Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 04:40 UTC
Behavioral task
behavioral1
Sample
9e7b3fcd73d20b2c92b8cfa21626afc9cdd34fd093b0760d0b22edd3d027db78.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
9e7b3fcd73d20b2c92b8cfa21626afc9cdd34fd093b0760d0b22edd3d027db78.exe
Resource
win10v2004-20241007-en
General
-
Target
9e7b3fcd73d20b2c92b8cfa21626afc9cdd34fd093b0760d0b22edd3d027db78.exe
-
Size
916KB
-
MD5
bea723449eb145b6c4000bfca106e3ed
-
SHA1
42bf0ff775020eabeecf4150b0129dd561dc0736
-
SHA256
9e7b3fcd73d20b2c92b8cfa21626afc9cdd34fd093b0760d0b22edd3d027db78
-
SHA512
9b488266399b6e7aea71cde0eb7c23621b684e207f2cce1e4cec71da7122bda9cc3c51ef61d29a02f18c04feacbfa5e009a03d8ef50bac613b52e018a7c86954
-
SSDEEP
24576:u3zSBJk4l/5b1nhD6g+0yQEuTLusJLK1lkloLXZ:azSBJk4l/5b1nhD6g+0yQEuRk1lkg
Malware Config
Extracted
quasar
2.8.0.1
Comquedinhaacoisaanda
190.102.40.205:5552
PfN9Ye1THuAjieZbW1
-
encryption_key
m4bU7sJJzbSU2TB27KbW
-
install_name
Venom.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/4500-1-0x0000000000C80000-0x0000000000D6C000-memory.dmp family_quasar -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9e7b3fcd73d20b2c92b8cfa21626afc9cdd34fd093b0760d0b22edd3d027db78.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4500 9e7b3fcd73d20b2c92b8cfa21626afc9cdd34fd093b0760d0b22edd3d027db78.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e7b3fcd73d20b2c92b8cfa21626afc9cdd34fd093b0760d0b22edd3d027db78.exe"C:\Users\Admin\AppData\Local\Temp\9e7b3fcd73d20b2c92b8cfa21626afc9cdd34fd093b0760d0b22edd3d027db78.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4500
Network
-
Remote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestip-api.comIN AResponseip-api.comIN A208.95.112.1
-
Remote address:208.95.112.1:80RequestGET /json/ HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0
Host: ip-api.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 291
Access-Control-Allow-Origin: *
X-Ttl: 5
X-Rl: 43
-
Remote address:8.8.8.8:53Request1.112.95.208.in-addr.arpaIN PTRResponse1.112.95.208.in-addr.arpaIN PTRip-apicom
-
Remote address:8.8.8.8:53Request71.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request4.38.16.2.in-addr.arpaIN PTRResponse4.38.16.2.in-addr.arpaIN PTRa2-16-38-4deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request205.40.102.190.in-addr.arpaIN PTRResponse205.40.102.190.in-addr.arpaIN PTR190-102-40-205 sidbrasilcombr
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request100.168.16.2.in-addr.arpaIN PTRResponse100.168.16.2.in-addr.arpaIN PTRa2-16-168-100deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request102.168.16.2.in-addr.arpaIN PTRResponse102.168.16.2.in-addr.arpaIN PTRa2-16-168-102deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
208.95.112.1:80http://ip-api.com/json/http9e7b3fcd73d20b2c92b8cfa21626afc9cdd34fd093b0760d0b22edd3d027db78.exe420 B 639 B 6 4
HTTP Request
GET http://ip-api.com/json/HTTP Response
200 -
1.5kB 788 B 15 13
-
72 B 158 B 1 1
DNS Request
28.118.140.52.in-addr.arpa
-
56 B 72 B 1 1
DNS Request
ip-api.com
DNS Response
208.95.112.1
-
71 B 95 B 1 1
DNS Request
1.112.95.208.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
71.31.126.40.in-addr.arpa
-
68 B 129 B 1 1
DNS Request
4.38.16.2.in-addr.arpa
-
73 B 118 B 1 1
DNS Request
205.40.102.190.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.150.49.20.in-addr.arpa
-
142 B 157 B 2 1
DNS Request
56.163.245.4.in-addr.arpa
DNS Request
56.163.245.4.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
100.168.16.2.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
102.168.16.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa