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba

Reason

Machine shutdown

General

Target

7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba.exe
Size

5.9MB
MD5

12f9b68ed66fed9a1e3c1c2319c837c6
SHA1

e423cbd003c718b6fa268de83806dae6a9fe88c3
SHA256

7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba
SHA512

b649639d2363f135f694f8d5968a6b7adabd76ef793a3fb9313b1c142a0e749be33a5831c4d0cbc32ea170a2100f693755b378280f252dd50bd1ddf008b1ba53
SSDEEP

98304:pMI+LjNr86mjj/UYviu26bbyKS2myX0rPgIh:p8Vmj72wblTmyEgG

Score

10^/10

quasar venomrat windows security rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

windows security

C2

quasarrat220-24487.portmap.io:24487

Mutex

VNM_MUTEX_mOPqShedZxvAqgLrWL

Attributes

encryption_key
7mvA2TfKjvMIY0zZeMKF
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE	disable_win_def
behavioral2/memory/2340-28-0x00000000008A0000-0x000000000092C000-memory.dmp	disable_win_def

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE	family_quasar
behavioral2/memory/2340-28-0x00000000008A0000-0x000000000092C000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/2340-28-0x00000000008A0000-0x000000000092C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2340-28-0x00000000008A0000-0x000000000092C000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing artifacts associated with disabling Widnows Defender 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2340-28-0x00000000008A0000-0x000000000092C000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2340-28-0x00000000008A0000-0x000000000092C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba.exeWINDOWS SECURITY.EXE

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	WINDOWS SECURITY.EXE

Executes dropped EXE 2 IoCs

Processes:

PAYPAL.EXEWINDOWS SECURITY.EXE

pid process

544 PAYPAL.EXE
2340 WINDOWS SECURITY.EXE
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
8 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3640 2340 WerFault.exe WINDOWS SECURITY.EXE
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3484 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1324 PING.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

WINDOWS SECURITY.EXE

description pid process

Token: SeDebugPrivilege 2340 WINDOWS SECURITY.EXE
Token: SeDebugPrivilege 2340 WINDOWS SECURITY.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

PAYPAL.EXEWINDOWS SECURITY.EXE

pid process

544 PAYPAL.EXE
2340 WINDOWS SECURITY.EXE

pid	process
544	PAYPAL.EXE
2340	WINDOWS SECURITY.EXE

flow	ioc
2	ip-api.com
8	api.ipify.org

pid	pid_target	process	target process
3640	2340	WerFault.exe	WINDOWS SECURITY.EXE

pid	process
3484	schtasks.exe

pid	process
1324	PING.EXE

description	pid	process
Token: SeDebugPrivilege	2340	WINDOWS SECURITY.EXE
Token: SeDebugPrivilege	2340	WINDOWS SECURITY.EXE

pid	process
544	PAYPAL.EXE
2340	WINDOWS SECURITY.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba.exeWINDOWS SECURITY.EXEcmd.exe

description	pid	process	target process
PID 4920 wrote to memory of 544	4920	7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba.exe	PAYPAL.EXE
PID 4920 wrote to memory of 544	4920	7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba.exe	PAYPAL.EXE
PID 4920 wrote to memory of 544	4920	7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba.exe	PAYPAL.EXE
PID 4920 wrote to memory of 2340	4920	7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba.exe	WINDOWS SECURITY.EXE
PID 4920 wrote to memory of 2340	4920	7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba.exe	WINDOWS SECURITY.EXE
PID 4920 wrote to memory of 2340	4920	7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba.exe	WINDOWS SECURITY.EXE
PID 2340 wrote to memory of 3484	2340	WINDOWS SECURITY.EXE	schtasks.exe
PID 2340 wrote to memory of 3484	2340	WINDOWS SECURITY.EXE	schtasks.exe
PID 2340 wrote to memory of 3484	2340	WINDOWS SECURITY.EXE	schtasks.exe
PID 2340 wrote to memory of 2076	2340	WINDOWS SECURITY.EXE	cmd.exe
PID 2340 wrote to memory of 2076	2340	WINDOWS SECURITY.EXE	cmd.exe
PID 2340 wrote to memory of 2076	2340	WINDOWS SECURITY.EXE	cmd.exe
PID 2076 wrote to memory of 4976	2076	cmd.exe	chcp.com
PID 2076 wrote to memory of 4976	2076	cmd.exe	chcp.com
PID 2076 wrote to memory of 4976	2076	cmd.exe	chcp.com
PID 2076 wrote to memory of 1324	2076	cmd.exe	PING.EXE
PID 2076 wrote to memory of 1324	2076	cmd.exe	PING.EXE
PID 2076 wrote to memory of 1324	2076	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba.exe
"C:\Users\Admin\AppData\Local\Temp\7c5919ffcd3234d3c520120fbbeb9204e11ca3adfbfc175175a1e087492cbbba.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\PAYPAL.EXE
  "C:\Users\Admin\AppData\Local\Temp\PAYPAL.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:544
- C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE
  "C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qdUJtlilZCoc.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:4976
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:1324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 920
    3⤵
    - Program crash
    PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2340 -ip 2340
1⤵
PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PAYPAL.EXE

Filesize
5.3MB

MD5
341b34b571af06277c2f3b4156bd86df

SHA1
ba120240400cc6dcf0e92e732d4f460f3763102b

SHA256
9a579053ee79c9ee45e29ac1887aba8cb87936c01026b5f3d830456547adc441

SHA512
2cbb482d2e087e18b7461c9a317aa249adf12821de17d6dd59f3c17e01394047df31e875a551d23d32a64a46f8db46003c2feced7e967dd159bc65d3bff76e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE

Filesize
534KB

MD5
9e14775490cee79c73cb45c2f24f7a73

SHA1
ddd6c7485a5e64a66a0a7598777abdafa7a63950

SHA256
d53df5b6b080ba24773ca16c7a8b70eeb783ead278712e0c5b44abc84805e60e

SHA512
1c0aec61a64400bcf18f6f0e5a950c68b7a25492b07290e3793a759f616c1b361ed6472d260d0f379b691567216a1f9e53af53b2dc89711df618a4463c8d0317

Download Submit
C:\Users\Admin\AppData\Local\Temp\qdUJtlilZCoc.bat

Filesize
213B

MD5
a4a4c477efaa75e6d9cc05ec496d757b

SHA1
f1ff3409aa36b02ff34d79e89c3e9b18724988ba

SHA256
1700ef6723ca98afc39394db2fe201c11aceda064af1c7b610d5c9042125f960

SHA512
23e79e7a8e448aa1e107db1e62615f7c7ad6472cc12b92384dfcbd285b9b3f586034f255cfbe9ba117fb738c0cd80de2fd44b3c8e7dbb31b3aaf543cf9be696d

Download Submit
memory/544-34-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download
memory/544-26-0x0000000002C90000-0x0000000002CFA000-memory.dmp

Filesize
424KB

Download
memory/544-25-0x0000000002C60000-0x0000000002C8D000-memory.dmp

Filesize
180KB

Download
memory/544-24-0x0000000002B10000-0x0000000002B32000-memory.dmp

Filesize
136KB

Download
memory/544-21-0x0000000000400000-0x0000000000B2B000-memory.dmp

Filesize
7.2MB

Download
memory/544-23-0x0000000002A90000-0x0000000002AE3000-memory.dmp

Filesize
332KB

Download
memory/544-22-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download
memory/2340-31-0x00000000730C0000-0x0000000073870000-memory.dmp

Filesize
7.7MB

Download
memory/2340-30-0x0000000005250000-0x00000000052E2000-memory.dmp

Filesize
584KB

Download
memory/2340-29-0x0000000005760000-0x0000000005D04000-memory.dmp

Filesize
5.6MB

Download
memory/2340-32-0x00000000051B0000-0x0000000005216000-memory.dmp

Filesize
408KB

Download
memory/2340-33-0x0000000005720000-0x0000000005732000-memory.dmp

Filesize
72KB

Download
memory/2340-27-0x00000000730CE000-0x00000000730CF000-memory.dmp

Filesize
4KB

Download
memory/2340-35-0x00000000730CE000-0x00000000730CF000-memory.dmp

Filesize
4KB

Download
memory/2340-36-0x00000000730C0000-0x0000000073870000-memory.dmp

Filesize
7.7MB

Download
memory/2340-38-0x00000000069B0000-0x00000000069BA000-memory.dmp

Filesize
40KB

Download
memory/2340-28-0x00000000008A0000-0x000000000092C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads