quasar | e74ca6236680178ea85d3dec5335bf054d5004d7810683cb1233f67ca3894c73

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe
Size

491KB
MD5

61052c513ec73fe0fe0cefe1f5a8d588
SHA1

ec74c81f9ac11a02987788c3f5ae21c7702367cb
SHA256

e74ca6236680178ea85d3dec5335bf054d5004d7810683cb1233f67ca3894c73
SHA512

83e5b267dcb6ee461ce284150be7db62f7c9012d66336206c4ae30ec9a6d8bbe73c25927ca6491da1322ae7dade5a1e67253b1025abd58df8afed1fc40614a74
SSDEEP

6144:PhvvWMRnH9YMaxFewKakPM+f7FUEmiFjYjOSVhr2togLXax:PhvbRndox1KJFUEJFsqSf2tTX

Score

10^/10

quasar venomrat svhost rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

svhost

myconect.ddns.net:6606

Mutex

VNM_MUTEX_ND6PULLW5ZVLwo1nwR

Attributes

encryption_key
yaa63tXY4j55os5llHHd
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource yara_rule

C:\Users\Admin\AppData\Roaming\$77-Venom.exe disable_win_def
behavioral2/memory/1220-19-0x0000000000470000-0x00000000004FC000-memory.dmp disable_win_def
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar payload 2 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Roaming\$77-Venom.exe family_quasar
behavioral2/memory/1220-19-0x0000000000470000-0x00000000004FC000-memory.dmp family_quasar
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe
Executes dropped EXE 1 IoCs

Processes:

$77-Venom.exe

pid process

1220 $77-Venom.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 ip-api.com

resource	yara_rule
C:\Users\Admin\AppData\Roaming\$77-Venom.exe	disable_win_def
behavioral2/memory/1220-19-0x0000000000470000-0x00000000004FC000-memory.dmp	disable_win_def

resource	yara_rule
C:\Users\Admin\AppData\Roaming\$77-Venom.exe	family_quasar
behavioral2/memory/1220-19-0x0000000000470000-0x00000000004FC000-memory.dmp	family_quasar

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe

pid	process
1220	$77-Venom.exe

flow	ioc
17	ip-api.com

Drops file in Windows directory 2 IoCs

Processes:

61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings 61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1584 WINWORD.EXE
1584 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

$77-Venom.exe

description pid process

Token: SeDebugPrivilege 1220 $77-Venom.exe
Token: SeDebugPrivilege 1220 $77-Venom.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

1584 WINWORD.EXE
1584 WINWORD.EXE
1584 WINWORD.EXE
1584 WINWORD.EXE
1584 WINWORD.EXE
1584 WINWORD.EXE
1584 WINWORD.EXE
1584 WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe

pid	process
1584	WINWORD.EXE
1584	WINWORD.EXE

description	pid	process
Token: SeDebugPrivilege	1220	$77-Venom.exe
Token: SeDebugPrivilege	1220	$77-Venom.exe

pid	process
1584	WINWORD.EXE
1584	WINWORD.EXE
1584	WINWORD.EXE
1584	WINWORD.EXE
1584	WINWORD.EXE
1584	WINWORD.EXE
1584	WINWORD.EXE
1584	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe

description	pid	process	target process
PID 1612 wrote to memory of 1220	1612	61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe	$77-Venom.exe
PID 1612 wrote to memory of 1220	1612	61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe	$77-Venom.exe
PID 1612 wrote to memory of 1220	1612	61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe	$77-Venom.exe
PID 1612 wrote to memory of 1584	1612	61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe	WINWORD.EXE
PID 1612 wrote to memory of 1584	1612	61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\61052c513ec73fe0fe0cefe1f5a8d588_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\AppData\Roaming\$77-Venom.exe
"C:\Users\Admin\AppData\Roaming\$77-Venom.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\null (2).docx" /o ""
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1584

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TCD9AA6.tmp\iso690.xsl
Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Roaming\$77-Venom.exe
Filesize
534KB

MD5
84c1dc6b428904cc2a6746653849df0f

SHA1
5cce4078427481f4d7456b5a4f3930ae6e706fb4

SHA256
bc24e3c5408fea0b6f9aa0deb56a4636a8d0b9a6054ff1033efa6ccfe04ba44a

SHA512
3b7a7607c3409b5ded563f2e1fcc0fa489c4465ab764d14a647b474968a025a95fa8ceb549fc70482b7b1dd935f66a41ada7b4910059786aafc870c5847a9245

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Filesize
225B

MD5
1e77bf000af3347e2808089d03ffc34b

SHA1
6f8ec790634583a6a7640138a92a49de71b7e3d6

SHA256
dfc2ad4bd81e656c4ff596ee0b0473af6a5cc43bca4defbf9b36da918040cb9b

SHA512
65323302e51a2f8e314105931ccc3c05700c8121a6e299d3fc8483f2b356f18b937cf33b8f0a2db29a51cf811902b123be0c972ec50fb97fb23974a0ade4f843

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize
3KB

MD5
c2ab103a4b68d9daddeee23a2e7070d9

SHA1
14ccb3fb581125cb8984927124833bf841588362

SHA256
014f28d6d03d0c0bf868910f9351b224b9354a5d400c5afb71171ccad676ec47

SHA512
c8e897827d3efb9b5c70b26635d9a69f92cdc1fbb71f5f00c3121b9031a33916c4a200fa3ca79c90ac37c7ce357245e31770642437efdf444dc1f27fa5c0ea38

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize
3KB

MD5
a4d3f790c77db27643f5e167ff1cc0b1

SHA1
a12ee74dd97e80dc520c0e0c975ed1bb5897280a

SHA256
3de95c5785acb4312f491f18007509acf98346c2182c7721a6c08e84f3f0d056

SHA512
82d860a33af5c93d4dd103a3d770c188e4981f9c9ae1639bcb50709fa354a55b2b129ce3d5f41d52745948dd052955f733871f640cf7ebf951cc04c63a977609

Download Submit
C:\Users\Admin\AppData\Roaming\null (2).docx
Filesize
2KB

MD5
b73ace90e3fbada0e8baa0d47b2cbd6f

SHA1
2147bfa5d92cb0c3fd296e7c90befa08564240a6

SHA256
94f271283b679ee024724d1aee0f4ead90ce56fb67813b5e0cbc082091fbe364

SHA512
d1a9d73fca25a73782bd0170937225afdb402a354a7fb6ea308114e276aed7f77ef211c458dd03292d2e90cd1d61976340396540ac410d452bda363f6d2ee157

Download Submit
memory/1220-16-0x00000000723DE000-0x00000000723DF000-memory.dmp

Filesize
4KB

Download
memory/1220-396-0x00000000723DE000-0x00000000723DF000-memory.dmp

Filesize
4KB

Download
memory/1220-23-0x0000000005540000-0x0000000005AE4000-memory.dmp

Filesize
5.6MB

Download
memory/1220-74-0x0000000006450000-0x000000000645A000-memory.dmp

Filesize
40KB

Download
memory/1220-73-0x0000000006170000-0x00000000061AC000-memory.dmp

Filesize
240KB

Download
memory/1220-33-0x0000000004EC0000-0x0000000004F52000-memory.dmp

Filesize
584KB

Download
memory/1220-19-0x0000000000470000-0x00000000004FC000-memory.dmp

Filesize
560KB

Download
memory/1220-58-0x0000000005C30000-0x0000000005C42000-memory.dmp

Filesize
72KB

Download
memory/1220-39-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

Filesize
2.0MB

Download
memory/1220-46-0x0000000005000000-0x0000000005066000-memory.dmp

Filesize
408KB

Download
memory/1220-534-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

Filesize
2.0MB

Download
memory/1584-35-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

Filesize
64KB

Download
memory/1584-31-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

Filesize
64KB

Download
memory/1584-40-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

Filesize
2.0MB

Download
memory/1584-29-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

Filesize
64KB

Download
memory/1584-25-0x00007FFE046ED000-0x00007FFE046EE000-memory.dmp

Filesize
4KB

Download
memory/1584-42-0x00007FFDC1E80000-0x00007FFDC1E90000-memory.dmp

Filesize
64KB

Download
memory/1584-36-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

Filesize
2.0MB

Download
memory/1584-37-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

Filesize
2.0MB

Download
memory/1584-38-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

Filesize
2.0MB

Download
memory/1584-30-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

Filesize
64KB

Download
memory/1584-597-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

Filesize
2.0MB

Download
memory/1584-595-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

Filesize
64KB

Download
memory/1584-34-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

Filesize
2.0MB

Download
memory/1584-41-0x00007FFDC1E80000-0x00007FFDC1E90000-memory.dmp

Filesize
64KB

Download
memory/1584-26-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

Filesize
2.0MB

Download
memory/1584-24-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

Filesize
64KB

Download
memory/1584-596-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

Filesize
64KB

Download
memory/1584-505-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

Filesize
2.0MB

Download
memory/1584-506-0x00007FFE046ED000-0x00007FFE046EE000-memory.dmp

Filesize
4KB

Download
memory/1584-594-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

Filesize
64KB

Download
memory/1584-535-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

Filesize
2.0MB

Download
memory/1584-593-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

Filesize
64KB

Download
memory/1612-1-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/1612-2-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download
memory/1612-0-0x0000000075202000-0x0000000075203000-memory.dmp

Filesize
4KB

Download
memory/1612-32-0x0000000075200000-0x00000000757B1000-memory.dmp

Filesize
5.7MB

Download