Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Vortex Crypter.exe

windows7-x64

10

Vortex Crypter.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    104s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 04:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Vortex Crypter.exe

  • Size

    6.7MB

  • MD5

    818c5a007a2075f7c56eb69b75d12acb

  • SHA1

    2f33d50e879a18ff744424855d6356bae8f2d5d9

  • SHA256

    79712e68d88a6d2d87555f24f9dc767868289ce0e70000c14e3e72df1b4a58f9

  • SHA512

    f15717749deac968f48ac8c5df01368735658eca535efa19c1b5c2bcb3a1b1f065baa05b609b6526c384a6800b78adccfc8249aab8e7ce411041575303da8ec4

  • SSDEEP

    196608:hwy9GeDVI5DKBWZlkgJedYs6LtYdEhqTgKDSy3n1B:hwykYVI5DK2NNs6LtYdEhSp24B

Score
10/10
quasaroffice04agilenetdefense_evasiondiscoveryexecutionspywarestealerthemidatrojan

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Extracted

Family

quasar

Version

1.5.0

Botnet

Office04

C2

movies-concerning.gl.at.ply.gg:12712

Mutex

5f7b0195-4eaf-4ae9-b4f8-cc2f6f6c4eb3

Attributes
  • encryption_key

    27AAC11A05508545506D258070495FCDA9A82735

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Modded Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 4 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 3 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Vortex Crypter.exe
    "C:\Users\Admin\AppData\Local\Temp\Vortex Crypter.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C wmic path win32_ComputerSystem get model
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2488
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic path win32_ComputerSystem get model
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:6088
    • C:\Users\Admin\AppData\Local\Temp\ShisPJcwxJ\Vortex Crypter.exe
      "C:\Users\Admin\AppData\Local\Temp\ShisPJcwxJ\Vortex Crypter.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:1316
    • C:\Users\Admin\AppData\Local\Temp\TfvvqkmtwSyn\Client-built.exe
      "C:\Users\Admin\AppData\Local\Temp\TfvvqkmtwSyn\Client-built.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4260
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Quasar Modded Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4608
      • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4132
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks" /create /tn "Quasar Modded Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4968
        • C:\Windows\System32\conhost.exe
          "C:\Windows\System32\conhost.exe" reagentc /disable
          4⤵
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3388
          • C:\Windows\System32\reagentc.exe
            reagentc /disable
            5⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            PID:6108
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "$([System.Environment]::GetEnvironmentVariable('SystemDrive'))\"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3736
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks" /delete /tn "Quasar Modded Client Startup" /f
          4⤵
            PID:1432
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VlqMYcSwlXOq.bat" "
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1076
            • C:\Windows\system32\chcp.com
              chcp 65001
              5⤵
                PID:1556
              • C:\Windows\system32\PING.EXE
                ping -n 10 localhost
                5⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:3356
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C TIMEOUT /T 3 && DEL /f "C:\Users\Admin\AppData\Local\Temp\Vortex Crypter.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4628
          • C:\Windows\system32\timeout.exe
            TIMEOUT /T 3
            3⤵
            • Delays execution with timeout.exe
            PID:4828

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      PowerShell

      1
      T1059.001

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Persistence

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Privilege Escalation

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Defense Evasion

      Virtualization/Sandbox Evasion

      1
      T1497

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Browser Information Discovery

      1
      T1217

      Query Registry

      4
      T1012

      Remote System Discovery

      1
      T1018

      System Information Discovery

      4
      T1082

      System Network Configuration Discovery

      1
      T1016

      Internet Connection Discovery

      1
      T1016.001

      Virtualization/Sandbox Evasion

      1
      T1497

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\ShisPJcwxJ\Vortex Crypter.exe
        Filesize

        5.9MB

        MD5

        95373b3cad383bc50fe84a2a598b5cfb

        SHA1

        e65e24821a2167656a2bc2dffbb1bd82cd08aeec

        SHA256

        d02da3d3909dc335bee98ffb284ce5413c84d349137c236715a9f898eba6fa42

        SHA512

        9756fb770c8e6716328b1046fb0fd6bbccb16cbcdc7e05f581a47264f89ab0f5f9a691b1b0857a9f2fad1018ab81aa158de7a07446a28311f0aba3088b35b82e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\TfvvqkmtwSyn\Client-built.exe
        Filesize

        556KB

        MD5

        85410a49050c880d856c15b4c958d86d

        SHA1

        f520f25b5cd537b1060d8ca66f53bac745f8f8fa

        SHA256

        9365b6cee47eecc6eab2c6d138f0d5714c31ff1473143ce14ce874eb896f01b3

        SHA512

        94ac76b3fb61b14f39b9cc9848d530842c834ae32efede2da7c5ce3d062940a788391d7b22e888ec5b024dba7437ef043ee11554fe62509e1f71ee202791f7d5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\VlqMYcSwlXOq.bat
        Filesize

        211B

        MD5

        3dee579585d7e9ec7b9175f81586224e

        SHA1

        6c4b31824d757b5db44c167f1f867fa3b0bf0086

        SHA256

        aa35416cc1568079051192fa9c285189a49bd6ce51460b65591b512065ffc134

        SHA512

        00b7581c2a1f0c330644cda9ecef90199d326234b5c238855b1ee94ca6f7db5f9e0ac1a80f71119444b788acb3fc91f540133d28f3d899a2a9b41a2b692166a4

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fxp0dean.fva.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\ec62652a-4173-490a-bf30-4c378c0dcdd3\AgileDotNetRT64.dll
        Filesize

        2.9MB

        MD5

        9bb6ed08af544d3738e60200d2804180

        SHA1

        5a40b484ca56b1ce59add4ec283e21d60070be02

        SHA256

        86d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7

        SHA512

        63e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5

        Download Submit

      • memory/1316-37-0x00007FFA81E90000-0x00007FFA82642000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/1316-24-0x000001E55FF70000-0x000001E560558000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/1316-49-0x00007FFA81E90000-0x00007FFA82642000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/1316-42-0x00007FFA97080000-0x00007FFA971CE000-memory.dmp

        Filesize

        1.3MB

        Download

      • memory/1316-41-0x00007FFA81E90000-0x00007FFA82642000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/3736-67-0x0000018B541F0000-0x0000018B54212000-memory.dmp

        Filesize

        136KB

        Download

      • memory/4132-55-0x000001EFB28F0000-0x000001EFB2902000-memory.dmp

        Filesize

        72KB

        Download

      • memory/4132-50-0x000001EFB28A0000-0x000001EFB28F0000-memory.dmp

        Filesize

        320KB

        Download

      • memory/4132-51-0x000001EFB29B0000-0x000001EFB2A62000-memory.dmp

        Filesize

        712KB

        Download

      • memory/4132-52-0x000001EFB2610000-0x000001EFB265E000-memory.dmp

        Filesize

        312KB

        Download

      • memory/4132-56-0x000001EFB2950000-0x000001EFB298C000-memory.dmp

        Filesize

        240KB

        Download

      • memory/4132-57-0x000001EFB2EE0000-0x000001EFB2EF2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/4244-39-0x00007FFA87C20000-0x00007FFA886E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4244-33-0x000000001C0C0000-0x000000001C1C2000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/4244-0-0x00007FFA87C23000-0x00007FFA87C25000-memory.dmp

        Filesize

        8KB

        Download

      • memory/4244-2-0x00007FFA87C20000-0x00007FFA886E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4244-1-0x0000000000BB0000-0x0000000001260000-memory.dmp

        Filesize

        6.7MB

        Download

      • memory/4260-38-0x000001C31EDB0000-0x000001C31EDC8000-memory.dmp

        Filesize

        96KB

        Download

      • memory/4260-30-0x000001C31E970000-0x000001C31EA00000-memory.dmp

        Filesize

        576KB

        Download