Analysis
- max time kernel
142s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
21/05/2024, 03:41
General
- Target 61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe
- Size 538KB
- Sample240521-d87j8agg31
- SHA256 5bfd4a2a53142c78b5ad8eb5ca2f14bb28fa648b2ce1d2169d837346f2673004
Malware Config
Extracted
-
quasar
-
2.1.0.0
-
svhost
-
myconect.ddns.net:6606
-
VNM_MUTEX_ND6PULLW5ZVLwo1nwR
-
encryption_key
yaa63tXY4j55os5llHHd
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
-
subdirectory
SubDir
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\$77-Venom.exe"C:\Users\Admin\AppData\Roaming\$77-Venom.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\null (2).docx" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
iso690.xsl
$77-Venom.exe
index.dat
ExcludeDictionaryEN0409.lex
fb3b0dbfee58fac8.customDestinations-ms
fb3b0dbfee58fac8.customDestinations-ms
null (2).docx
memory/212-0-0x00000000753D2000-0x00000000753D3000-memory.dmp
memory/212-1-0x00000000753D0000-0x0000000075981000-memory.dmp
memory/212-2-0x00000000753D0000-0x0000000075981000-memory.dmp
memory/212-23-0x00000000753D0000-0x0000000075981000-memory.dmp
memory/3008-38-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp
memory/3008-18-0x000000007224E000-0x000000007224F000-memory.dmp
memory/3008-568-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp
memory/3008-565-0x000000007224E000-0x000000007224F000-memory.dmp
memory/3008-21-0x0000000000CC0000-0x0000000000D4C000-memory.dmp
memory/3008-34-0x0000000005720000-0x00000000057B2000-memory.dmp
memory/3008-24-0x0000000005BB0000-0x0000000006154000-memory.dmp
memory/3008-66-0x0000000006CA0000-0x0000000006CAA000-memory.dmp
memory/3008-65-0x00000000069A0000-0x00000000069DC000-memory.dmp
memory/3008-61-0x0000000006460000-0x0000000006472000-memory.dmp
memory/3008-58-0x0000000005840000-0x00000000058A6000-memory.dmp
memory/3916-26-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp
memory/3916-32-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp
memory/3916-31-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp
memory/3916-27-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp
memory/3916-35-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp
memory/3916-30-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp
memory/3916-37-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp
memory/3916-36-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp
memory/3916-28-0x00007FF935B4D000-0x00007FF935B4E000-memory.dmp
memory/3916-25-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp
memory/3916-40-0x00007FF8F32D0000-0x00007FF8F32E0000-memory.dmp
memory/3916-33-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp
memory/3916-39-0x00007FF8F32D0000-0x00007FF8F32E0000-memory.dmp
memory/3916-566-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp
memory/3916-567-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp
memory/3916-29-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp
memory/3916-590-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp
memory/3916-593-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp
memory/3916-592-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp
memory/3916-591-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp
memory/3916-594-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp