jester | 2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea

General

Target

2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe
Size

1.7MB
MD5

bb9e3c71b3ee3279632905f905ac21c4
SHA1

a2b1d81ec6a21b52f555f5ec7e9cf9a73f937971
SHA256

2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea
SHA512

f63faf0d317fa32fa9e091dfb0327752433c94c2d8171ef1d4b988288012de2062c89c37c87513873010e7ea78e71d54981ca17cec333222eb9ad9bbb9600916

Score

10^/10

jester ads555man collection stealer

Malware Config

Extracted

Family

jester

Botnet

ads555man

C2

http://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/ads555man

https://api.anonfiles.com/upload?token=d26d620842507144

Mutex

efbb42d7-d0db-4f16-a194-3d9d9d1fc654

Attributes

license_key
65EEBAF23D4744267D131CD5BA37E706

Signatures

Jester
Jester is an information stealer malware written in C#.
stealer jester

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 ip-api.com

flow	ioc
18	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe

description	pid	process	target process
PID 2052 set thread context of 4076	2052	2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe	MSBuild.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

976 4076 WerFault.exe MSBuild.exe

pid	pid_target	process	target process
976	4076	WerFault.exe	MSBuild.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

MSBuild.exe2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exeWerFault.exe

pid	process
4076	MSBuild.exe
2052	2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe
2052	2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe
976	WerFault.exe
976	WerFault.exe
976	WerFault.exe
976	WerFault.exe
976	WerFault.exe
976	WerFault.exe
976	WerFault.exe
976	WerFault.exe
976	WerFault.exe
976	WerFault.exe
976	WerFault.exe
976	WerFault.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exeMSBuild.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	2052	2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe
Token: SeDebugPrivilege	4076	MSBuild.exe
Token: SeRestorePrivilege	976	WerFault.exe
Token: SeBackupPrivilege	976	WerFault.exe
Token: SeDebugPrivilege	976	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe

description	pid	process	target process
PID 2052 wrote to memory of 4076	2052	2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe	MSBuild.exe
PID 2052 wrote to memory of 4076	2052	2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe	MSBuild.exe
PID 2052 wrote to memory of 4076	2052	2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe	MSBuild.exe
PID 2052 wrote to memory of 4076	2052	2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe	MSBuild.exe
PID 2052 wrote to memory of 4076	2052	2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe	MSBuild.exe
PID 2052 wrote to memory of 4076	2052	2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe	MSBuild.exe
PID 2052 wrote to memory of 4076	2052	2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe	MSBuild.exe
PID 2052 wrote to memory of 4076	2052	2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe	MSBuild.exe

outlook_office_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe
"C:\Users\Admin\AppData\Local\Temp\2f60704e2dac47d532955485a04c195dffa41f9e638527ac42c82a224b2202ea.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 1876
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-115-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/2052-116-0x0000000005840000-0x0000000005841000-memory.dmp

Filesize
4KB

Download
memory/2052-117-0x00000000032D0000-0x00000000032D3000-memory.dmp

Filesize
12KB

Download
memory/2052-118-0x00000000032F0000-0x0000000003335000-memory.dmp

Filesize
276KB

Download
memory/2052-119-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/2052-120-0x0000000005A20000-0x0000000005A61000-memory.dmp

Filesize
260KB

Download
memory/2052-121-0x0000000006BA0000-0x0000000006BD8000-memory.dmp

Filesize
224KB

Download
memory/2052-122-0x0000000006BF0000-0x0000000006C30000-memory.dmp

Filesize
256KB

Download
memory/2052-123-0x0000000006C70000-0x0000000006C71000-memory.dmp

Filesize
4KB

Download
memory/2052-124-0x0000000006C10000-0x0000000006C11000-memory.dmp

Filesize
4KB

Download
memory/2052-125-0x0000000006E10000-0x0000000006E11000-memory.dmp

Filesize
4KB

Download
memory/4076-126-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4076-127-0x000000000043833E-mapping.dmp

Download
memory/4076-130-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download
memory/4076-131-0x00000000059D0000-0x00000000059D1000-memory.dmp

Filesize
4KB

Download
memory/4076-132-0x0000000005F70000-0x0000000005F71000-memory.dmp

Filesize
4KB

Download
memory/4076-133-0x00000000055A0000-0x00000000055A1000-memory.dmp

Filesize
4KB

Download
memory/4076-134-0x0000000006B00000-0x0000000006B01000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads