quasar | 5bdd21c031e8d79b4bd9fc49dbb612d8a24fc652cf6df24c0fcb473c5abcfed8

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-es
resource tags

arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
11-09-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TikTokBot.exe
Size

534KB
MD5

22916453f988c9660b4c7c12b7e021b3
SHA1

f662549f7d5fb24fe72c2f5f82e1d661b9efcdff
SHA256

5bdd21c031e8d79b4bd9fc49dbb612d8a24fc652cf6df24c0fcb473c5abcfed8
SHA512

7df8cb2fc2b4da6f99e53fb7496621fcb6c4cba7c8ecd40ae763ac5ac6c599520339465337b7b7e4bccf988701af7a87055377187c63d41ae60d7f0f291f6c65
SSDEEP

6144:l8fGxBIgrx8kFYLTiMkbCs0KrTXLYzAR7bloVhfSP8tTsKv8CZ45uusDGy3V8/GR:BPx7FYPiMTsLXczA2tS2sKUCBujq

Score

10^/10

quasar venomrat slave discovery evasion rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Slave

eu-west-36307.packetriot.net:22471

Mutex

VNM_MUTEX_c2q7y2ayYutZ2XaYe7

Attributes

encryption_key
uKN8xUJGqzjjCLO8arNy
install_name
Mm2Dupe.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svchost
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/memory/1668-1-0x0000000000700000-0x000000000078C000-memory.dmp	disable_win_def
C:\Users\Admin\AppData\Roaming\SubDir\Mm2Dupe.exe	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

TikTokBot.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	TikTokBot.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	TikTokBot.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	TikTokBot.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	TikTokBot.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1668-1-0x0000000000700000-0x000000000078C000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Mm2Dupe.exe	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TikTokBot.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	TikTokBot.exe

Executes dropped EXE 1 IoCs

Processes:

Mm2Dupe.exe

pid process

1684 Mm2Dupe.exe

pid	process
1684	Mm2Dupe.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

TikTokBot.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	TikTokBot.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	TikTokBot.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
7	ip-api.com

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

PING.EXEschtasks.exepowershell.exeschtasks.execmd.exechcp.comTikTokBot.exeTikTokBot.exeMm2Dupe.execmd.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TikTokBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TikTokBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mm2Dupe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

3764 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3764 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

3216 schtasks.exe
1456 schtasks.exe

pid	process
3764	PING.EXE

pid	process
3764	PING.EXE

pid	process
3216	schtasks.exe
1456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

powershell.exeTikTokBot.exeTikTokBot.exe

pid	process
3576	powershell.exe
3576	powershell.exe
1668	TikTokBot.exe
1668	TikTokBot.exe
1668	TikTokBot.exe
1668	TikTokBot.exe
1668	TikTokBot.exe
1668	TikTokBot.exe
1668	TikTokBot.exe
1640	TikTokBot.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

TikTokBot.exepowershell.exeMm2Dupe.exeTikTokBot.exe

description	pid	process
Token: SeDebugPrivilege	1668	TikTokBot.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeDebugPrivilege	1684	Mm2Dupe.exe
Token: SeDebugPrivilege	1684	Mm2Dupe.exe
Token: SeDebugPrivilege	1640	TikTokBot.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Mm2Dupe.exe

pid process

1684 Mm2Dupe.exe

pid	process
1684	Mm2Dupe.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

TikTokBot.exeMm2Dupe.execmd.execmd.exe

description	pid	process	target process
PID 1668 wrote to memory of 3216	1668	TikTokBot.exe	schtasks.exe
PID 1668 wrote to memory of 3216	1668	TikTokBot.exe	schtasks.exe
PID 1668 wrote to memory of 3216	1668	TikTokBot.exe	schtasks.exe
PID 1668 wrote to memory of 1684	1668	TikTokBot.exe	Mm2Dupe.exe
PID 1668 wrote to memory of 1684	1668	TikTokBot.exe	Mm2Dupe.exe
PID 1668 wrote to memory of 1684	1668	TikTokBot.exe	Mm2Dupe.exe
PID 1668 wrote to memory of 3576	1668	TikTokBot.exe	powershell.exe
PID 1668 wrote to memory of 3576	1668	TikTokBot.exe	powershell.exe
PID 1668 wrote to memory of 3576	1668	TikTokBot.exe	powershell.exe
PID 1684 wrote to memory of 1456	1684	Mm2Dupe.exe	schtasks.exe
PID 1684 wrote to memory of 1456	1684	Mm2Dupe.exe	schtasks.exe
PID 1684 wrote to memory of 1456	1684	Mm2Dupe.exe	schtasks.exe
PID 1668 wrote to memory of 3976	1668	TikTokBot.exe	cmd.exe
PID 1668 wrote to memory of 3976	1668	TikTokBot.exe	cmd.exe
PID 1668 wrote to memory of 3976	1668	TikTokBot.exe	cmd.exe
PID 3976 wrote to memory of 3832	3976	cmd.exe	cmd.exe
PID 3976 wrote to memory of 3832	3976	cmd.exe	cmd.exe
PID 3976 wrote to memory of 3832	3976	cmd.exe	cmd.exe
PID 1668 wrote to memory of 4524	1668	TikTokBot.exe	cmd.exe
PID 1668 wrote to memory of 4524	1668	TikTokBot.exe	cmd.exe
PID 1668 wrote to memory of 4524	1668	TikTokBot.exe	cmd.exe
PID 4524 wrote to memory of 4328	4524	cmd.exe	chcp.com
PID 4524 wrote to memory of 4328	4524	cmd.exe	chcp.com
PID 4524 wrote to memory of 4328	4524	cmd.exe	chcp.com
PID 4524 wrote to memory of 3764	4524	cmd.exe	PING.EXE
PID 4524 wrote to memory of 3764	4524	cmd.exe	PING.EXE
PID 4524 wrote to memory of 3764	4524	cmd.exe	PING.EXE
PID 4524 wrote to memory of 1640	4524	cmd.exe	TikTokBot.exe
PID 4524 wrote to memory of 1640	4524	cmd.exe	TikTokBot.exe
PID 4524 wrote to memory of 1640	4524	cmd.exe	TikTokBot.exe

C:\Users\Admin\AppData\Local\Temp\TikTokBot.exe
"C:\Users\Admin\AppData\Local\Temp\TikTokBot.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\TikTokBot.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3216
- C:\Users\Admin\AppData\Roaming\SubDir\Mm2Dupe.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Mm2Dupe.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Mm2Dupe.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3576
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rlrk6Nv5Olc0.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4328
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3764
- - C:\Users\Admin\AppData\Local\Temp\TikTokBot.exe
    "C:\Users\Admin\AppData\Local\Temp\TikTokBot.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TikTokBot.exe.log

Filesize
1KB

MD5
10eab9c2684febb5327b6976f2047587

SHA1
a12ed54146a7f5c4c580416aecb899549712449e

SHA256
f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928

SHA512
7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bosmoyzh.ufd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\rlrk6Nv5Olc0.bat

Filesize
206B

MD5
1fac7f5087081dfd17099147b368d63c

SHA1
2fba9aa9a0bc50cf93ca034eb08872dbc48119b4

SHA256
6a97a789e3a8b4fda25ecd980fe57167076d02ce189b4facc905b40ffd073dfd

SHA512
5bdbdd2631f4400fbb207a488a31c376972dffbd446ad78b351e0cecea23d522abbc95cfbc2f84500c8d65d215934768b86c85d385f9994c0effec4f8119bae7

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Mm2Dupe.exe

Filesize
534KB

MD5
22916453f988c9660b4c7c12b7e021b3

SHA1
f662549f7d5fb24fe72c2f5f82e1d661b9efcdff

SHA256
5bdd21c031e8d79b4bd9fc49dbb612d8a24fc652cf6df24c0fcb473c5abcfed8

SHA512
7df8cb2fc2b4da6f99e53fb7496621fcb6c4cba7c8ecd40ae763ac5ac6c599520339465337b7b7e4bccf988701af7a87055377187c63d41ae60d7f0f291f6c65

Download Submit
memory/1668-8-0x00000000064A0000-0x00000000064EA000-memory.dmp

Filesize
296KB

Download
memory/1668-0-0x000000007516E000-0x000000007516F000-memory.dmp

Filesize
4KB

Download
memory/1668-4-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/1668-5-0x0000000005280000-0x00000000052E6000-memory.dmp

Filesize
408KB

Download
memory/1668-6-0x0000000005EA0000-0x0000000005EB2000-memory.dmp

Filesize
72KB

Download
memory/1668-7-0x0000000006410000-0x000000000644C000-memory.dmp

Filesize
240KB

Download
memory/1668-2-0x0000000005790000-0x0000000005D34000-memory.dmp

Filesize
5.6MB

Download
memory/1668-9-0x0000000006450000-0x0000000006470000-memory.dmp

Filesize
128KB

Download
memory/1668-65-0x0000000006670000-0x00000000066B0000-memory.dmp

Filesize
256KB

Download
memory/1668-66-0x000000007516E000-0x000000007516F000-memory.dmp

Filesize
4KB

Download
memory/1668-67-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/1668-74-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/1668-1-0x0000000000700000-0x000000000078C000-memory.dmp

Filesize
560KB

Download
memory/1668-3-0x00000000051E0000-0x0000000005272000-memory.dmp

Filesize
584KB

Download
memory/1684-54-0x0000000006AD0000-0x0000000006ADA000-memory.dmp

Filesize
40KB

Download
memory/1684-69-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/1684-68-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/1684-18-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/1684-14-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/3576-33-0x0000000005530000-0x0000000005884000-memory.dmp

Filesize
3.3MB

Download
memory/3576-56-0x0000000007330000-0x00000000073C6000-memory.dmp

Filesize
600KB

Download
memory/3576-34-0x00000000059D0000-0x00000000059E0000-memory.dmp

Filesize
64KB

Download
memory/3576-35-0x0000000005B50000-0x0000000005C52000-memory.dmp

Filesize
1.0MB

Download
memory/3576-36-0x0000000005CC0000-0x0000000005CDE000-memory.dmp

Filesize
120KB

Download
memory/3576-37-0x0000000005CF0000-0x0000000005D3C000-memory.dmp

Filesize
304KB

Download
memory/3576-38-0x0000000006EC0000-0x0000000006EF2000-memory.dmp

Filesize
200KB

Download
memory/3576-39-0x0000000070560000-0x00000000705AC000-memory.dmp

Filesize
304KB

Download
memory/3576-49-0x00000000062D0000-0x00000000062EE000-memory.dmp

Filesize
120KB

Download
memory/3576-50-0x0000000006F00000-0x0000000006FA3000-memory.dmp

Filesize
652KB

Download
memory/3576-51-0x0000000007650000-0x0000000007CCA000-memory.dmp

Filesize
6.5MB

Download
memory/3576-52-0x0000000007000000-0x000000000701A000-memory.dmp

Filesize
104KB

Download
memory/3576-55-0x0000000007070000-0x000000000707A000-memory.dmp

Filesize
40KB

Download
memory/3576-23-0x00000000052A0000-0x0000000005306000-memory.dmp

Filesize
408KB

Download
memory/3576-57-0x0000000007220000-0x0000000007231000-memory.dmp

Filesize
68KB

Download
memory/3576-58-0x00000000072A0000-0x00000000072AE000-memory.dmp

Filesize
56KB

Download
memory/3576-59-0x00000000072B0000-0x00000000072C4000-memory.dmp

Filesize
80KB

Download
memory/3576-60-0x0000000007310000-0x000000000732A000-memory.dmp

Filesize
104KB

Download
memory/3576-61-0x00000000072F0000-0x00000000072F8000-memory.dmp

Filesize
32KB

Download
memory/3576-22-0x00000000049C0000-0x00000000049E2000-memory.dmp

Filesize
136KB

Download
memory/3576-21-0x00000000049F0000-0x0000000004A72000-memory.dmp

Filesize
520KB

Download
memory/3576-20-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/3576-19-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/3576-17-0x0000000004BC0000-0x00000000051E8000-memory.dmp

Filesize
6.2MB

Download
memory/3576-16-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/3576-15-0x0000000000A10000-0x0000000000A46000-memory.dmp

Filesize
216KB

Download
memory/3576-64-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download