File name:

Vanta Cheat.exe

Full analysis: https://app.any.run/tasks/f5893fde-4424-429c-928f-033f2267b6d3
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: August 05, 2024, 16:20:36
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
quasar
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

A083701F156B308338606A66A02AFF63

SHA1:

CF5B8E335D72513F2C8681E3C4430A0E55FBB79A

SHA256:

474DFD46630CD3970E8AFD0350D2BC8B3F8989BC6F00FA6DD7F65DD950E411A5

SSDEEP:

6144:/7WLUOKMGAAXYqcDCyKnzqGNpvhhoOb8F97j47K1Leqc:/7WDKMGAApcDqn22lhhopl4G1K9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Vanta Cheat.exe (PID: 6312)
      • Runtime.exe (PID: 6432)

    • QUASAR has been detected (YARA)

      • Runtime.exe (PID: 6432)

    • Drops the executable file immediately after the start

      • Vanta Cheat.exe (PID: 6312)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Vanta Cheat.exe (PID: 6312)

    • Starts itself from another location

      • Vanta Cheat.exe (PID: 6312)

    • Connects to unusual port

      • Runtime.exe (PID: 6432)

  • INFO

    • Reads the computer name

      • Vanta Cheat.exe (PID: 6312)
      • Runtime.exe (PID: 6432)
      • TextInputHost.exe (PID: 6376)

    • Checks supported languages

      • Vanta Cheat.exe (PID: 6312)
      • TextInputHost.exe (PID: 6376)
      • Runtime.exe (PID: 6432)

    • Creates files or folders in the user directory

      • Vanta Cheat.exe (PID: 6312)
      • Runtime.exe (PID: 6432)

    • Reads Environment values

      • Runtime.exe (PID: 6432)
      • Vanta Cheat.exe (PID: 6312)

    • Reads the machine GUID from the registry

      • Vanta Cheat.exe (PID: 6312)
      • Runtime.exe (PID: 6432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(6432) Runtime.exe
Version1.4.0
C2 (2)4.tcp.eu.ngrok.io:16568
Sub_DirWindowshelper
Install_NameRuntime.exe
Mutexc4dbc28d-96ce-4980-a57d-64960ef16483
StartupGoogle Chrome
TagGithub
LogDirLogs
SignatureMjdziuNmtL4tS5boTR6KRz2X1n3v4uBhWQEZAkG5TX4TJlDlY00vcGAfgOutC5UDtzYibL2XcPA3KP0BlXIEXhHngXTKsEq1fSE5x4qLnoM6rg48mm+Q95Doe6cdRxUyuhqESVQJClBnvO8ywbl1Ft3rhhnVo++HxD8vspak9D8Rj9nl5azxXKH0xL0IHk7BMKkO6xPiPzAFiOWqAXHVop+fNZQvpx1YOkhqVvPRYBnch7q+Zk/QcH7+lkLSq5IVWH1KlcimpbykAbmkGiB+A39wvtR7oTX/qNS2cc6FXvnY...
CertificateMIIE9DCCAtygAwIBAgIQAOWFzYtjAI4IAtNS7mcl3TANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDIwMTE3MzMzMVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAhhhg9U3/4tQ9UQeDxAjA7XifLW8q2YqjRWcCgq/ZJNj+w1KpCHV+Y+fkxm2iZfUyEmFbduqv...
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:06:05 15:59:49+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 509952
InitializedDataSize: 3584
UninitializedDataSize: -
EntryPoint: 0x7e79e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.7.4.6
ProductVersionNumber: 0.0.2.8
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Discord
FileDescription: Discord (32 Bit)
FileVersion: 2.7.4.6
InternalName: Vanta Cheat
LegalCopyright: 2023©
LegalTrademarks: Vanta Loader
OriginalFileName: Vanta Cheat
ProductName: Vanta Crack
ProductVersion: 0.0.2.8
AssemblyVersion: 0.0.2.8
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vanta cheat.exe #QUASAR runtime.exe textinputhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6312"C:\Users\admin\Desktop\Vanta Cheat.exe" C:\Users\admin\Desktop\Vanta Cheat.exe
explorer.exe
User:
admin
Company:
Discord
Integrity Level:
MEDIUM
Description:
Discord (32 Bit)
Exit code:
0
Version:
2.7.4.6
Modules
Images
c:\users\admin\desktop\vanta cheat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6376"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
6432"C:\Users\admin\AppData\Roaming\Windowshelper\Runtime.exe"C:\Users\admin\AppData\Roaming\Windowshelper\Runtime.exe
Vanta Cheat.exe
User:
admin
Company:
Discord
Integrity Level:
MEDIUM
Description:
Discord (32 Bit)
Version:
2.7.4.6
Modules
Images
c:\users\admin\appdata\roaming\windowshelper\runtime.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Quasar
(PID) Process(6432) Runtime.exe
Version1.4.0
C2 (2)4.tcp.eu.ngrok.io:16568
Sub_DirWindowshelper
Install_NameRuntime.exe
Mutexc4dbc28d-96ce-4980-a57d-64960ef16483
StartupGoogle Chrome
TagGithub
LogDirLogs
SignatureMjdziuNmtL4tS5boTR6KRz2X1n3v4uBhWQEZAkG5TX4TJlDlY00vcGAfgOutC5UDtzYibL2XcPA3KP0BlXIEXhHngXTKsEq1fSE5x4qLnoM6rg48mm+Q95Doe6cdRxUyuhqESVQJClBnvO8ywbl1Ft3rhhnVo++HxD8vspak9D8Rj9nl5azxXKH0xL0IHk7BMKkO6xPiPzAFiOWqAXHVop+fNZQvpx1YOkhqVvPRYBnch7q+Zk/QcH7+lkLSq5IVWH1KlcimpbykAbmkGiB+A39wvtR7oTX/qNS2cc6FXvnY...
CertificateMIIE9DCCAtygAwIBAgIQAOWFzYtjAI4IAtNS7mcl3TANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDIwMTE3MzMzMVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAhhhg9U3/4tQ9UQeDxAjA7XifLW8q2YqjRWcCgq/ZJNj+w1KpCHV+Y+fkxm2iZfUyEmFbduqv...
Total events
2 474
Read events
2 472
Write events
2
Delete events
0

Modification events

(PID) Process:(6312) Vanta Cheat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Google Chrome
Value:
"C:\Users\admin\Desktop\Vanta Cheat.exe"
(PID) Process:(6432) Runtime.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Google Chrome
Value:
"C:\Users\admin\AppData\Roaming\Windowshelper\Runtime.exe"
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6432Runtime.exeC:\Users\admin\AppData\Roaming\Logs\2024-08-05binary
MD5:CEE244174787542BD13D73EF1FC29270
SHA256:5EA17C5B7A919C0B648ED123915B63B39CA7C8C493A17CA77525E021A0B7D6BC
6312Vanta Cheat.exeC:\Users\admin\AppData\Roaming\Windowshelper\Runtime.exeexecutable
MD5:A083701F156B308338606A66A02AFF63
SHA256:474DFD46630CD3970E8AFD0350D2BC8B3F8989BC6F00FA6DD7F65DD950E411A5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
81
DNS requests
24
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5552
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5552
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6856
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6808
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2532
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1140
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6432
Runtime.exe
18.198.77.177:16568
4.tcp.eu.ngrok.io
AMAZON-02
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5336
SearchApp.exe
95.100.146.18:443
www.bing.com
Akamai International B.V.
CZ
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5552
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.110
whitelisted
4.tcp.eu.ngrok.io
  • 18.198.77.177
  • 3.121.139.82
malicious
www.bing.com
  • 95.100.146.18
  • 95.100.146.34
  • 95.100.146.17
  • 95.100.146.16
  • 95.100.146.8
  • 95.100.146.10
  • 95.100.146.19
  • 95.100.146.40
  • 95.100.146.11
  • 2.23.209.150
  • 2.23.209.141
  • 2.23.209.160
  • 2.23.209.148
  • 2.23.209.158
  • 2.23.209.179
  • 2.23.209.177
  • 2.23.209.149
  • 2.23.209.176
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.2
  • 20.190.159.0
  • 20.190.159.64
  • 20.190.159.68
  • 40.126.31.71
  • 40.126.31.73
  • 20.190.159.71
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
th.bing.com
  • 95.100.146.11
  • 95.100.146.18
  • 95.100.146.34
  • 95.100.146.17
  • 95.100.146.16
  • 95.100.146.8
  • 95.100.146.10
  • 95.100.146.19
  • 95.100.146.40
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Misc activity
ET INFO DNS Query to a *.ngrok domain (ngrok.io)
2256
svchost.exe
Misc activity
ET INFO DNS Query to a *.ngrok domain (ngrok.io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Vanta Cheat.exe