Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-04-2024 09:28
Static task
static1
Behavioral task
behavioral1
Sample
e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe
Resource
win10v2004-20231215-en
General
-
Target
e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe
-
Size
720KB
-
MD5
e9ae8d2f81cc2981ae784f3648040a92
-
SHA1
d9a19d08b817a88feaf08e00eee8a0479663a960
-
SHA256
1d03149eb8839cefbe072e5fed04a5a775f856b53ffa1373f235a6a5ddceb553
-
SHA512
f3ec9ededf32237cc22f5e303e00ee422b8e0d16c2ba789224808d069364ea9cbaf51d969e32e2b87086a1566c1528ef3f3d7cbfa494cbdd1d08ecac412fa1eb
-
SSDEEP
12288:uQWRct2NjFmzP1Wy4ASG3smyH0/X6BDWaozKnaoEe0N:u7RcMNjgWy4ASG3K4KtvcRoE
Malware Config
Extracted
blustealer
https://api.telegram.org/bot1802269231:AAELtF2SraPZQTuiNsCQFsNfPKlpc9jYjSk/sendMessage?chat_id=1817981127
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\rRajA = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe" e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exedescription pid process target process PID 1052 set thread context of 2568 1052 e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exepid process 2568 e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exedescription pid process target process PID 1052 wrote to memory of 2568 1052 e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe PID 1052 wrote to memory of 2568 1052 e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe PID 1052 wrote to memory of 2568 1052 e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe PID 1052 wrote to memory of 2568 1052 e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe PID 1052 wrote to memory of 2568 1052 e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe PID 1052 wrote to memory of 2568 1052 e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe PID 1052 wrote to memory of 2568 1052 e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe PID 1052 wrote to memory of 2568 1052 e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe PID 1052 wrote to memory of 2568 1052 e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9ae8d2f81cc2981ae784f3648040a92_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1052-18-0x0000000074230000-0x000000007491E000-memory.dmpFilesize
6.9MB
-
memory/1052-2-0x0000000004CE0000-0x0000000004D20000-memory.dmpFilesize
256KB
-
memory/1052-1-0x0000000074230000-0x000000007491E000-memory.dmpFilesize
6.9MB
-
memory/1052-0-0x00000000001A0000-0x000000000025A000-memory.dmpFilesize
744KB
-
memory/1052-4-0x0000000074230000-0x000000007491E000-memory.dmpFilesize
6.9MB
-
memory/1052-5-0x0000000004CE0000-0x0000000004D20000-memory.dmpFilesize
256KB
-
memory/1052-6-0x00000000056A0000-0x0000000005726000-memory.dmpFilesize
536KB
-
memory/1052-7-0x0000000000770000-0x0000000000788000-memory.dmpFilesize
96KB
-
memory/1052-3-0x0000000000290000-0x00000000002AA000-memory.dmpFilesize
104KB
-
memory/2568-8-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2568-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2568-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2568-14-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2568-16-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2568-9-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2568-20-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB