Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
18/07/2024, 16:52
General
- Target 5842335503404a570eb9263542504d63_JaffaCakes118.jar
- Size 905KB
- Sample240718-vdnbjaxfmn
- SHA256 6cadc1a284604c4ec3ba8655e5b933bc7df036e6eb84685d7a6ca0e40c17d575
Malware Config
Extracted
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
ihemeg1986
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main payload 32 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 2 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\5842335503404a570eb9263542504d63_JaffaCakes118.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\p16hIwD.exeC:\Users\Admin\p16hIwD.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Users\Admin\p16hIwD.exe3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
5yfe66gfii9aud.dll
System.dll
p16hIwD.exe
memory/1436-44-0x0000000010000000-0x0000000010008000-memory.dmp
memory/1436-46-0x0000000010000000-0x0000000010008000-memory.dmp
memory/1888-2-0x000001FDB9AA0000-0x000001FDB9D10000-memory.dmp
memory/1888-14-0x000001FDB9D20000-0x000001FDB9D30000-memory.dmp
memory/1888-13-0x000001FDB9D10000-0x000001FDB9D20000-memory.dmp
memory/1888-16-0x000001FDB9D30000-0x000001FDB9D40000-memory.dmp
memory/1888-18-0x000001FDB9D40000-0x000001FDB9D50000-memory.dmp
memory/1888-20-0x000001FDB9D50000-0x000001FDB9D60000-memory.dmp
memory/1888-23-0x000001FDB9D60000-0x000001FDB9D70000-memory.dmp
memory/1888-28-0x000001FDB9D70000-0x000001FDB9D80000-memory.dmp
memory/1888-29-0x000001FDB9A80000-0x000001FDB9A81000-memory.dmp
memory/1888-275-0x000001FDB9AA0000-0x000001FDB9D10000-memory.dmp
memory/1888-276-0x000001FDB9D10000-0x000001FDB9D20000-memory.dmp
memory/1888-277-0x000001FDB9D20000-0x000001FDB9D30000-memory.dmp
memory/1888-278-0x000001FDB9D30000-0x000001FDB9D40000-memory.dmp
memory/1888-279-0x000001FDB9D40000-0x000001FDB9D50000-memory.dmp
memory/1888-280-0x000001FDB9D50000-0x000001FDB9D60000-memory.dmp
memory/1888-281-0x000001FDB9D60000-0x000001FDB9D70000-memory.dmp
memory/1888-282-0x000001FDB9D70000-0x000001FDB9D80000-memory.dmp
memory/2748-67-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-47-0x000000007534E000-0x000000007534F000-memory.dmp
memory/2748-71-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-69-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-65-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-63-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-61-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-59-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-57-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-51-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-75-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-55-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-109-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-105-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-103-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-77-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-79-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-93-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-107-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-53-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-49-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-73-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-45-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-101-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-99-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-97-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-95-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-91-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-89-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-87-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-85-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-83-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-81-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2748-568-0x0000000075340000-0x0000000075AF0000-memory.dmp
memory/2748-569-0x0000000005AF0000-0x0000000006094000-memory.dmp
memory/2748-570-0x0000000005470000-0x000000000550C000-memory.dmp
memory/2748-571-0x0000000005540000-0x0000000005584000-memory.dmp
memory/2748-572-0x0000000005730000-0x0000000005796000-memory.dmp
memory/2748-573-0x0000000005840000-0x00000000058D2000-memory.dmp
memory/2748-581-0x0000000006A50000-0x0000000006A5A000-memory.dmp
memory/2748-582-0x000000007534E000-0x000000007534F000-memory.dmp
memory/2748-583-0x0000000075340000-0x0000000075AF0000-memory.dmp
memory/2748-586-0x0000000001310000-0x0000000001360000-memory.dmp
memory/2748-592-0x0000000000F00000-0x0000000000F14000-memory.dmp