Analysis

  • max time kernel
    132s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    03-12-2021 01:22

General

  • Target

    17311685b626728febd2b02b10bef166.exe

  • Size

    428KB

  • MD5

    17311685b626728febd2b02b10bef166

  • SHA1

    44220969370c56ffa1dd54c1c3252ccfde8a50d2

  • SHA256

    010207d4463874eabd3808b12355e24acab67ff55c93c075625c2a05e481fd31

  • SHA512

    9ace3b7efc7f6e017b6451f73083680c629b8bac4bbbdaab3e3d6b641b4baec721342bf278183fecb2924f4f2fd8d303d6b4caa80f7ccffd261b35f26b420491

Malware Config

Extracted

Family

jester

Botnet

fanyze

C2

http://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/fanyze

https://api.anonfiles.com/upload?token=d26d620842507144

Mutex

f9999b04-5f6b-47c3-830e-f07171c30d02

Attributes
  • license_key

    9A554B1F2269B7AF81AF6B074943117B

Signatures

  • Jester

    Jester is an information stealer malware written in C#.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17311685b626728febd2b02b10bef166.exe
    "C:\Users\Admin\AppData\Local\Temp\17311685b626728febd2b02b10bef166.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Users\Admin\AppData\Local\Temp\Jester.exe
      "C:\Users\Admin\AppData\Local\Temp\Jester.exe"
      2⤵
      • Executes dropped EXE
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:1788
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:1432
          • C:\Windows\system32\netsh.exe
            netsh wlan show profile
            4⤵
              PID:1480
            • C:\Windows\system32\findstr.exe
              findstr All
              4⤵
                PID:3196
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3168
              • C:\Windows\system32\chcp.com
                chcp 65001
                4⤵
                  PID:3568
                • C:\Windows\system32\netsh.exe
                  netsh wlan show profile name="65001" key=clear
                  4⤵
                    PID:3160
                  • C:\Windows\system32\findstr.exe
                    findstr Key
                    4⤵
                      PID:716
                  • C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe
                    "C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe"
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:3620

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/1788-121-0x00000247119E0000-0x00000247119E1000-memory.dmp

                Filesize

                4KB

              • memory/1788-123-0x000002472BF70000-0x000002472BF72000-memory.dmp

                Filesize

                8KB

              • memory/1788-124-0x00000247135F0000-0x00000247135F1000-memory.dmp

                Filesize

                4KB

              • memory/3620-152-0x0000000073B40000-0x0000000073C3B000-memory.dmp

                Filesize

                1004KB

              • memory/3620-153-0x0000000073AE0000-0x0000000073B06000-memory.dmp

                Filesize

                152KB

              • memory/3620-154-0x0000000001250000-0x0000000001663000-memory.dmp

                Filesize

                4.1MB

              • memory/3620-156-0x0000000073550000-0x0000000073845000-memory.dmp

                Filesize

                3.0MB

              • memory/3620-155-0x0000000073B40000-0x0000000073C3B000-memory.dmp

                Filesize

                1004KB

              • memory/3620-158-0x0000000073AE0000-0x0000000073B06000-memory.dmp

                Filesize

                152KB

              • memory/3620-157-0x0000000073850000-0x0000000073936000-memory.dmp

                Filesize

                920KB

              • memory/3620-159-0x0000000001250000-0x0000000001663000-memory.dmp

                Filesize

                4.1MB