Analysis
- max time kernel
147s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
28/03/2024, 16:17
General
- Target 0a424c71b75fecfb42fb0e2b17f1c6bc_JaffaCakes118.exe
- Size 1.3MB
- Sample240328-trwpdsae51
- SHA256 a7cce7b44e791b44a67edeec0489858b4ba9d1a82464d4148a6f691a4e86e93c
Malware Config
Extracted
-
blustealer
-
Protocol
smtp
-
Host
mail.dm-teh.com
-
Port
587
-
Username
-
Password
Vm@(O;CO.vEQ
Signatures
- BluStealer
A Modular information stealer written in Visual Basic.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a424c71b75fecfb42fb0e2b17f1c6bc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0a424c71b75fecfb42fb0e2b17f1c6bc_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\\AddInProcess32.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
AddInProcess32.exe
memory/2232-13-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2232-21-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2232-18-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4068-4-0x0000000004C20000-0x0000000004CBC000-memory.dmp
memory/4068-5-0x0000000004EA0000-0x0000000004EB0000-memory.dmp
memory/4068-6-0x00000000024C0000-0x00000000024EC000-memory.dmp
memory/4068-7-0x0000000004E80000-0x0000000004E8A000-memory.dmp
memory/4068-8-0x0000000074430000-0x0000000074BE0000-memory.dmp
memory/4068-9-0x0000000004EA0000-0x0000000004EB0000-memory.dmp
memory/4068-11-0x0000000005F70000-0x0000000005F82000-memory.dmp
memory/4068-1-0x0000000074430000-0x0000000074BE0000-memory.dmp
memory/4068-3-0x0000000004AB0000-0x0000000004B42000-memory.dmp
memory/4068-17-0x0000000074430000-0x0000000074BE0000-memory.dmp
memory/4068-2-0x0000000005130000-0x00000000056D4000-memory.dmp
memory/4068-0-0x00000000000F0000-0x000000000024A000-memory.dmp