Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
01/04/2024, 09:38
General
- Target 6e88324fa975a177ec1aae3a7e9cbf0c_JaffaCakes118.exe
- Size 502KB
- Sample240401-ll84jaaf9t
- SHA256 bddaa21e315b720ed176a2b79402eb3936fcb0720e1a0626eb9d0d16f619b167
Malware Config
Extracted
-
quasar
-
1.4.0
-
Flame
-
205.185.118.52:20000
-
a29240aa-6acd-4239-8ddb-467651349a3f
-
encryption_key
45CD64426FF035695420CFA2524CB594ABBD310D
-
install_name
Authentication.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
WindowsUpdate
-
subdirectory
Windows
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e88324fa975a177ec1aae3a7e9cbf0c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6e88324fa975a177ec1aae3a7e9cbf0c_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows\Authentication.exe"C:\Users\Admin\AppData\Roaming\Windows\Authentication.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Authentication.exe
memory/4556-0-0x0000000000500000-0x0000000000584000-memory.dmp
memory/4556-1-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp
memory/4556-2-0x000000001B210000-0x000000001B220000-memory.dmp
memory/4556-10-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp
memory/4892-8-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp
memory/4892-9-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/4892-11-0x000000001BE90000-0x000000001BEE0000-memory.dmp
memory/4892-12-0x000000001BFA0000-0x000000001C052000-memory.dmp
memory/4892-13-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp
memory/4892-14-0x0000000000B40000-0x0000000000B50000-memory.dmp