blustealer | 01dccd80e7c6948853bacb394d25995d5886f84c05bfbb506b4c5862d8221901

Analysis

max time kernel
92s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe
Size

715KB
MD5

f6ca0052f508770f499eaddb5dfdefa5
SHA1

83b1cdaa08b1e5c32b5baed55c22608ce9d01944
SHA256

01dccd80e7c6948853bacb394d25995d5886f84c05bfbb506b4c5862d8221901
SHA512

cc6c3739d611d66a7b3aeb248212c97cad3341e989d0855dd2d960464b656eb2cb4facaff0bda95632d415e40d06f94af2e13c6105caa1263a9bfb4f21dde2d1
SSDEEP

12288:8AIfVYIdFMXgcisxVmXldFPaNGhC5VMgSxLH49TWwp8u911p0ziyMtSUPaTfrgKy:2V5zMbiMVAlbPaNG2egFTW+8AsiAUPa6

Score

10^/10

blustealer zgrat persistence rat stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
restd.club
Port:
587
Username:
[email protected]
Password:
mQJrXsvkEb#S

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/4476-9-0x0000000006CE0000-0x0000000006D4E000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-27-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-33-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-49-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-59-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-57-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-55-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-61-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-63-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-65-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-67-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-69-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-53-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-73-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-71-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-51-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-47-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-45-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-43-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-41-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-39-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-37-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-35-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-31-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-29-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-25-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-23-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-21-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-19-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-17-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-15-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-13-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-11-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1
behavioral2/memory/4476-10-0x0000000006CE0000-0x0000000006D48000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paint = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\paint\\paint.exe\""	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4476 set thread context of 1588	4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	93

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe
4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe
4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe
4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe
4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe
4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1588	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 1960	4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	92
PID 4476 wrote to memory of 1960	4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	92
PID 4476 wrote to memory of 1960	4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	92
PID 4476 wrote to memory of 1588	4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	93
PID 4476 wrote to memory of 1588	4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	93
PID 4476 wrote to memory of 1588	4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	93
PID 4476 wrote to memory of 1588	4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	93
PID 4476 wrote to memory of 1588	4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	93
PID 4476 wrote to memory of 1588	4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	93
PID 4476 wrote to memory of 1588	4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	93
PID 4476 wrote to memory of 1588	4476	f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Users\Admin\AppData\Local\Temp\f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe
  2⤵
  PID:1960
- C:\Users\Admin\AppData\Local\Temp\f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f6ca0052f508770f499eaddb5dfdefa5_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1588-2127-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1588-2129-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/4476-51-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-2-0x0000000005E40000-0x00000000063E4000-memory.dmp

Filesize
5.6MB

Download
memory/4476-4-0x0000000005800000-0x0000000005810000-memory.dmp

Filesize
64KB

Download
memory/4476-5-0x00000000057D0000-0x00000000057DA000-memory.dmp

Filesize
40KB

Download
memory/4476-6-0x0000000006AF0000-0x0000000006B66000-memory.dmp

Filesize
472KB

Download
memory/4476-7-0x0000000005C20000-0x0000000005CC6000-memory.dmp

Filesize
664KB

Download
memory/4476-8-0x0000000005DD0000-0x0000000005DEE000-memory.dmp

Filesize
120KB

Download
memory/4476-9-0x0000000006CE0000-0x0000000006D4E000-memory.dmp

Filesize
440KB

Download
memory/4476-27-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-33-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-49-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-59-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-57-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-55-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-61-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-63-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-0-0x0000000000D70000-0x0000000000E26000-memory.dmp

Filesize
728KB

Download
memory/4476-67-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-69-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-53-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-73-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-71-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-45-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-3-0x0000000005890000-0x0000000005922000-memory.dmp

Filesize
584KB

Download
memory/4476-65-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-43-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-204-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/4476-41-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-39-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-37-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-35-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-31-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-29-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-25-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-23-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-21-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-19-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-17-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-15-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-13-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-11-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-10-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-1783-0x0000000005800000-0x0000000005810000-memory.dmp

Filesize
64KB

Download
memory/4476-2126-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/4476-47-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/4476-1-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download