blustealer | 01dccd80e7c6948853bacb394d25995d5886f84c05bfbb506b4c5862d8221901

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe
Size

715KB
MD5

f6ca0052f508770f499eaddb5dfdefa5
SHA1

83b1cdaa08b1e5c32b5baed55c22608ce9d01944
SHA256

01dccd80e7c6948853bacb394d25995d5886f84c05bfbb506b4c5862d8221901
SHA512

cc6c3739d611d66a7b3aeb248212c97cad3341e989d0855dd2d960464b656eb2cb4facaff0bda95632d415e40d06f94af2e13c6105caa1263a9bfb4f21dde2d1
SSDEEP

12288:8AIfVYIdFMXgcisxVmXldFPaNGhC5VMgSxLH49TWwp8u911p0ziyMtSUPaTfrgKy:2V5zMbiMVAlbPaNG2egFTW+8AsiAUPa6

Score

10^/10

blustealer zgrat persistence rat stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
restd.club
Port:
587
Username:
[email protected]
Password:
mQJrXsvkEb#S

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/1800-4-0x00000000046A0000-0x000000000470E000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-44-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-52-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-62-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-60-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-58-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-56-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-54-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-64-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-68-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-66-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-50-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-48-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-46-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-42-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-40-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-38-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-36-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-34-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-32-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-30-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-28-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-26-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-24-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-22-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-20-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-18-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-16-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-14-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-12-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-10-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-8-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-6-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1
behavioral1/memory/1800-5-0x00000000046A0000-0x0000000004708000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\paint = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\paint\\paint.exe\""	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1800 set thread context of 1524	1800	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1800	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1524	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1524	1800	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	30
PID 1800 wrote to memory of 1524	1800	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	30
PID 1800 wrote to memory of 1524	1800	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	30
PID 1800 wrote to memory of 1524	1800	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	30
PID 1800 wrote to memory of 1524	1800	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	30
PID 1800 wrote to memory of 1524	1800	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	30
PID 1800 wrote to memory of 1524	1800	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	30
PID 1800 wrote to memory of 1524	1800	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	30
PID 1800 wrote to memory of 1524	1800	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-2130-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1524-2131-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1800-38-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-58-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-4-0x00000000046A0000-0x000000000470E000-memory.dmp

Filesize
440KB

Download
memory/1800-34-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-52-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-30-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-60-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-32-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-56-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-54-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-64-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-68-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-66-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-50-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-48-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-46-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-42-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-40-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-0-0x0000000000C20000-0x0000000000CD6000-memory.dmp

Filesize
728KB

Download
memory/1800-36-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-44-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-3-0x0000000004DB0000-0x0000000004E56000-memory.dmp

Filesize
664KB

Download
memory/1800-62-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-28-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-26-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-24-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-22-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-20-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-18-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-16-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-14-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-12-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-10-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-8-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-6-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-5-0x00000000046A0000-0x0000000004708000-memory.dmp

Filesize
416KB

Download
memory/1800-880-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/1800-2114-0x0000000004740000-0x0000000004780000-memory.dmp

Filesize
256KB

Download
memory/1800-2-0x0000000004740000-0x0000000004780000-memory.dmp

Filesize
256KB

Download
memory/1800-1-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/1800-2127-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download