02e3982683b8110a00bab25e7fcea0ee921e8de6eba79c11ddaaff6fcb0c0834

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2024, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b665e70ae44147cd85b19f12c2cd8ac_JaffaCakes118.exe
Size 128KB
Sample241019-hthprsvfql
SHA256 02e3982683b8110a00bab25e7fcea0ee921e8de6eba79c11ddaaff6fcb0c0834
MD5 5b665e70ae44147cd85b19f12c2cd8ac
SHA1 eaf45104deaec160571a4893a960676cabf0637d
SHA512 0f884a2109c00b79c90053cbf640b6be85b14b34e6409239cc98f0853a52a838efdca3671a6240bc1c31f39b2a24127a32f419eb38da025d0bac207e9e288fb1
SSDEEP 3072:USKaIJeRRzP1p32s6AxYFEl5AmYIs5/UMEduACW:jKGzP2sX+FElSAjkAn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

credential_access discovery persistence spyware stealer upx

Malware Config

Extracted

Credentials

Protocol
ftp
Host
ftp.drivehq.com
Port
21
Username
mohalammari1

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	5b665e70ae44147cd85b19f12c2cd8ac_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	ISTEAL~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	istealer.exe

Executes dropped EXE 7 IoCs

pid	Process
2720	istealer v5.0.2.EXE
4532	ISTEAL~1.EXE
2676	sample.exe
4872	sample.exe
4792	HID.exe
1788	HID.exe
3564	istealer.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	istealer v5.0.2.EXE

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2676 set thread context of 4872	2676	sample.exe	99
PID 4792 set thread context of 1788	4792	HID.exe	105

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1440-0-0x0000000000400000-0x0000000000434000-memory.dmp	upx
behavioral2/memory/1440-19-0x0000000000400000-0x0000000000434000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	1440	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b665e70ae44147cd85b19f12c2cd8ac_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	istealer v5.0.2.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ISTEAL~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sample.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HID.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	istealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1728	timeout.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2720	1440	5b665e70ae44147cd85b19f12c2cd8ac_JaffaCakes118.exe	84
PID 1440 wrote to memory of 2720	1440	5b665e70ae44147cd85b19f12c2cd8ac_JaffaCakes118.exe	84
PID 1440 wrote to memory of 2720	1440	5b665e70ae44147cd85b19f12c2cd8ac_JaffaCakes118.exe	84
PID 2720 wrote to memory of 4532	2720	istealer v5.0.2.EXE	86
PID 2720 wrote to memory of 4532	2720	istealer v5.0.2.EXE	86
PID 2720 wrote to memory of 4532	2720	istealer v5.0.2.EXE	86
PID 4532 wrote to memory of 2676	4532	ISTEAL~1.EXE	97
PID 4532 wrote to memory of 2676	4532	ISTEAL~1.EXE	97
PID 4532 wrote to memory of 2676	4532	ISTEAL~1.EXE	97
PID 2676 wrote to memory of 4872	2676	sample.exe	99
PID 2676 wrote to memory of 4872	2676	sample.exe	99
PID 2676 wrote to memory of 4872	2676	sample.exe	99
PID 2676 wrote to memory of 4872	2676	sample.exe	99
PID 2676 wrote to memory of 4872	2676	sample.exe	99
PID 4532 wrote to memory of 4792	4532	ISTEAL~1.EXE	104
PID 4532 wrote to memory of 4792	4532	ISTEAL~1.EXE	104
PID 4532 wrote to memory of 4792	4532	ISTEAL~1.EXE	104
PID 4792 wrote to memory of 1788	4792	HID.exe	105
PID 4792 wrote to memory of 1788	4792	HID.exe	105
PID 4792 wrote to memory of 1788	4792	HID.exe	105
PID 4792 wrote to memory of 1788	4792	HID.exe	105
PID 4792 wrote to memory of 1788	4792	HID.exe	105
PID 2720 wrote to memory of 3564	2720	istealer v5.0.2.EXE	106
PID 2720 wrote to memory of 3564	2720	istealer v5.0.2.EXE	106
PID 2720 wrote to memory of 3564	2720	istealer v5.0.2.EXE	106
PID 3564 wrote to memory of 2404	3564	istealer.exe	108
PID 3564 wrote to memory of 2404	3564	istealer.exe	108
PID 3564 wrote to memory of 2404	3564	istealer.exe	108
PID 2404 wrote to memory of 1728	2404	cmd.exe	110
PID 2404 wrote to memory of 1728	2404	cmd.exe	110
PID 2404 wrote to memory of 1728	2404	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\5b665e70ae44147cd85b19f12c2cd8ac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b665e70ae44147cd85b19f12c2cd8ac_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Local\Temp\istealer v5.0.2.EXE
  "C:\Users\Admin\AppData\Local\Temp\istealer v5.0.2.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ISTEAL~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ISTEAL~1.EXE
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\sample.exe
      "C:\Users\Admin\AppData\Local\Temp\sample.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\sample.exe
        
        C:\Users\Admin\AppData\Local\Temp\sample.exe
        5⤵
        Executes dropped EXE
        
        PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\HID.exe
      "C:\Users\Admin\AppData\Local\Temp\HID.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\HID.exe
        
        C:\Users\Admin\AppData\Local\Temp\HID.exe
        5⤵
        Executes dropped EXE
        
        PID:1788
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\istealer.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\istealer.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 5 && del C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\istealer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2404
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 1208
  2⤵
  - Program crash
  PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1440 -ip 1440
1⤵
PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HID.exe

Path C:\Users\Admin\AppData\Local\Temp\HID.exe
Size 47KB
SHA256 084d2cd4a6e00936f0af7bdae4ad44a9bcba99dfe9a3f5fefe4ffaae7c0679b7
MD5 17b43f19c17c51a8e17d8ce68ab62f36
SHA1 65fa49a44620e1dad36dfe0ca11e1c67ac9f6b00
SHA512 2786fff147abbb3f65b53967b2a59638d03f7015d89fd5a6fecf806a9259e34fd1a2fa023cae3a797eff14469de71dcd90e478d819b5c9fbfe999cdbcbc67b66
SSDEEP 768:cUJnDTjBH0jcXIAkE4mV1t70PrJPK9ANFn+Kt5ViZmhmE9TqPfeIz+gn8g/Hzfdt:cC64GEX1tgz0eP+KYZntek+g84XBzN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISTEAL~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ISTEAL~1.EXE
Size 124KB
SHA256 fb77e3809376f2b26895b700afaa34d6af5c04801479d2d20d2c00d1dd236b2a
MD5 79d1d9d36a0fbc70b086c0087a09dccc
SHA1 8bf30e228e8c65ea3b33496c444c5f3ea828edf3
SHA512 d7ad4b82c7c794434b56615227beae10fdd076a4cface7c79d2b7e2c82eda3ead08a0ab52b439d6c8eae8c723dabd9fc48b5b23e94cf0d83ab23a9dd5de6da5a
SSDEEP 3072:RRGEFqzG0q/vLOrN6GEFqz0zvu74XnA6GEFqzeCeq:zG6qzG0q/viN6G6qzUuSA6G6qzj
MD5 SHA1 SHA512 SSDEEP

Submit Download

istealer.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\istealer.exe
Size 18KB
SHA256 f6189b3c13965696e60e924c7a60481bd4cc42134d9bb11739e08e8a46fa76b3
MD5 a86fa2561ecd995a18e4056e6977c283
SHA1 72c0f26830f6c3b5463e5ebeb6af854575b0ed7b
SHA512 e9d2cdedab6e54d62b7d5c5ce0326d83fb727ae7d423ca77191f74ffa8e9b9484a70f9fa2b17b0fadc998a5d3b21e7996ca3b5f419985179712d3f434dd9fd23
SSDEEP 384:jDcEz386Mxx1EYJKW9eupHCyTuyltk+4XXI+yWOD5B119izMeNFOJ5:HcEj862pdUupHCquylm7XI8Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

istealer v5.0.2.EXE

Path C:\Users\Admin\AppData\Local\Temp\istealer v5.0.2.EXE
Size 153KB
SHA256 7f5edcffe65c83a36dd18a06454aa00e8691a7a5f41db25b1fc0bd0c9d8490f5
MD5 a9b100efa644d51dccbbfba0d6a533b0
SHA1 99eab8bdc69ae73c33ae9f57fda503b5041f85d4
SHA512 398e3879e9d6a14437a66f638fd6d5b6c0ffdd0caebcfe84a15983df920c236ea6b050e52c28e7f9907dfa3ae2baf995bbe152c73652336b60dd31d49aea81f3
SSDEEP 3072:1Gu9BlfzWIbXWm+w0JF5L0q/vLh65NW1bnE1KfDrcTxkytlpKtolN/P:1/0uoP0q/vc5410KfDrmool
MD5 SHA1 SHA512 SSDEEP

Submit Download

sample.exe

Path C:\Users\Admin\AppData\Local\Temp\sample.exe
Size 31KB
SHA256 5b73f25eefabfc9d1fc11d6057da60c3f64dc174e867d8f149a76c277fdfd210
MD5 4be6a6cbb9baef50c06d07d7467544a7
SHA1 efa17578fba9f4a0a7eff9dae6e1a1835198d928
SHA512 68162379df96040dcfc6d2fa47a425d84459dc2f0439f0b8df3ba2609da6a9d8de34c6cb609739bd5b07d9fabc3566112ea5416a6207e65332cfa6cc9149e47d
SSDEEP 768:cUJnDTjBH0jcXIAkE4mV1t70Pr7PK9ANFE9K/32Sn:cC64GEX1tgzeeMI/3B
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1440-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1440-19-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1788-47-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4872-33-0x0000000000400000-0x0000000000403000-memory.dmp

Download

memory/4872-34-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4872-35-0x0000000000400000-0x0000000000403000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads