Overview

overview

10

Static

static

10

Paypal cracker.exe

windows7-x64

10

Paypal cracker.exe

windows10-2004-x64

libeay32.dll

windows7-x64

3

libeay32.dll

windows10-2004-x64

3

libssl32.dll

windows7-x64

3

libssl32.dll

windows10-2004-x64

3

msvcr71.dll

windows7-x64

3

msvcr71.dll

windows10-2004-x64

3

ssleay32.dll

windows7-x64

3

ssleay32.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    31-12-2024 12:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Paypal cracker.exe

  • Size

    6.6MB

  • MD5

    5627dd16f023b8be51ed365d2fb6fee5

  • SHA1

    fcccce747bf6c824233cfda366798fa0467d3daf

  • SHA256

    2e2f6fe5b310d843656af43b60c0faddf6eb0f329efc8353272437db44b5f247

  • SHA512

    e475f903d2afd4c1b985f368f77610270df54bb8207130f6339e59595777718cfadadbb732775523a11aa035cbbf3c6d81896a33d84b40f6c01f182a1654f637

  • SSDEEP

    98304:xRlI+LjNr86mjj/UYviu26bbyKS2myX0rPpIh1KcV:xRlVmj72wblTmyEpG17V

Score
10/10
quasarvenomratwindows securitydiscoverypersistenceratrootkitspywarestealertrojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

windows security

C2

quasarrat220-24487.portmap.io:24487

Mutex

VNM_MUTEX_mOPqShedZxvAqgLrWL

Attributes
  • encryption_key

    7mvA2TfKjvMIY0zZeMKF

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

  • subdirectory

    SubDir

Signatures

  • Contains code to disable Windows Defender 3 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 3 IoCs
  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat
  • Venomrat family
    venomrat
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 56 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Paypal cracker.exe
    "C:\Users\Admin\AppData\Local\Temp\Paypal cracker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Users\Admin\AppData\Roaming\systemsvc.exe
      "C:\Users\Admin\AppData\Roaming\systemsvc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2692
    • C:\Users\Admin\AppData\Roaming\systemkvc.exe
      "C:\Users\Admin\AppData\Roaming\systemkvc.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Services\6D9F65649A3.exe
        "C:\Services\6D9F65649A3.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1792
        • C:\Users\Admin\AppData\Local\Temp\96822CC.exe
          "C:\Users\Admin\AppData\Local\Temp\96822CC.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer Phishing Filter
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2512
    • C:\Users\Admin\AppData\Local\Temp\Checker.exe
      "Checker.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Users\Admin\AppData\Local\Temp\PAYPAL.EXE
        "C:\Users\Admin\AppData\Local\Temp\PAYPAL.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:1940
      • C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE
        "C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2600
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE" /rl HIGHEST /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1700
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\uy5yOVqTV7F1.bat" "
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1852
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1604
          • C:\Windows\SysWOW64\PING.EXE
            ping -n 10 localhost
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2284
          • C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE
            "C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2588
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\tEpQvHWYjaSO.bat" "
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1200
              • C:\Windows\SysWOW64\chcp.com
                chcp 65001
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2168
              • C:\Windows\SysWOW64\PING.EXE
                ping -n 10 localhost
                7⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2060
              • C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE
                "C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE"
                7⤵
                • Executes dropped EXE
                PID:1396
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 1448
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1676
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
    1⤵
      PID:1536

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Services\47B2B8B1239598F
      Filesize

      34KB

      MD5

      6a172fdb857f0ac1921efc443e407e7d

      SHA1

      9401bd19abe0750b866625107f146c1cf55c75b8

      SHA256

      ab3adcd792f9526fc8634b1de30773d74becadaf056c8d3b1aeee1641f4d640b

      SHA512

      195a632b76a2a19227cbd1364b810148764c6e5b94971d3e34f93e83d38d410d122db52671a9ebca4087e0216361c6e54db7f959a83832cb5ca2d769cec04ef2

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\96822CC.exe
      Filesize

      3KB

      MD5

      29090b6b4d6605a97ac760d06436ac2d

      SHA1

      d929d3389642e52bae5ad8512293c9c4d3e4fab5

      SHA256

      98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

      SHA512

      9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Checker.exe
      Filesize

      5.9MB

      MD5

      3425a9f00842bf28a0bafc5c1571b881

      SHA1

      3009eca32bcf159981d37a8620836b1d215aa33e

      SHA256

      7328321fccd71cfda94a18656158ce54b0e3a0831d48f46f559b442a33a1790a

      SHA512

      868b816f376a3bc38d24850808eb5410e4037acedd0849ad73868065525444a4cca54e3484d5ac0b14523217f3d6da24fc6132942632653439f0ea5310084bc7

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\WINDOWS SECURITY.EXE
      Filesize

      534KB

      MD5

      9e14775490cee79c73cb45c2f24f7a73

      SHA1

      ddd6c7485a5e64a66a0a7598777abdafa7a63950

      SHA256

      d53df5b6b080ba24773ca16c7a8b70eeb783ead278712e0c5b44abc84805e60e

      SHA512

      1c0aec61a64400bcf18f6f0e5a950c68b7a25492b07290e3793a759f616c1b361ed6472d260d0f379b691567216a1f9e53af53b2dc89711df618a4463c8d0317

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tEpQvHWYjaSO.bat
      Filesize

      213B

      MD5

      19736a966ca9e3de86dbd578fe432f16

      SHA1

      f507603f438840d7eaa5b598556e509040a62d03

      SHA256

      e835deb76665287f0cc77378c22357ce8ab0c43ea7b2e8b2b9e0fb6d56a1c0a9

      SHA512

      af68a86157db93d008362c7076a35383b558966b25a6b25170b90c9c66d3581e3bf4cefce65ca9a534486c11f4ab470bca1ae77743c96ed40d32b125c5c73b3a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\uy5yOVqTV7F1.bat
      Filesize

      213B

      MD5

      bb2f78e149da47536fade0d0b4de8fd3

      SHA1

      46ac8d07a9766c02e6d3e25d9a309b7954c239a5

      SHA256

      0e8089114db000862261c18c4088a1991f15881c5925ec32d595ae7a786d15c1

      SHA512

      86f224cf62dfb097e7c0ae2e5184ddf2e81d5a739728df85ae3cba2382fdb22498e7e4db6e25645538f9a337438c7d037df1baf21aac0dca31bbd1fdc9901d1c

      Download Submit

    • C:\Users\Admin\AppData\Roaming\systemkvc.exe
      Filesize

      355KB

      MD5

      33ed3913ea48a41363644e37261fddc2

      SHA1

      f52b405849a5bcffa792ee44643c7d6c9db9044f

      SHA256

      3859cde03ca6389bb5973e274ab9da5b51b9593a319e1b16330225b2aea8bd63

      SHA512

      1b4c87215b7da10166ddfc9a9f214a8fc4292905517f4632fea937fd5aff83f8cec3c99cf15dac0d6d34f0a180b592e2f3fc8346e6aa52bcf064c396b547e053

      Download Submit

    • C:\Users\Admin\Desktop\New Text Document.txt
      Filesize

      11B

      MD5

      fc0fd331f06f178f1784b3ac10d55be9

      SHA1

      a4055329129f29983175460f2040a1044f52e404

      SHA256

      686d730989029fa82d827e3af80ce673ed16673363c6353a408b930a2f23b977

      SHA512

      98ea91beb8c38de34f543f2c1162d60ecb0b6bb620802c80b4c0495b1309b0893e198a8360ce9ae0db4b1dbc28572423930b5efeb0f8624480fac4686daa111c

      Download Submit

    • \Users\Admin\AppData\Local\Temp\PAYPAL.EXE
      Filesize

      5.3MB

      MD5

      341b34b571af06277c2f3b4156bd86df

      SHA1

      ba120240400cc6dcf0e92e732d4f460f3763102b

      SHA256

      9a579053ee79c9ee45e29ac1887aba8cb87936c01026b5f3d830456547adc441

      SHA512

      2cbb482d2e087e18b7461c9a317aa249adf12821de17d6dd59f3c17e01394047df31e875a551d23d32a64a46f8db46003c2feced7e967dd159bc65d3bff76e66

      Download Submit

    • \Users\Admin\AppData\Roaming\systemsvc.exe
      Filesize

      299KB

      MD5

      5d5392e5c3edac5337a75692f75b4c8e

      SHA1

      80b9f25c4162e69fc24a5a056e2c3fc029b68f02

      SHA256

      e7c8df1d1cf7e5abf9c6c025ee99acad9ce907d5f584bb38c5eeb32706251109

      SHA512

      15141c710c41ff75b23b8b406d91b105dcfe5bb8819ae067baf1d2383a599e081ce14c978bdae151129352ccb096cd587e4ab1bf4f0995c284907e606ed66227

      Download Submit

    • memory/1792-71-0x00000000013C0000-0x000000000141C000-memory.dmp

      Filesize

      368KB

      Download

    • memory/1940-403-0x0000000000400000-0x0000000000B2B000-memory.dmp

      Filesize

      7.2MB

      Download

    • memory/1940-39-0x0000000000400000-0x0000000000B2B000-memory.dmp

      Filesize

      7.2MB

      Download

    • memory/2512-97-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-107-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-73-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2512-68-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2512-74-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2512-91-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-88-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-78-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2512-77-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2512-92-0x00000000007A0000-0x00000000007B6000-memory.dmp

      Filesize

      88KB

      Download

    • memory/2512-75-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2512-98-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-99-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-117-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-116-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-112-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-111-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-110-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-109-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-93-0x00000000007A0000-0x00000000007B6000-memory.dmp

      Filesize

      88KB

      Download

    • memory/2512-94-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2512-95-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-96-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-108-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-113-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-114-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-115-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-100-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-101-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-102-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-103-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-106-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-105-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2512-104-0x000000000BB50000-0x000000000BBA2000-memory.dmp

      Filesize

      328KB

      Download

    • memory/2588-37-0x0000000003790000-0x0000000003EBB000-memory.dmp

      Filesize

      7.2MB

      Download

    • memory/2600-129-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2600-124-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2600-131-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2600-130-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2600-125-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2600-126-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2600-127-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2600-128-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2600-119-0x00000000000F0000-0x00000000000F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2600-120-0x00000000000F0000-0x00000000000F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2600-145-0x00000000009D0000-0x0000000000A5C000-memory.dmp

      Filesize

      560KB

      Download

    • memory/2600-123-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2600-122-0x000000000BAD0000-0x000000000BB16000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2792-45-0x0000000000030000-0x0000000000031000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2792-53-0x00000000013C0000-0x000000000141C000-memory.dmp

      Filesize

      368KB

      Download

    • memory/2792-46-0x0000000000030000-0x0000000000031000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2792-21-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2792-175-0x00000000003F0000-0x000000000044C000-memory.dmp

      Filesize

      368KB

      Download

    • memory/2792-19-0x000000000047E000-0x000000000047F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2792-20-0x000000000047E000-0x000000000047F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2792-22-0x000000000047E000-0x000000000047F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2792-18-0x00000000003F0000-0x000000000044C000-memory.dmp

      Filesize

      368KB

      Download