File name: | monaco guck.exe |
Full analysis: | https://app.any.run/tasks/246718f9-735e-4468-bb9c-949d49e4207d |
Verdict: | Malicious activity |
Threats: | Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely. |
Analysis date: | June 27, 2022, 10:22:10 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
MD5: | C9730861A855C2360BC1C610874CDA86 |
SHA1: | 221BF41D5A328C3690C8AD268CFB819CC7397FBA |
SHA256: | 90CA44F5D63436A70D023AE571F42C332D88BC468ADED2F9ACF3E9B84A6FB7AC |
SSDEEP: | 6144:MpNHXf500M8knHTWJbO2SbL1CafH60dcCVVFy2:8d50ZqJbFa1tH6nCVVFy2 |
.exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
---|---|---|
.exe | | | Win64 Executable (generic) (21.3) |
.scr | | | Windows screen saver (10.1) |
.dll | | | Win32 Dynamic Link Library (generic) (5) |
.exe | | | Win32 Executable (generic) (3.4) |
AssemblyVersion: | 1.3.0.0 |
---|---|
ProductVersion: | 1.3.0.0 |
ProductName: | - |
OriginalFileName: | Client.exe |
LegalTrademarks: | - |
LegalCopyright: | - |
InternalName: | Client.exe |
FileVersion: | 1.3.0.0 |
FileDescription: | - |
CompanyName: | - |
Comments: | - |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 1.3.0.0 |
FileVersionNumber: | 1.3.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x581be |
UninitializedDataSize: | - |
InitializedDataSize: | 3072 |
CodeSize: | 352768 |
LinkerVersion: | 8 |
PEType: | PE32 |
TimeStamp: | 2022:06:27 12:21:54+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 27-Jun-2022 10:21:54 |
Comments: | - |
CompanyName: | - |
FileDescription: | - |
FileVersion: | 1.3.0.0 |
InternalName: | Client.exe |
LegalCopyright: | - |
LegalTrademarks: | - |
OriginalFilename: | Client.exe |
ProductName: | - |
ProductVersion: | 1.3.0.0 |
Assembly Version: | 1.3.0.0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000080 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 3 |
Time date stamp: | 27-Jun-2022 10:21:54 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00002000 | 0x000561C4 | 0x00056200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.44471 |
.rsrc | 0x0005A000 | 0x00000A00 | 0x00000A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.23597 |
.reloc | 0x0005C000 | 0x0000000C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.10191 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.22615 | 1171 | UNKNOWN | UNKNOWN | RT_MANIFEST |
mscoree.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2492 | "C:\Users\admin\AppData\Local\Temp\monaco guck.exe" | C:\Users\admin\AppData\Local\Temp\monaco guck.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 1.3.0.0 Modules
Quasar(PID) Process(2492) monaco guck.exe Certificate Signature LogDirLogs Tagwdadsa Startupruntime brocker MutexQSR_MUTEX_q2Tul7nBUKmd8SX6eg Install_NameClient.exe Sub_DirSubDir C2 (2)niggahunter88-33934.portmap.io:33934 Version1.3.0.0 | |||||||||||||||
3276 | "C:\Users\admin\AppData\Roaming\SubDir\Client.exe" | C:\Users\admin\AppData\Roaming\SubDir\Client.exe | monaco guck.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Version: 1.3.0.0 Modules
Quasar(PID) Process(3276) Client.exe Certificate Signature LogDirLogs Tagwdadsa Startupruntime brocker MutexQSR_MUTEX_q2Tul7nBUKmd8SX6eg Install_NameClient.exe Sub_DirSubDir C2 (2)niggahunter88-33934.portmap.io:33934 Version1.3.0.0 | |||||||||||||||
1988 | "C:\Program Files\Opera\opera.exe" | C:\Program Files\Opera\opera.exe | Explorer.EXE | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Internet Browser Version: 1748 Modules
| |||||||||||||||
384 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
1500 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 83.0 Modules
| |||||||||||||||
3296 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.0.1117024118\1426869262" -parentBuildID 20201112153044 -prefsHandle 1120 -prefMapHandle 1112 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 1204 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 83.0 Modules
| |||||||||||||||
708 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.6.1624583795\435927158" -childID 1 -isForBrowser -prefsHandle 2872 -prefMapHandle 2868 -prefsLen 245 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 2884 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 83.0 Modules
| |||||||||||||||
3360 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.13.553227784\429654681" -childID 2 -isForBrowser -prefsHandle 3112 -prefMapHandle 3108 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 3124 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 83.0 Modules
| |||||||||||||||
3900 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.20.439337104\967603797" -childID 3 -isForBrowser -prefsHandle 3644 -prefMapHandle 3640 -prefsLen 7470 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 3672 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 83.0 Modules
| |||||||||||||||
1492 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1500.21.978411728\1650280098" -childID 4 -isForBrowser -prefsHandle 3656 -prefMapHandle 3652 -prefsLen 7470 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1500 "\\.\pipe\gecko-crash-server-pipe.1500" 3704 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
|
(PID) Process: | (2492) monaco guck.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\monaco guck_RASAPI32 |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (2492) monaco guck.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\monaco guck_RASAPI32 |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (2492) monaco guck.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\monaco guck_RASAPI32 |
Operation: | write | Name: | FileTracingMask |
Value: | |||
(PID) Process: | (2492) monaco guck.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\monaco guck_RASAPI32 |
Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
(PID) Process: | (2492) monaco guck.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\monaco guck_RASAPI32 |
Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
(PID) Process: | (2492) monaco guck.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\monaco guck_RASAPI32 |
Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
(PID) Process: | (2492) monaco guck.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\monaco guck_RASMANCS |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (2492) monaco guck.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\monaco guck_RASMANCS |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (2492) monaco guck.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\monaco guck_RASMANCS |
Operation: | write | Name: | FileTracingMask |
Value: | |||
(PID) Process: | (2492) monaco guck.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\monaco guck_RASMANCS |
Operation: | write | Name: | ConsoleTracingMask |
Value: |
PID | Process | Filename | Type | |
---|---|---|---|---|
1500 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
1988 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opr6A41.tmp | xml | |
MD5:D8667E22C1FB99B3F385BEC5CC57971F | SHA256:D4254882968FA5DA7E96C97E0EAED669E0DD6C83B0F3D778F44EF5B7C5FF6913 | |||
1988 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat | binary | |
MD5:95C3A365142C4116906EDEAAAA866BAB | SHA256:CF813E4FEDD7BEF4BBACF3A7216AE8E9984D3F547B291DF37B9DF605CAA835BB | |||
1988 | opera.exe | C:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00003.tmp | xml | |
MD5:7966F3F842F1E41B71A94EE31B6DED29 | SHA256:1298A8BC01D74ACDDF2825B82EB242D005C0A816617A7E187FCC0B7BA8E23272 | |||
2492 | monaco guck.exe | C:\Users\admin\AppData\Roaming\SubDir\Client.exe | executable | |
MD5:C9730861A855C2360BC1C610874CDA86 | SHA256:90CA44F5D63436A70D023AE571F42C332D88BC468ADED2F9ACF3E9B84A6FB7AC | |||
1988 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml | xml | |
MD5:D8667E22C1FB99B3F385BEC5CC57971F | SHA256:D4254882968FA5DA7E96C97E0EAED669E0DD6C83B0F3D778F44EF5B7C5FF6913 | |||
3276 | Client.exe | C:\Users\admin\AppData\Roaming\Logs\06-27-2022 | binary | |
MD5:C1DB65B1598A725AA422907BB56610F9 | SHA256:30C9F2087AABFBF96F14C43EAF63B9C1AB5C582C2EEBD770D152104D704D6DF8 | |||
1988 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini | text | |
MD5:AD33D7DEC80A0252A33F10741224E785 | SHA256:F82E5C7678D553672403FE3E8398F172767C8738F755FA95E1D37FBE5744F159 | |||
1988 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opr69F2.tmp | text | |
MD5:AD33D7DEC80A0252A33F10741224E785 | SHA256:F82E5C7678D553672403FE3E8398F172767C8738F755FA95E1D37FBE5744F159 | |||
1988 | opera.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1DKRWBBKC08LJ7CIONFT.temp | binary | |
MD5:3F7590FD56AC999E0289444034C9CC80 | SHA256:632F80B7AD1F589FE608EF8546E3E7D1B0501A9EC3E38C0140EA1C10ED3E602B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2492 | monaco guck.exe | GET | — | 104.26.14.73:80 | http://freegeoip.net/xml/ | US | — | — | shared |
3276 | Client.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/json/ | unknown | binary | 281 b | shared |
1988 | opera.exe | GET | 200 | 93.184.220.29:80 | http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl | US | der | 592 b | whitelisted |
2492 | monaco guck.exe | GET | — | 208.95.112.1:80 | http://ip-api.com/json/ | unknown | — | — | shared |
1500 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | US | text | 8 b | whitelisted |
1500 | firefox.exe | POST | 200 | 142.250.186.131:80 | http://ocsp.pki.goog/gts1c3 | US | der | 471 b | whitelisted |
1500 | firefox.exe | POST | 200 | 142.250.186.131:80 | http://ocsp.pki.goog/gts1c3 | US | der | 472 b | whitelisted |
1988 | opera.exe | GET | 200 | 142.250.184.238:80 | http://clients1.google.com/complete/search?q=bin&client=opera-suggest-omnibox&hl=de | US | text | 155 b | whitelisted |
1500 | firefox.exe | POST | 200 | 142.250.186.131:80 | http://ocsp.pki.goog/gts1c3 | US | der | 472 b | whitelisted |
1500 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1988 | opera.exe | 185.26.182.94:443 | certs.opera.com | Opera Software AS | — | whitelisted |
3276 | Client.exe | 208.95.112.1:80 | ip-api.com | IBURST | — | malicious |
2492 | monaco guck.exe | 104.26.14.73:80 | freegeoip.net | Cloudflare Inc | US | shared |
1500 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | — | US | whitelisted |
1988 | opera.exe | 93.184.220.29:80 | crl3.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2492 | monaco guck.exe | 208.95.112.1:80 | ip-api.com | IBURST | — | malicious |
3276 | Client.exe | 193.161.193.99:33934 | niggahunter88-33934.portmap.io | OOO Bitree Networks | RU | malicious |
2492 | monaco guck.exe | 52.20.78.240:80 | api.ipify.org | Amazon.com, Inc. | US | malicious |
1988 | opera.exe | 142.250.184.238:80 | clients1.google.com | Google Inc. | US | whitelisted |
1500 | firefox.exe | 142.250.186.132:443 | www.google.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
ip-api.com |
| shared |
freegeoip.net |
| shared |
api.ipify.org |
| shared |
niggahunter88-33934.portmap.io |
| malicious |
certs.opera.com |
| whitelisted |
crl3.digicert.com |
| whitelisted |
clients1.google.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
example.org |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2492 | monaco guck.exe | Potential Corporate Privacy Violation | ET POLICY External IP Lookup ip-api.com |
2492 | monaco guck.exe | A Network Trojan was detected | ET TROJAN Common RAT Connectivity Check Observed |
2492 | monaco guck.exe | Potential Corporate Privacy Violation | AV POLICY Internal Host Retrieving External IP Address (ip-api. com) |
2492 | monaco guck.exe | A Network Trojan was detected | ET TROJAN W32/Quasar 1.3/Venom RAT Connectivity Check 3 |
2492 | monaco guck.exe | Potential Corporate Privacy Violation | ET POLICY External IP Lookup api.ipify.org |
3276 | Client.exe | Potential Corporate Privacy Violation | ET POLICY External IP Lookup ip-api.com |
3276 | Client.exe | A Network Trojan was detected | ET TROJAN Common RAT Connectivity Check Observed |
3276 | Client.exe | Potential Corporate Privacy Violation | AV POLICY Internal Host Retrieving External IP Address (ip-api. com) |
— | — | Potential Corporate Privacy Violation | ET POLICY DNS Query to a Reverse Proxy Service Observed |
1500 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |