quasar | 0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72

General

Target

ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
Size

555KB
MD5

ccf59a9ca800d77f057cdc4f521495c1
SHA1

7cdab49311072b2de9adc80c44bb60c323367321
SHA256

0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72
SHA512

7ba18a18d3af162ea408746b362d6d56027b76c3f3208e87cea43aa9023ac39e1fa000c95d8e02c45e974674dc327f26f3d6a4ce0b36b1ccb226036ed104596a
SSDEEP

12288:LuRGujKm9u7E+EZj/ock+bNvVRbV3/pPtQDROsJt:LuRGKG7E+EZzoqbvR53VtQDROsJ

Score

10^/10

quasar venomrat office04 discovery rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

Mju-49682.portmap.io:49682

Mutex

VNM_MUTEX_c2q7y2ayYutZ2XaYe7

Attributes

encryption_key
SuO52LCbOLZpyY12QyzT
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 5 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/2792-15-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/2792-11-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/2792-7-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/2792-5-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/2792-13-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2792-15-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/2792-11-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/2792-7-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/2792-5-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/2792-13-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com

flow	ioc
2	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.execcf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

description	pid	process	target process
PID 2372 set thread context of 2792	2372	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2960 set thread context of 1368	2960	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2696 2792 WerFault.exe ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

pid	pid_target	process	target process
2696	2792	WerFault.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.execcf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.execmd.exechcp.comPING.EXEccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.execcf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

1628 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1628 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

pid process

1368 ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

pid	process
1628	PING.EXE

pid	process
1628	PING.EXE

pid	process
1368	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.execcf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2792	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
Token: SeDebugPrivilege	2792	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
Token: SeDebugPrivilege	1368	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

pid process

2792 ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

pid	process
2792	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.execcf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.execmd.execcf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

description	pid	process	target process
PID 2372 wrote to memory of 2792	2372	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2372 wrote to memory of 2792	2372	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2372 wrote to memory of 2792	2372	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2372 wrote to memory of 2792	2372	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2372 wrote to memory of 2792	2372	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2372 wrote to memory of 2792	2372	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2372 wrote to memory of 2792	2372	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2372 wrote to memory of 2792	2372	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2372 wrote to memory of 2792	2372	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2792 wrote to memory of 2948	2792	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	cmd.exe
PID 2792 wrote to memory of 2948	2792	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	cmd.exe
PID 2792 wrote to memory of 2948	2792	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	cmd.exe
PID 2792 wrote to memory of 2948	2792	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	cmd.exe
PID 2792 wrote to memory of 2696	2792	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	WerFault.exe
PID 2792 wrote to memory of 2696	2792	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	WerFault.exe
PID 2792 wrote to memory of 2696	2792	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	WerFault.exe
PID 2792 wrote to memory of 2696	2792	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	WerFault.exe
PID 2948 wrote to memory of 2544	2948	cmd.exe	chcp.com
PID 2948 wrote to memory of 2544	2948	cmd.exe	chcp.com
PID 2948 wrote to memory of 2544	2948	cmd.exe	chcp.com
PID 2948 wrote to memory of 2544	2948	cmd.exe	chcp.com
PID 2948 wrote to memory of 1628	2948	cmd.exe	PING.EXE
PID 2948 wrote to memory of 1628	2948	cmd.exe	PING.EXE
PID 2948 wrote to memory of 1628	2948	cmd.exe	PING.EXE
PID 2948 wrote to memory of 1628	2948	cmd.exe	PING.EXE
PID 2948 wrote to memory of 2960	2948	cmd.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2948 wrote to memory of 2960	2948	cmd.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2948 wrote to memory of 2960	2948	cmd.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2948 wrote to memory of 2960	2948	cmd.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2960 wrote to memory of 1368	2960	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2960 wrote to memory of 1368	2960	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2960 wrote to memory of 1368	2960	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2960 wrote to memory of 1368	2960	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2960 wrote to memory of 1368	2960	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2960 wrote to memory of 1368	2960	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2960 wrote to memory of 1368	2960	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2960 wrote to memory of 1368	2960	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 2960 wrote to memory of 1368	2960	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\bA9Gk3BPLBBT.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:2544
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 1476
    3⤵
    - Program crash
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bA9Gk3BPLBBT.bat

Filesize
243B

MD5
5d0408bf371d3d38ddc3253d7a2f313a

SHA1
291dac11eb1402b80aef6d8ba78673bc080df660

SHA256
8bde8a1e1dec20d99660eb24a34fb8df44536f49adbbf783cc03add35d6091cf

SHA512
153b29d885614cd1ca2bd6805ccc5d1056fd83268092d1ae3bdd09dfa6017791a478c7fb3edb7b1a8733d3f299327daa4911a42e2ddcf60c2c3369f2680171ff

Download Submit
memory/2372-16-0x00000000746E0000-0x0000000074DCE000-memory.dmp

Filesize
6.9MB

Download
memory/2372-1-0x0000000000B90000-0x0000000000C22000-memory.dmp

Filesize
584KB

Download
memory/2372-2-0x00000000003C0000-0x00000000003C8000-memory.dmp

Filesize
32KB

Download
memory/2372-0-0x00000000746EE000-0x00000000746EF000-memory.dmp

Filesize
4KB

Download
memory/2792-11-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2792-17-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/2792-15-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2792-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2792-7-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2792-5-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2792-13-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2792-3-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2792-18-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/2792-4-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2792-29-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads