Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
15s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31/12/2024, 12:11 UTC
Errors
General
-
Target
Paypal cracker.exe
-
Size
6.6MB
-
MD5
5627dd16f023b8be51ed365d2fb6fee5
-
SHA1
fcccce747bf6c824233cfda366798fa0467d3daf
-
SHA256
2e2f6fe5b310d843656af43b60c0faddf6eb0f329efc8353272437db44b5f247
-
SHA512
e475f903d2afd4c1b985f368f77610270df54bb8207130f6339e59595777718cfadadbb732775523a11aa035cbbf3c6d81896a33d84b40f6c01f182a1654f637
-
SSDEEP
98304:xRlI+LjNr86mjj/UYviu26bbyKS2myX0rPpIh1KcV:xRlVmj72wblTmyEpG17V
Malware Config
Extracted
quasar
2.1.0.0
windows security
quasarrat220-24487.portmap.io:24487
VNM_MUTEX_mOPqShedZxvAqgLrWL
-
encryption_key
7mvA2TfKjvMIY0zZeMKF
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
-
subdirectory
SubDir
Signatures
-
Contains code to disable Windows Defender 3 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Program crash 1 IoCs
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Paypal cracker.exe"C:\Users\Admin\AppData\Local\Temp\Paypal cracker.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\systemsvc.exe"C:\Users\Admin\AppData\Roaming\systemsvc.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\systemkvc.exe"C:\Users\Admin\AppData\Roaming\systemkvc.exe"2⤵
-
C:\Services\6D9F656405E.exe"C:\Services\6D9F656405E.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\8IUA066.exe"C:\Users\Admin\AppData\Local\Temp\8IUA066.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Checker.exe"Checker.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PAYPAL.EXE"C:\Users\Admin\AppData\Local\Temp\PAYPAL.EXE"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE"C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1PLWfojgAdsL.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 22044⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2496 -ip 24961⤵
Network
-
DNS149.220.183.52.in-addr.arpaRemote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse -
DNSz.zoRemote address:8.8.8.8:53Requestz.zoIN AResponse
-
DNS69.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request69.31.126.40.in-addr.arpaIN PTRResponse
-
DNSip-api.comRemote address:8.8.8.8:53Requestip-api.comIN AResponseip-api.comIN A208.95.112.1
-
GEThttp://ip-api.com/json/Remote address:208.95.112.1:80RequestGET /json/ HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0
Host: ip-api.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Tue, 31 Dec 2024 12:11:20 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 291
Access-Control-Allow-Origin: *
X-Ttl: 60
X-Rl: 44
-
DNSquasarrat220-24487.portmap.ioRemote address:8.8.8.8:53Requestquasarrat220-24487.portmap.ioIN AResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS1.112.95.208.in-addr.arpaRemote address:8.8.8.8:53Request1.112.95.208.in-addr.arpaIN PTRResponse1.112.95.208.in-addr.arpaIN PTRip-apicom
-
185.81.68.147:80 -
185.81.68.147:80
-
185.81.68.147:80
-
185.81.68.147:80
-
208.95.112.1:80http://ip-api.com/json/http
HTTP Request
GET http://ip-api.com/json/HTTP Response
200
-
8.8.8.8:53149.220.183.52.in-addr.arpadns
DNS Request
149.220.183.52.in-addr.arpa
-
8.8.8.8:53z.zodns
DNS Request
z.zo
-
8.8.8.8:5369.31.126.40.in-addr.arpadns
DNS Request
69.31.126.40.in-addr.arpa
-
8.8.8.8:53ip-api.comdns
DNS Request
ip-api.com
DNS Response
208.95.112.1
-
8.8.8.8:53quasarrat220-24487.portmap.iodns
DNS Request
quasarrat220-24487.portmap.io
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:531.112.95.208.in-addr.arpadns
DNS Request
1.112.95.208.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD56a172fdb857f0ac1921efc443e407e7d
SHA19401bd19abe0750b866625107f146c1cf55c75b8
SHA256ab3adcd792f9526fc8634b1de30773d74becadaf056c8d3b1aeee1641f4d640b
SHA512195a632b76a2a19227cbd1364b810148764c6e5b94971d3e34f93e83d38d410d122db52671a9ebca4087e0216361c6e54db7f959a83832cb5ca2d769cec04ef2
-
Filesize
213B
MD5847c1ea0aa76a066ffc8fe0eb041c8a9
SHA1cd375f5ad48e75bfe03dcf8e961ee0fb91e27524
SHA2561df685d966b2ab67804431393dceba11caade019f9a9af3e60d22db1d20e0519
SHA51265c1024b2fa4805557324a8408fb708ebf47de93449628bc8226ce8d573c3b9a2fbe779b478d581ba92fd2e32c1a16a00822c3d3ffabeecaf8e6fd30e7f0f1d0
-
Filesize
3KB
MD529090b6b4d6605a97ac760d06436ac2d
SHA1d929d3389642e52bae5ad8512293c9c4d3e4fab5
SHA25698a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272
SHA5129121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be
-
Filesize
5.9MB
MD53425a9f00842bf28a0bafc5c1571b881
SHA13009eca32bcf159981d37a8620836b1d215aa33e
SHA2567328321fccd71cfda94a18656158ce54b0e3a0831d48f46f559b442a33a1790a
SHA512868b816f376a3bc38d24850808eb5410e4037acedd0849ad73868065525444a4cca54e3484d5ac0b14523217f3d6da24fc6132942632653439f0ea5310084bc7
-
Filesize
5.3MB
MD5341b34b571af06277c2f3b4156bd86df
SHA1ba120240400cc6dcf0e92e732d4f460f3763102b
SHA2569a579053ee79c9ee45e29ac1887aba8cb87936c01026b5f3d830456547adc441
SHA5122cbb482d2e087e18b7461c9a317aa249adf12821de17d6dd59f3c17e01394047df31e875a551d23d32a64a46f8db46003c2feced7e967dd159bc65d3bff76e66
-
Filesize
534KB
MD59e14775490cee79c73cb45c2f24f7a73
SHA1ddd6c7485a5e64a66a0a7598777abdafa7a63950
SHA256d53df5b6b080ba24773ca16c7a8b70eeb783ead278712e0c5b44abc84805e60e
SHA5121c0aec61a64400bcf18f6f0e5a950c68b7a25492b07290e3793a759f616c1b361ed6472d260d0f379b691567216a1f9e53af53b2dc89711df618a4463c8d0317
-
Filesize
299KB
MD55d5392e5c3edac5337a75692f75b4c8e
SHA180b9f25c4162e69fc24a5a056e2c3fc029b68f02
SHA256e7c8df1d1cf7e5abf9c6c025ee99acad9ce907d5f584bb38c5eeb32706251109
SHA51215141c710c41ff75b23b8b406d91b105dcfe5bb8819ae067baf1d2383a599e081ce14c978bdae151129352ccb096cd587e4ab1bf4f0995c284907e606ed66227
-
Filesize
355KB
MD533ed3913ea48a41363644e37261fddc2
SHA1f52b405849a5bcffa792ee44643c7d6c9db9044f
SHA2563859cde03ca6389bb5973e274ab9da5b51b9593a319e1b16330225b2aea8bd63
SHA5121b4c87215b7da10166ddfc9a9f214a8fc4292905517f4632fea937fd5aff83f8cec3c99cf15dac0d6d34f0a180b592e2f3fc8346e6aa52bcf064c396b547e053
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
368KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
7.2MB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
240KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
560KB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
368KB