quasar | 5bfd4a2a53142c78b5ad8eb5ca2f14bb28fa648b2ce1d2169d837346f2673004

General

Target

61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe
Size

538KB
MD5

61eabb5f86336fe941185bf0a37a8472
SHA1

c733162ee7b9c8622d06258f676c846e99689199
SHA256

5bfd4a2a53142c78b5ad8eb5ca2f14bb28fa648b2ce1d2169d837346f2673004
SHA512

b2d458c865ada84666405636c40a70724d433d1bc9bcdfc830ff9b9b05c1ee08cafd2bbb2e59cd8820c0c247bee2dec432493e6aade925c30ea00a6f9b33efdd
SSDEEP

12288:oghbus5MJCyVyV4mqcS0KRBY+gSwQUuuGsTvZv/cDTX:HFu5V7tcUShSl1uGCZv/c/

Score

10^/10

quasar venomrat svhost rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

svhost

C2

myconect.ddns.net:6606

Mutex

VNM_MUTEX_ND6PULLW5ZVLwo1nwR

Attributes

encryption_key
yaa63tXY4j55os5llHHd
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\$77-Venom.exe	disable_win_def
behavioral2/memory/3008-21-0x0000000000CC0000-0x0000000000D4C000-memory.dmp	disable_win_def

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\$77-Venom.exe	family_quasar
behavioral2/memory/3008-21-0x0000000000CC0000-0x0000000000D4C000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

$77-Venom.exe

pid process

3008 $77-Venom.exe

pid	process
3008	$77-Venom.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\assembly\Desktop.ini	61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe
File created	C:\Windows\assembly\Desktop.ini	61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 ip-api.com

flow	ioc
20	ip-api.com

Drops file in Windows directory 3 IoCs

Processes:

61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe
File created	C:\Windows\assembly\Desktop.ini	61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3916 WINWORD.EXE
3916 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

$77-Venom.exe

description pid process

Token: SeDebugPrivilege 3008 $77-Venom.exe
Token: SeDebugPrivilege 3008 $77-Venom.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

3916 WINWORD.EXE
3916 WINWORD.EXE
3916 WINWORD.EXE
3916 WINWORD.EXE
3916 WINWORD.EXE
3916 WINWORD.EXE
3916 WINWORD.EXE
3916 WINWORD.EXE

pid	process
3916	WINWORD.EXE
3916	WINWORD.EXE

description	pid	process
Token: SeDebugPrivilege	3008	$77-Venom.exe
Token: SeDebugPrivilege	3008	$77-Venom.exe

pid	process
3916	WINWORD.EXE
3916	WINWORD.EXE
3916	WINWORD.EXE
3916	WINWORD.EXE
3916	WINWORD.EXE
3916	WINWORD.EXE
3916	WINWORD.EXE
3916	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe

description	pid	process	target process
PID 212 wrote to memory of 3008	212	61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe	$77-Venom.exe
PID 212 wrote to memory of 3008	212	61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe	$77-Venom.exe
PID 212 wrote to memory of 3008	212	61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe	$77-Venom.exe
PID 212 wrote to memory of 3916	212	61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe	WINWORD.EXE
PID 212 wrote to memory of 3916	212	61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\61eabb5f86336fe941185bf0a37a8472_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:212

C:\Users\Admin\AppData\Roaming\$77-Venom.exe
"C:\Users\Admin\AppData\Roaming\$77-Venom.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\null (2).docx" /o ""
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3916

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TCD9711.tmp\iso690.xsl
Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Roaming\$77-Venom.exe
Filesize
534KB

MD5
84c1dc6b428904cc2a6746653849df0f

SHA1
5cce4078427481f4d7456b5a4f3930ae6e706fb4

SHA256
bc24e3c5408fea0b6f9aa0deb56a4636a8d0b9a6054ff1033efa6ccfe04ba44a

SHA512
3b7a7607c3409b5ded563f2e1fcc0fa489c4465ab764d14a647b474968a025a95fa8ceb549fc70482b7b1dd935f66a41ada7b4910059786aafc870c5847a9245

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Filesize
225B

MD5
1e77bf000af3347e2808089d03ffc34b

SHA1
6f8ec790634583a6a7640138a92a49de71b7e3d6

SHA256
dfc2ad4bd81e656c4ff596ee0b0473af6a5cc43bca4defbf9b36da918040cb9b

SHA512
65323302e51a2f8e314105931ccc3c05700c8121a6e299d3fc8483f2b356f18b937cf33b8f0a2db29a51cf811902b123be0c972ec50fb97fb23974a0ade4f843

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize
3KB

MD5
c33b25ee689feb4bfbd22875561b9d70

SHA1
7bd62d3e3749d0218bbb8e14265e13c630dbc1e1

SHA256
c51e9f4081198f8e554e9226f0f728a616a2a7e9d2cea74b27e7b46d50f9548f

SHA512
b2102f41dddec12e6a89440fb97e4f7196046ba4801de1e630613c8d7e4a897cc00fc5bb8e819cf22e78a5a53c7f774c4ca9febd142983e65f8b22132b9c02cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize
3KB

MD5
92d954d6d749388363c425714a755b8a

SHA1
65b11d1c4f50fff9bf99e74d70cc40c270235caf

SHA256
7679d8e7eef2259c0459a5a2c27193d85c16f8d1996ccb4448d62bf64658c09d

SHA512
555955c32acd13ade130c57832e6d5461b02bad5e10a8cd4dd824496fa512d4bcb335f59170a787399e1d1f5382298c60e3ecf32671784347ce851004b51ea94

Download Submit
C:\Users\Admin\AppData\Roaming\null (2).docx
Filesize
2KB

MD5
b73ace90e3fbada0e8baa0d47b2cbd6f

SHA1
2147bfa5d92cb0c3fd296e7c90befa08564240a6

SHA256
94f271283b679ee024724d1aee0f4ead90ce56fb67813b5e0cbc082091fbe364

SHA512
d1a9d73fca25a73782bd0170937225afdb402a354a7fb6ea308114e276aed7f77ef211c458dd03292d2e90cd1d61976340396540ac410d452bda363f6d2ee157

Download Submit
memory/212-0-0x00000000753D2000-0x00000000753D3000-memory.dmp

Filesize
4KB

Download
memory/212-1-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/212-2-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/212-23-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/3008-38-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp

Filesize
2.0MB

Download
memory/3008-18-0x000000007224E000-0x000000007224F000-memory.dmp

Filesize
4KB

Download
memory/3008-568-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp

Filesize
2.0MB

Download
memory/3008-565-0x000000007224E000-0x000000007224F000-memory.dmp

Filesize
4KB

Download
memory/3008-21-0x0000000000CC0000-0x0000000000D4C000-memory.dmp

Filesize
560KB

Download
memory/3008-34-0x0000000005720000-0x00000000057B2000-memory.dmp

Filesize
584KB

Download
memory/3008-24-0x0000000005BB0000-0x0000000006154000-memory.dmp

Filesize
5.6MB

Download
memory/3008-66-0x0000000006CA0000-0x0000000006CAA000-memory.dmp

Filesize
40KB

Download
memory/3008-65-0x00000000069A0000-0x00000000069DC000-memory.dmp

Filesize
240KB

Download
memory/3008-61-0x0000000006460000-0x0000000006472000-memory.dmp

Filesize
72KB

Download
memory/3008-58-0x0000000005840000-0x00000000058A6000-memory.dmp

Filesize
408KB

Download
memory/3916-26-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Filesize
64KB

Download
memory/3916-35-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp

Filesize
2.0MB

Download
memory/3916-39-0x00007FF8F32D0000-0x00007FF8F32E0000-memory.dmp

Filesize
64KB

Download
memory/3916-33-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp

Filesize
2.0MB

Download
memory/3916-32-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Filesize
64KB

Download
memory/3916-30-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Filesize
64KB

Download
memory/3916-37-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp

Filesize
2.0MB

Download
memory/3916-36-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp

Filesize
2.0MB

Download
memory/3916-28-0x00007FF935B4D000-0x00007FF935B4E000-memory.dmp

Filesize
4KB

Download
memory/3916-25-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Filesize
64KB

Download
memory/3916-31-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp

Filesize
2.0MB

Download
memory/3916-40-0x00007FF8F32D0000-0x00007FF8F32E0000-memory.dmp

Filesize
64KB

Download
memory/3916-27-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Filesize
64KB

Download
memory/3916-566-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp

Filesize
2.0MB

Download
memory/3916-567-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp

Filesize
2.0MB

Download
memory/3916-29-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp

Filesize
2.0MB

Download
memory/3916-590-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Filesize
64KB

Download
memory/3916-593-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Filesize
64KB

Download
memory/3916-592-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Filesize
64KB

Download
memory/3916-591-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Filesize
64KB

Download
memory/3916-594-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads