blustealer | 80877119f9ddd3a9f4740e0b04640d3fd1793787cfb9d45cc5f23ed318828b1b

General

Target

fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe
Size

915KB
MD5

fa78d1d0ef30fafdb9670abc29deb24e
SHA1

52b8bf6a36b6f4f74718c51c356112368110807f
SHA256

80877119f9ddd3a9f4740e0b04640d3fd1793787cfb9d45cc5f23ed318828b1b
SHA512

f9c96a1f2054ed926b39938594d8051ebe926044a15a3650b6fb9e9766ea50df6bcae4834381378c6959dc4489f86097863c44c5e6cdc0e28be0660e1794b1da
SSDEEP

12288:1FDc9F3nC0Py3gAhgqeJbNo6CBN0bm1acX3x81GzE0ELQ1wBDrUYSi142+y:15bN0RKWgE0mQ1wBfUFy+y

Score

10^/10

blustealer collection spyware stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
mail.sabaint.me
Port:
587
Username:
[email protected]
Password:
regina1983-

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1912	PASSWORDSNET4.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe
Key opened	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe
Key opened	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 732 set thread context of 4288	732	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	PASSWORDSNET4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	PASSWORDSNET4.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2624	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4288	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4288	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4288	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 2624	732	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	96
PID 732 wrote to memory of 2624	732	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	96
PID 732 wrote to memory of 2624	732	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	96
PID 732 wrote to memory of 4288	732	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	98
PID 732 wrote to memory of 4288	732	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	98
PID 732 wrote to memory of 4288	732	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	98
PID 732 wrote to memory of 4288	732	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	98
PID 732 wrote to memory of 4288	732	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	98
PID 732 wrote to memory of 4288	732	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	98
PID 732 wrote to memory of 4288	732	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	98
PID 732 wrote to memory of 4288	732	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	98
PID 4288 wrote to memory of 1912	4288	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	99
PID 4288 wrote to memory of 1912	4288	fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe	99

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe

C:\Users\Admin\AppData\Local\Temp\fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vaGrwRJrTr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp932.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2624
- C:\Users\Admin\AppData\Local\Temp\fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - outlook_office_path
    - outlook_win_path
    PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

2

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp932.tmp

Filesize
1KB

MD5
e0066232f98e3e3500ccf36b748e3ee1

SHA1
411d0871ca9ff846ebc63709aa0d8f7549e416ea

SHA256
a47e8e5e75f64c222ff6afa799990003160afa879bda2d219d7d53e5b2697db0

SHA512
ff4ed820d923d45d027b123111b1125951012fc3af1a616b403b5bcda4c96c1bd0e4d0b7dea7c122c3973b71511f76ada40dc260116bd4d1978551862e2b32b5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe

Filesize
156KB

MD5
0c3c728a9b4376e014bc97f7b1da74f0

SHA1
de2253d0c3e02ea9d27ae6f46082cec9d0164a02

SHA256
05f0ac30ce02bc3608d957b40896240ae750da01393f4e26a8951fc7987959ca

SHA512
f610ae81854bc99086f139833b7d16b7e7634f53ef1125dc97d01611ec46c262e1f87dde31aa47a19e17a81334c4f25b4096d8e255460e3446bf45d656f5f81c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\PTMYDVMK_Admin.zip

Filesize
24B

MD5
98a833e15d18697e8e56cdafb0642647

SHA1
e5f94d969899646a3d4635f28a7cd9dd69705887

SHA256
ff006c86b5ec033fe3cafd759bf75be00e50c375c75157e99c0c5d39c96a2a6c

SHA512
c6f9a09d9707b770dbc10d47c4d9b949f4ebf5f030b5ef8c511b635c32d418ad25d72eee5d7ed02a96aeb8bf2c85491ca1aa0e4336d242793c886ed1bcdd910b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\PTMYDVMK_Admin.zip

Filesize
523B

MD5
e5b6d26582fb08f429dba3950dfc62e3

SHA1
f848f7a70b9cdc80d43516f5bb9864de4801927d

SHA256
2f73cbe42a669257b797b6130f81a98e1c9ef08b2d2f4ceda04559cef6963bcc

SHA512
7adea9c124632a9f2d52f8478f94869c626254b3dbf0e14ed9eea389a692cb5e845d7c3fc5224dcc3fdab8278da9b70660c0609b5bedb87e20bfe12ab940dd64

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Z271LTM1YM.zip

Filesize
122KB

MD5
37ac88bc53abcc353b3a93f68fb30871

SHA1
f5165c03b5de33db3704d502227bac35eae1c6c5

SHA256
7bc03158a3c0bcb001093d9d40eaf6b9a7adf14e685db68fbd9d0f135d447ebe

SHA512
01c65cbf90c2db90d0563d4a45650d4abd19e1a90bb8467f0e5a57ff1c6c377e3be8216f3324b81af58822b75a22b52f7317df985c11f3a7a45b72843134fc38

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\credentials.txt

Filesize
1KB

MD5
16406dab57ce6758ddb801d657ab02b7

SHA1
bf308038436554e75cf53fa0b9dee89d3bbbdc26

SHA256
2af41cd06fe4d75fbeb86a49cb62eee78d2091180f4249b555e52a84ccc59801

SHA512
d53fefb6e8b5ca133e7927102373f0a5580dcb1d5ab2e811d28dcff54ab40004986f8096b3a410a072eb7d1447eb76d5779a360c373f7bac7062a0ab0b4a355f

Download Submit
memory/732-6-0x0000000004C60000-0x0000000004C6A000-memory.dmp

Filesize
40KB

Download
memory/732-5-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/732-8-0x00000000050C0000-0x00000000050D8000-memory.dmp

Filesize
96KB

Download
memory/732-9-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/732-10-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/732-11-0x0000000007AF0000-0x0000000007B94000-memory.dmp

Filesize
656KB

Download
memory/732-12-0x000000000A250000-0x000000000A288000-memory.dmp

Filesize
224KB

Download
memory/732-1-0x0000000000110000-0x00000000001FA000-memory.dmp

Filesize
936KB

Download
memory/732-0-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/732-22-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/732-2-0x0000000004B60000-0x0000000004BFC000-memory.dmp

Filesize
624KB

Download
memory/732-7-0x0000000004E90000-0x0000000004EE6000-memory.dmp

Filesize
344KB

Download
memory/732-4-0x0000000004CA0000-0x0000000004D32000-memory.dmp

Filesize
584KB

Download
memory/732-3-0x00000000051B0000-0x0000000005754000-memory.dmp

Filesize
5.6MB

Download
memory/1912-97-0x00007FFCED9A0000-0x00007FFCEE461000-memory.dmp

Filesize
10.8MB

Download
memory/1912-99-0x000000001BDB0000-0x000000001BDC0000-memory.dmp

Filesize
64KB

Download
memory/1912-107-0x00007FFCED9A0000-0x00007FFCEE461000-memory.dmp

Filesize
10.8MB

Download
memory/1912-96-0x0000000000C90000-0x0000000000CBE000-memory.dmp

Filesize
184KB

Download
memory/4288-108-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4288-21-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4288-18-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads