blustealer | 80877119f9ddd3a9f4740e0b04640d3fd1793787cfb9d45cc5f23ed318828b1b

General

Target

fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe
Size

915KB
MD5

fa78d1d0ef30fafdb9670abc29deb24e
SHA1

52b8bf6a36b6f4f74718c51c356112368110807f
SHA256

80877119f9ddd3a9f4740e0b04640d3fd1793787cfb9d45cc5f23ed318828b1b
SHA512

f9c96a1f2054ed926b39938594d8051ebe926044a15a3650b6fb9e9766ea50df6bcae4834381378c6959dc4489f86097863c44c5e6cdc0e28be0660e1794b1da
SSDEEP

12288:1FDc9F3nC0Py3gAhgqeJbNo6CBN0bm1acX3x81GzE0ELQ1wBDrUYSi142+y:15bN0RKWgE0mQ1wBfUFy+y

Score

10^/10

blustealer collection spyware stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
mail.sabaint.me
Port:
587
Username:
[email protected]
Password:
regina1983-

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Executes dropped EXE 1 IoCs

pid	Process
2364	PASSWORDSNET4.exe

Loads dropped DLL 1 IoCs

pid	Process
1676	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 868 set thread context of 1676	868	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	PASSWORDSNET4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	PASSWORDSNET4.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2492	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1676	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1676	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1676	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 2492	868	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	28
PID 868 wrote to memory of 2492	868	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	28
PID 868 wrote to memory of 2492	868	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	28
PID 868 wrote to memory of 2492	868	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	28
PID 868 wrote to memory of 1676	868	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	30
PID 868 wrote to memory of 1676	868	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	30
PID 868 wrote to memory of 1676	868	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	30
PID 868 wrote to memory of 1676	868	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	30
PID 868 wrote to memory of 1676	868	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	30
PID 868 wrote to memory of 1676	868	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	30
PID 868 wrote to memory of 1676	868	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	30
PID 868 wrote to memory of 1676	868	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	30
PID 868 wrote to memory of 1676	868	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	30
PID 1676 wrote to memory of 2364	1676	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	31
PID 1676 wrote to memory of 2364	1676	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	31
PID 1676 wrote to memory of 2364	1676	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	31
PID 1676 wrote to memory of 2364	1676	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	31

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe

C:\Users\Admin\AppData\Local\Temp\fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vaGrwRJrTr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB55B.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2492
- C:\Users\Admin\AppData\Local\Temp\fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - outlook_office_path
    - outlook_win_path
    PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

2

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB55B.tmp

Filesize
1KB

MD5
0e1bc9866ec03a2540cf82226002c9d8

SHA1
de6df13700dde89265820a817bd9dbb7fc477b20

SHA256
7b6de2c149b6dd08c1c720c6323291ffd82dafd9352828be9d01a95112124af7

SHA512
d5a5371bcccaefaf2d2f3ad3ed10a9d65b8dd04cc2f20afb0b7917e494b1a5fcbf1658118c1d6029830bfaa6ddc590275e9d01b0a282626669235f03ade10226

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\PU8WYU~1.ZIP

Filesize
122KB

MD5
37ac88bc53abcc353b3a93f68fb30871

SHA1
f5165c03b5de33db3704d502227bac35eae1c6c5

SHA256
7bc03158a3c0bcb001093d9d40eaf6b9a7adf14e685db68fbd9d0f135d447ebe

SHA512
01c65cbf90c2db90d0563d4a45650d4abd19e1a90bb8467f0e5a57ff1c6c377e3be8216f3324b81af58822b75a22b52f7317df985c11f3a7a45b72843134fc38

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\QGTQZTRE_Admin.zip

Filesize
24B

MD5
98a833e15d18697e8e56cdafb0642647

SHA1
e5f94d969899646a3d4635f28a7cd9dd69705887

SHA256
ff006c86b5ec033fe3cafd759bf75be00e50c375c75157e99c0c5d39c96a2a6c

SHA512
c6f9a09d9707b770dbc10d47c4d9b949f4ebf5f030b5ef8c511b635c32d418ad25d72eee5d7ed02a96aeb8bf2c85491ca1aa0e4336d242793c886ed1bcdd910b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\QGTQZTRE_Admin.zip

Filesize
400B

MD5
bd2352b6b8cc2f8dc8a9fb6e834d7ce1

SHA1
e222352b64dfa6d54e9ffe7eb50fe396f070662f

SHA256
f33a74aac191d353ce4f940cf40bb1308715be79de92567b7276aa4528a9ed69

SHA512
5ec1a9de1aeae287847e639dd6e6c61aa0a42d948e5e3656d00436e99d15bb2c3d0fdbf7d3983f957f0501851818b61eed985ba48ef5607d28f2391b3c2a3fcd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\credentials.txt

Filesize
311B

MD5
24caaaffb71817406cafd61c15bf78fa

SHA1
adaa9e048afb85cd19b34ce8b30cc9d56111df4a

SHA256
e89da4dbaa58a8a1dfc0a66f031f49ab7e39753c23342204a88db12ccc15b617

SHA512
e29399b0fe291462a206506c3c2e2f6be33a0ef9bd3a1c6145633d680e96403f2e3c4908694d61f874c04fdf85e528386fb43e0d2d67b144195caf1b201e9d0b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe

Filesize
156KB

MD5
0c3c728a9b4376e014bc97f7b1da74f0

SHA1
de2253d0c3e02ea9d27ae6f46082cec9d0164a02

SHA256
05f0ac30ce02bc3608d957b40896240ae750da01393f4e26a8951fc7987959ca

SHA512
f610ae81854bc99086f139833b7d16b7e7634f53ef1125dc97d01611ec46c262e1f87dde31aa47a19e17a81334c4f25b4096d8e255460e3446bf45d656f5f81c

Download Submit
memory/868-3-0x00000000004B0000-0x00000000004C8000-memory.dmp

Filesize
96KB

Download
memory/868-7-0x0000000001F40000-0x0000000001F78000-memory.dmp

Filesize
224KB

Download
memory/868-6-0x0000000007E70000-0x0000000007F14000-memory.dmp

Filesize
656KB

Download
memory/868-5-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Filesize
256KB

Download
memory/868-4-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/868-2-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Filesize
256KB

Download
memory/868-0-0x00000000008C0000-0x00000000009AA000-memory.dmp

Filesize
936KB

Download
memory/868-1-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/868-24-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/1676-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1676-23-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1676-21-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1676-16-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1676-15-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1676-13-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1676-113-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/1676-131-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/2364-99-0x0000000001080000-0x00000000010AE000-memory.dmp

Filesize
184KB

Download
memory/2364-100-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp

Filesize
9.9MB

Download
memory/2364-101-0x000000001BEE0000-0x000000001BF60000-memory.dmp

Filesize
512KB

Download
memory/2364-106-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads