Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 21:07
Static task
static1
Behavioral task
behavioral1
Sample
fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
fda687e3f7ee2e46c4094d557f137ff8
-
SHA1
f1e13dd8b5f869045bdc15de6303e5cfcc7c4cff
-
SHA256
674a7b749bea309b2f9157e187a92fc0da9ce79b3a9ee4f3c85e6b58dd961789
-
SHA512
d47b72db111b19669d8bf5575fedc11bb01ff220b0929b09dd061efd612f55093d708fe5007f0e60732defd5de6868e898fba55270b0fa449f5ab766097109e0
-
SSDEEP
24576:/WN565751UbTCg1XJ2qg4rSs3S1KqFHTwfs89UrmMnfk/iQ2+S0d:/q65rUbTCg1wFsqBZMfsaU9fk/Pj
Malware Config
Extracted
blustealer
Protocol: smtp- Host:
mail.starkgulf.com - Port:
587 - Username:
info@starkgulf.com - Password:
info123#
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exedescription pid process target process PID 1220 set thread context of 2440 1220 fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exepid process 2440 fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exedescription pid process target process PID 1220 wrote to memory of 2440 1220 fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe PID 1220 wrote to memory of 2440 1220 fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe PID 1220 wrote to memory of 2440 1220 fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe PID 1220 wrote to memory of 2440 1220 fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe PID 1220 wrote to memory of 2440 1220 fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe PID 1220 wrote to memory of 2440 1220 fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe PID 1220 wrote to memory of 2440 1220 fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe PID 1220 wrote to memory of 2440 1220 fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe PID 1220 wrote to memory of 2440 1220 fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fda687e3f7ee2e46c4094d557f137ff8_JaffaCakes118.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1220-17-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/1220-1-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/1220-2-0x0000000002280000-0x00000000022C0000-memory.dmpFilesize
256KB
-
memory/1220-3-0x0000000000240000-0x0000000000258000-memory.dmpFilesize
96KB
-
memory/1220-4-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/1220-5-0x0000000002280000-0x00000000022C0000-memory.dmpFilesize
256KB
-
memory/1220-6-0x000000000B650000-0x000000000B72E000-memory.dmpFilesize
888KB
-
memory/1220-7-0x0000000000830000-0x00000000008A2000-memory.dmpFilesize
456KB
-
memory/1220-0-0x00000000008A0000-0x0000000000A30000-memory.dmpFilesize
1.6MB
-
memory/2440-8-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/2440-10-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/2440-9-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/2440-14-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/2440-16-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/2440-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2440-20-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB