Overview

overview

10

Static

static

10

VortexCrypter.exe

windows7-x64

10

VortexCrypter.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    103s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 04:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VortexCrypter.exe

  • Size

    6.7MB

  • MD5

    818c5a007a2075f7c56eb69b75d12acb

  • SHA1

    2f33d50e879a18ff744424855d6356bae8f2d5d9

  • SHA256

    79712e68d88a6d2d87555f24f9dc767868289ce0e70000c14e3e72df1b4a58f9

  • SHA512

    f15717749deac968f48ac8c5df01368735658eca535efa19c1b5c2bcb3a1b1f065baa05b609b6526c384a6800b78adccfc8249aab8e7ce411041575303da8ec4

  • SSDEEP

    196608:hwy9GeDVI5DKBWZlkgJedYs6LtYdEhqTgKDSy3n1B:hwykYVI5DK2NNs6LtYdEhSp24B

Score
10/10
quasaroffice04agilenetdefense_evasionspywarethemidatrojan

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Extracted

Family

quasar

Version

1.5.0

Botnet

Office04

C2

movies-concerning.gl.at.ply.gg:12712

Mutex

5f7b0195-4eaf-4ae9-b4f8-cc2f6f6c4eb3

Attributes
  • encryption_key

    27AAC11A05508545506D258070495FCDA9A82735

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Modded Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 4 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 3 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\VortexCrypter.exe
    "C:\Users\Admin\AppData\Local\Temp\VortexCrypter.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C wmic path win32_ComputerSystem get model
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4296
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic path win32_ComputerSystem get model
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4880
    • C:\Users\Admin\AppData\Local\Temp\zoUBCHaopd\Vortex Crypter.exe
      "C:\Users\Admin\AppData\Local\Temp\zoUBCHaopd\Vortex Crypter.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:3600
    • C:\Users\Admin\AppData\Local\Temp\KCKAzbRrCAVo\Client-built.exe
      "C:\Users\Admin\AppData\Local\Temp\KCKAzbRrCAVo\Client-built.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4076
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Quasar Modded Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3500
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C TIMEOUT /T 3 && DEL /f "C:\Users\Admin\AppData\Local\Temp\VortexCrypter.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4948
      • C:\Windows\system32\timeout.exe
        TIMEOUT /T 3
        3⤵
        • Delays execution with timeout.exe
        PID:2192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\KCKAzbRrCAVo\Client-built.exe
    Filesize

    556KB

    MD5

    85410a49050c880d856c15b4c958d86d

    SHA1

    f520f25b5cd537b1060d8ca66f53bac745f8f8fa

    SHA256

    9365b6cee47eecc6eab2c6d138f0d5714c31ff1473143ce14ce874eb896f01b3

    SHA512

    94ac76b3fb61b14f39b9cc9848d530842c834ae32efede2da7c5ce3d062940a788391d7b22e888ec5b024dba7437ef043ee11554fe62509e1f71ee202791f7d5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ec62652a-4173-490a-bf30-4c378c0dcdd3\AgileDotNetRT64.dll
    Filesize

    2.9MB

    MD5

    9bb6ed08af544d3738e60200d2804180

    SHA1

    5a40b484ca56b1ce59add4ec283e21d60070be02

    SHA256

    86d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7

    SHA512

    63e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\zoUBCHaopd\Vortex Crypter.exe
    Filesize

    5.9MB

    MD5

    95373b3cad383bc50fe84a2a598b5cfb

    SHA1

    e65e24821a2167656a2bc2dffbb1bd82cd08aeec

    SHA256

    d02da3d3909dc335bee98ffb284ce5413c84d349137c236715a9f898eba6fa42

    SHA512

    9756fb770c8e6716328b1046fb0fd6bbccb16cbcdc7e05f581a47264f89ab0f5f9a691b1b0857a9f2fad1018ab81aa158de7a07446a28311f0aba3088b35b82e

    Download Submit

  • memory/216-1-0x0000000000B70000-0x0000000001220000-memory.dmp

    Filesize

    6.7MB

    Download

  • memory/216-2-0x00007FFF4DC60000-0x00007FFF4E721000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/216-37-0x00007FFF4DC60000-0x00007FFF4E721000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/216-0-0x00007FFF4DC63000-0x00007FFF4DC65000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3600-38-0x00007FFF47D90000-0x00007FFF48542000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3600-24-0x000002AD78390000-0x000002AD78978000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/3600-40-0x00007FFF47D90000-0x00007FFF48542000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3600-42-0x00007FFF5C520000-0x00007FFF5C66E000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3600-43-0x00007FFF47D90000-0x00007FFF48542000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4076-30-0x00000256B4C10000-0x00000256B4C28000-memory.dmp

    Filesize

    96KB

    Download

  • memory/4076-28-0x00000256B47C0000-0x00000256B4850000-memory.dmp

    Filesize

    576KB

    Download