Analysis
- max time kernel
40s - max time network
42s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
24/08/2026, 10:03
Errors
General
- Target 2c3dd563b1e0c39208261913d2b9312480ca939a60dcbe86bc860e8959e48548.exe
- Size 697KB
- Sample260824-l3ldsseq9v
- SHA256 2c3dd563b1e0c39208261913d2b9312480ca939a60dcbe86bc860e8959e48548
Malware Config
Extracted
-
quasar
-
2.1.0.0
-
Office04
-
armadada.ddns.net:4782
-
VNM_MUTEX_c2q7y2ayYutZ2XaYe7
-
encryption_key
8SaDmGQtcm4Ys5TDXATO
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
- Quasar payload 2 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c3dd563b1e0c39208261913d2b9312480ca939a60dcbe86bc860e8959e48548.exe"C:\Users\Admin\AppData\Local\Temp\2c3dd563b1e0c39208261913d2b9312480ca939a60dcbe86bc860e8959e48548.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c7dLjGAfdtqe.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 17804⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Client.exeC:\Users\Admin\AppData\Local\Temp\Client.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3532 -ip 35321⤵
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeC:\Users\Admin\AppData\Roaming\SubDir\Client.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
Client.exe
__PSScriptPolicyTest_nfmzuzic.2jm.ps1
c7dLjGAfdtqe.bat
memory/2052-56-0x0000000007380000-0x000000000738A000-memory.dmp
memory/2052-55-0x0000000007310000-0x000000000732A000-memory.dmp
memory/2052-62-0x0000000007630000-0x0000000007638000-memory.dmp
memory/2052-61-0x0000000007650000-0x000000000766A000-memory.dmp
memory/2052-60-0x0000000007550000-0x0000000007564000-memory.dmp
memory/2052-59-0x0000000007540000-0x000000000754E000-memory.dmp
memory/2052-58-0x0000000007510000-0x0000000007521000-memory.dmp
memory/2052-28-0x0000000004A30000-0x0000000004A66000-memory.dmp
memory/2052-29-0x00000000051C0000-0x00000000057E8000-memory.dmp
memory/2052-44-0x000000006FF30000-0x000000006FF7C000-memory.dmp
memory/2052-35-0x0000000005120000-0x0000000005142000-memory.dmp
memory/2052-37-0x00000000059F0000-0x0000000005A56000-memory.dmp
memory/2052-39-0x0000000005B40000-0x0000000005E94000-memory.dmp
memory/2052-41-0x0000000005FE0000-0x0000000005FFE000-memory.dmp
memory/2052-43-0x00000000065B0000-0x00000000065E2000-memory.dmp
memory/2052-42-0x0000000006000000-0x000000000604C000-memory.dmp
memory/2052-57-0x0000000007590000-0x0000000007626000-memory.dmp
memory/2052-52-0x0000000006FA0000-0x0000000006FBE000-memory.dmp
memory/2052-53-0x0000000006FD0000-0x0000000007073000-memory.dmp
memory/2052-54-0x0000000007950000-0x0000000007FCA000-memory.dmp
memory/3532-66-0x0000000006FD0000-0x0000000006FDA000-memory.dmp
memory/4396-0-0x0000000000DB0000-0x0000000000DC0000-memory.dmp
memory/4396-1-0x0000000074C82000-0x0000000074C84000-memory.dmp
memory/4896-17-0x0000000005590000-0x0000000005B34000-memory.dmp
memory/4896-16-0x0000000000360000-0x00000000003EC000-memory.dmp
memory/4896-22-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/4896-21-0x0000000004ED0000-0x0000000004EE2000-memory.dmp
memory/4896-20-0x0000000004E60000-0x0000000004EC6000-memory.dmp
memory/4896-19-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/4896-18-0x0000000004F00000-0x0000000004F92000-memory.dmp