quasar | f43704733fbb8efbc457bb922c529df7e358cd26f7d99f0ec4c4cbb748d816d1

General

Target

f84217da36243f2f84ac59ef8b7a335c_JaffaCakes118.exe
Size

557KB
MD5

f84217da36243f2f84ac59ef8b7a335c
SHA1

0db32208d2c6c43caa2c5f7030812521a749e91f
SHA256

f43704733fbb8efbc457bb922c529df7e358cd26f7d99f0ec4c4cbb748d816d1
SHA512

d247f517e8cf1cc93170b8c38c9a95e1797669478f7f7d65f9e13f3ff66b5995557ab86abb763a7208517a8033e4a708fca241d2f1ef257fadcedd6a73c7edd4
SSDEEP

6144:Zst++SoUwNSXqzvAaYhwOA2WGxa+7OTLubgabY03HEw5v+HEzK/bxQh9lp2E9Th0:6fXSaD50/AdNT6bi03Hv+YEyjJ1Zm

Score

10^/10

quasar venomrat office04 discovery rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

127.0.0.1:4782

Mutex

VNM_MUTEX_iRne81OIv7xHkBnmxo

Attributes

encryption_key
btGyLN1mMyjkKPSibgiM
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/files/0x0029000000018671-5.dat	disable_win_def
behavioral1/memory/2840-10-0x0000000000880000-0x0000000000936000-memory.dmp	disable_win_def

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0029000000018671-5.dat	family_quasar
behavioral1/memory/2840-10-0x0000000000880000-0x0000000000936000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Executes dropped EXE 1 IoCs

pid	Process
2840	Qparrgldtgy.exe

Loads dropped DLL 1 IoCs

pid	Process
2132	f84217da36243f2f84ac59ef8b7a335c_JaffaCakes118.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f84217da36243f2f84ac59ef8b7a335c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qparrgldtgy.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2856	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	Qparrgldtgy.exe
Token: SeDebugPrivilege	2840	Qparrgldtgy.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2840	Qparrgldtgy.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2840	2132	f84217da36243f2f84ac59ef8b7a335c_JaffaCakes118.exe	30
PID 2132 wrote to memory of 2840	2132	f84217da36243f2f84ac59ef8b7a335c_JaffaCakes118.exe	30
PID 2132 wrote to memory of 2840	2132	f84217da36243f2f84ac59ef8b7a335c_JaffaCakes118.exe	30
PID 2132 wrote to memory of 2840	2132	f84217da36243f2f84ac59ef8b7a335c_JaffaCakes118.exe	30
PID 2840 wrote to memory of 2856	2840	Qparrgldtgy.exe	32
PID 2840 wrote to memory of 2856	2840	Qparrgldtgy.exe	32
PID 2840 wrote to memory of 2856	2840	Qparrgldtgy.exe	32
PID 2840 wrote to memory of 2856	2840	Qparrgldtgy.exe	32

C:\Users\Admin\AppData\Local\Temp\f84217da36243f2f84ac59ef8b7a335c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f84217da36243f2f84ac59ef8b7a335c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\Qparrgldtgy.exe
  "C:\Users\Admin\AppData\Local\Temp\Qparrgldtgy.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Qparrgldtgy.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Qparrgldtgy.exe

Filesize
702KB

MD5
228c70c1f3f7931565e579dfa23c9d16

SHA1
36b022abebcf57a83a1984d824e3d1046dc7bf31

SHA256
f853198fd10c73b320de1723a25dd35d17f61a0afde46f8e3a9a85efde306656

SHA512
a35a7168426d882a3f1e27948d2854ddfaa9f9fdc91c6cafeef7defbb74b608ce3d21dacf9fe3013483efe3fd861202a6c4f275f051604bd92d52cd588961097

Download Submit
memory/2132-0-0x000000007439E000-0x000000007439F000-memory.dmp

Filesize
4KB

Download
memory/2132-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2132-2-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2132-12-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-10-0x0000000000880000-0x0000000000936000-memory.dmp

Filesize
728KB

Download
memory/2840-11-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-13-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-15-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-16-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads