Overview

overview

10

Static

static

3

Bitcoin Fl...er.exe

windows7-x64

10

Bitcoin Fl...er.exe

windows10-2004-x64

10

Btc_Flashi...t_.exe

windows7-x64

3

Btc_Flashi...t_.exe

windows10-2004-x64

3

Main.exe

windows7-x64

10

Main.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/03/2025, 21:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Main.exe

  • Size

    723KB

  • MD5

    da83861c41845595ac896a9ba8908166

  • SHA1

    35fb04158b18389c0fa05d560b44d0c90b378bac

  • SHA256

    88f0200e25ae48da6d87f5bb43c0b3ca9e3af0a55544a362a4c68fca967ab790

  • SHA512

    b257db872b86fc9565222694a5bf6e74f6c825a107b3ebbc38a7e19e762b143c7ad86bce111c9eb9424d5f83fe5cb057f73456fd3c19e7f68b95acbc5fb72e90

  • SSDEEP

    12288:tOhqsVIRb2yrFriBdD3aTbgLxLYjQbyGzs0yROS44MERXjI7Uh0TAXP6KH37gi:ohDsDhCU/gLijQbyGzs0yQaMKjI7kXjl

Score
10/10
asyncratquasarstormkittyvenomratdefaultoffice04defense_evasiondiscoveryevasionpersistenceprivilege_escalationratrootkitspywarestealertrojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

45.61.140.75:7812

Mutex

VNM_MUTEX_DIBuVCpZfDcrHCFft2

Attributes
  • encryption_key

    q8RpA86xyuUHuOrxUGXa

  • install_name

    Windows Security.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Service Host

  • subdirectory

    SubDir

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7479631857:AAFuIUMNJYKHzJ3Bc9t4FSh9ZQXlqymhFnk/sendMessage?chat_id=6291749148
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Contains code to disable Windows Defender 4 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 4 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 2 IoCs
  • Stormkitty family
    stormkitty
  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat
  • Venomrat family
    venomrat
  • Async RAT payload 1 IoCs
    rat
  • Deletes itself 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 5 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Main.exe
    "C:\Users\Admin\AppData\Local\Temp\Main.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Users\Admin\AppData\Roaming\Windows Security.exe
      "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
      2⤵
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender Real-time Protection settings
      • Modifies Windows Defender TamperProtection settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2828
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "Windows Service Host" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Security.exe" /rl HIGHEST /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3052
      • C:\Users\Admin\AppData\Roaming\SubDir\Windows Security.exe
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows Security.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2012
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks" /create /tn "Windows Service Host" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Security.exe" /rl HIGHEST /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2336
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" Get-MpPreference -verbose
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3032
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
        3⤵
        • System Location Discovery: System Language Discovery
        PID:604
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
          4⤵
          • Deletes itself
          • System Location Discovery: System Language Discovery
          PID:3012
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\JG2NNIwHy8Om.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2736
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2964
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 10 localhost
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2720
        • C:\Users\Admin\AppData\Roaming\Windows Security.exe
          "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:996
    • C:\Users\Admin\AppData\Roaming\crack.exe
      "C:\Users\Admin\AppData\Roaming\crack.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp586C.tmp.cmd""
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1712
        • C:\Windows\SysWOW64\timeout.exe
          timeout 4
          4⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:1268
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Wi-Fi Discovery
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
          • System Location Discovery: System Language Discovery
          PID:328
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show profile
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:940
        • C:\Windows\SysWOW64\findstr.exe
          findstr All
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1540
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1816
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1616
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show networks mode=bssid
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

4
T1562

Disable or Modify Tools

4
T1562.001

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

1
T1016.001

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\988aef883cbfe929420487071a3a2809\msgid.dat
    Filesize

    1B

    MD5

    cfcd208495d565ef66e7dff9f98764da

    SHA1

    b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

    SHA256

    5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

    SHA512

    31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\JG2NNIwHy8Om.bat
    Filesize

    210B

    MD5

    c1ebe2b5cde1fb7301e73a86e7113790

    SHA1

    c89c3cf56ab62a3b88b9d6e82327383fbe9ba547

    SHA256

    a965bcce32ef7dd6b08b7b2cc2131a77f7c642c80c8e4ec07cf1c19afe476af4

    SHA512

    8921e20d5feff7e9b8652aa5d1626094709f4dc5c6451288f4fdf31fa96a4dc3c0f9257f175509da0ee805a6ab41f4a6efa6d47bd95255df57fc242fca2067d0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\places.raw
    Filesize

    5.0MB

    MD5

    37c0ccc36df7aacfa0ff975a51e0212d

    SHA1

    aacb3c8c982dc134909c078f9523418f8486b2e9

    SHA256

    d0ef7ee080e5bfa8c0f781f223b4f4c888689f34f41392f546b5bad891286280

    SHA512

    892d091d7b71da5ff556d80c3d8953eb60a62da6e2aeb26932483dafb5c7002fa56aef00b507e87f28aecfa6dc67793b558cb5ca639cb50c552162715710dcb7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp586C.tmp.cmd
    Filesize

    151B

    MD5

    88cf037fa8140743965c8628a3349dae

    SHA1

    eed304a65e6a52725bc30f72fa708bb087dc0fc2

    SHA256

    4af7b269b8f2e341b48a27f2a8e32b94ec84ee247bfdac30410f95c9185c64db

    SHA512

    d0fd391a4fb5e50b0c9894d50a4befc8199329a149c0f606b4d75e7a43bd6b0fbd6bb51e1550a42ecf5b900ef0350d5a222cb4382a9766f6f4aa48194738cdba

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Windows Security.exe
    Filesize

    534KB

    MD5

    e08257dba54a675925b5fe410fb044b6

    SHA1

    4a15b592c595bae0abe7a3b160c026805700c6b6

    SHA256

    03ebf0bf1d1017311113a4a32b757a5ad415d29301ff1c736d504beba7244621

    SHA512

    45a343389a78269a861f99e7b1cf72c6be384043b36491b330ff48f7c940d2bcecd3d2f688adfa5b77029f39cc745926960f50d5506025726a0437d4b94bc2c2

    Download Submit

  • C:\Users\Admin\AppData\Roaming\crack.exe
    Filesize

    8KB

    MD5

    9215015740c937980b6b53cee5087769

    SHA1

    a0bfe95486944f1548620d4de472c3758e95d36a

    SHA256

    a5390a297f14ef8f5be308009ec436d2a58598188dbb92d7299795a10ba1c541

    SHA512

    5b9bbf1836466d803d3e160a38e10c8397aa3966c120ab6435a52b7d0a09eb664ef2172bf0e7e2de1cc3eae261167c9355fa7ac3b1b7e4504a7e07b82c4b90e2

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svchost.exe
    Filesize

    170KB

    MD5

    36e79d9c029304417b9e0a142eb22a42

    SHA1

    ec3e50b99c320bf80cf990558da8707fbb52edab

    SHA256

    b9b3b3630d78ed68c6cca1fb41fe51fa1626c6a58bd62387d824e344b8e451bb

    SHA512

    d2732de13b780eff3c14a4122410f02395a2d1cc36f7c28f9d8a58f07cc20528860ff169d35ba72cb64f0f0d58ca98f5a8bd962447c33f637ef9e8a0fc3ae9c8

    Download Submit

  • memory/996-135-0x00000000001D0000-0x000000000025C000-memory.dmp

    Filesize

    560KB

    Download

  • memory/1228-0-0x000007FEF5303000-0x000007FEF5304000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1228-1-0x0000000000B60000-0x0000000000C1C000-memory.dmp

    Filesize

    752KB

    Download

  • memory/2012-30-0x0000000001160000-0x00000000011EC000-memory.dmp

    Filesize

    560KB

    Download

  • memory/2744-20-0x0000000001220000-0x0000000001228000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2792-22-0x0000000000070000-0x00000000000A0000-memory.dmp

    Filesize

    192KB

    Download

  • memory/2828-21-0x00000000000D0000-0x000000000015C000-memory.dmp

    Filesize

    560KB

    Download