quasar | 0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72

Reason

Machine shutdown

General

Target

ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
Size

555KB
MD5

ccf59a9ca800d77f057cdc4f521495c1
SHA1

7cdab49311072b2de9adc80c44bb60c323367321
SHA256

0d5e2eae0c67083409f56b1b0da8a3ed755241f3c571c28fae7f6a8ba383ff72
SHA512

7ba18a18d3af162ea408746b362d6d56027b76c3f3208e87cea43aa9023ac39e1fa000c95d8e02c45e974674dc327f26f3d6a4ce0b36b1ccb226036ed104596a
SSDEEP

12288:LuRGujKm9u7E+EZj/ock+bNvVRbV3/pPtQDROsJt:LuRGKG7E+EZzoqbvR53VtQDROsJ

Score

10^/10

quasar venomrat office04 discovery rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

Mju-49682.portmap.io:49682

Mutex

VNM_MUTEX_c2q7y2ayYutZ2XaYe7

Attributes

encryption_key
SuO52LCbOLZpyY12QyzT
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/memory/4076-3-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4076-3-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 ip-api.com

flow	ioc
12	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

description	pid	process	target process
PID 4492 set thread context of 4076	4492	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2400 4076 WerFault.exe ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

pid	pid_target	process	target process
2400	4076	WerFault.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.execcf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.execmd.exechcp.comPING.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

4400 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4400 PING.EXE

pid	process
4400	PING.EXE

pid	process
4400	PING.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4076	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
Token: SeDebugPrivilege	4076	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

pid process

4076 ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

pid	process
4076	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.execcf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 4492 wrote to memory of 4076	4492	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 4492 wrote to memory of 4076	4492	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 4492 wrote to memory of 4076	4492	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 4492 wrote to memory of 4076	4492	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 4492 wrote to memory of 4076	4492	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 4492 wrote to memory of 4076	4492	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 4492 wrote to memory of 4076	4492	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 4492 wrote to memory of 4076	4492	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
PID 4076 wrote to memory of 680	4076	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	cmd.exe
PID 4076 wrote to memory of 680	4076	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	cmd.exe
PID 4076 wrote to memory of 680	4076	ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe	cmd.exe
PID 680 wrote to memory of 3640	680	cmd.exe	chcp.com
PID 680 wrote to memory of 3640	680	cmd.exe	chcp.com
PID 680 wrote to memory of 3640	680	cmd.exe	chcp.com
PID 680 wrote to memory of 4400	680	cmd.exe	PING.EXE
PID 680 wrote to memory of 4400	680	cmd.exe	PING.EXE
PID 680 wrote to memory of 4400	680	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Local\Temp\ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YKDEa4avsnMi.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:680
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:3640
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 1876
    3⤵
    - Program crash
    PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4076 -ip 4076
1⤵
PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ccf59a9ca800d77f057cdc4f521495c1_JaffaCakes118.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\YKDEa4avsnMi.bat

Filesize
243B

MD5
ca370876eb7db8eb0fcc79b11dc472fb

SHA1
1c0058e06fc1fd38d9d0280360ec6caa64a75086

SHA256
ae8c15a4150c5d6cac77dc44d6f38e9ec3f89b8b4d9892e9269c8aa6d5faf25c

SHA512
0c9408cab9ef17a26291bd6cda3b4c0d9c5c5db36d75df5e36f7c6b7d0e0cbe9b4df66bfa63dea89d0a3e481f6220d73dba4244f92d219ea239ea67f2c52a9bf

Download Submit
memory/4076-8-0x0000000005890000-0x0000000005E34000-memory.dmp

Filesize
5.6MB

Download
memory/4076-3-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4076-7-0x0000000074F20000-0x00000000756D0000-memory.dmp

Filesize
7.7MB

Download
memory/4076-9-0x00000000053C0000-0x0000000005452000-memory.dmp

Filesize
584KB

Download
memory/4076-10-0x0000000074F20000-0x00000000756D0000-memory.dmp

Filesize
7.7MB

Download
memory/4076-11-0x0000000005460000-0x00000000054C6000-memory.dmp

Filesize
408KB

Download
memory/4076-12-0x0000000006070000-0x0000000006082000-memory.dmp

Filesize
72KB

Download
memory/4076-13-0x00000000066F0000-0x000000000672C000-memory.dmp

Filesize
240KB

Download
memory/4076-15-0x0000000006A70000-0x0000000006A7A000-memory.dmp

Filesize
40KB

Download
memory/4492-6-0x0000000074F20000-0x00000000756D0000-memory.dmp

Filesize
7.7MB

Download
memory/4492-2-0x0000000005680000-0x0000000005688000-memory.dmp

Filesize
32KB

Download
memory/4492-0-0x0000000074F2E000-0x0000000074F2F000-memory.dmp

Filesize
4KB

Download
memory/4492-1-0x0000000000D50000-0x0000000000DE2000-memory.dmp

Filesize
584KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads