Analysis
- max time kernel
140s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
21/10/2024, 07:33
General
- Target 65fdd9a6908f3fad268bda8f8eb02a81_JaffaCakes118.exe
- Size 1.5MB
- Sample241021-jdkd4aveke
- SHA256 a04d1b6d23818af17d324ec5ff6e3de019b9dfc66880ab04b7c47ca9629ad336
Malware Config
Extracted
-
blustealer
-
Protocol
smtp
-
Host
mail.yekamuhendislik.com
-
Port
587
-
Username
-
Password
MuhasebE123*
Signatures
- A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
- BluStealer
A Modular information stealer written in Visual Basic.
- A310logger Executable 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\65fdd9a6908f3fad268bda8f8eb02a81_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65fdd9a6908f3fad268bda8f8eb02a81_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rnVsEWY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp65BA.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\65fdd9a6908f3fad268bda8f8eb02a81_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65fdd9a6908f3fad268bda8f8eb02a81_JaffaCakes118.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\65fdd9a6908f3fad268bda8f8eb02a81_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65fdd9a6908f3fad268bda8f8eb02a81_JaffaCakes118.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\65fdd9a6908f3fad268bda8f8eb02a81_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65fdd9a6908f3fad268bda8f8eb02a81_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
tmp65BA.tmp
8D6HYI5LTN.zip
Fox.exe
credentials.txt
memory/4080-55-0x0000000000BB0000-0x0000000000C62000-memory.dmp
memory/4080-54-0x00007FFC51DE3000-0x00007FFC51DE5000-memory.dmp
memory/4528-10-0x00000000750A0000-0x0000000075850000-memory.dmp
memory/4528-3-0x0000000005420000-0x00000000059C4000-memory.dmp
memory/4528-8-0x0000000004EA0000-0x0000000004EBE000-memory.dmp
memory/4528-9-0x00000000750AE000-0x00000000750AF000-memory.dmp
memory/4528-0-0x00000000750AE000-0x00000000750AF000-memory.dmp
memory/4528-11-0x0000000005E60000-0x0000000005F2C000-memory.dmp
memory/4528-12-0x0000000005BA0000-0x0000000005BFC000-memory.dmp
memory/4528-6-0x00000000050A0000-0x00000000050F6000-memory.dmp
memory/4528-1-0x0000000000270000-0x0000000000404000-memory.dmp
memory/4528-2-0x0000000004D90000-0x0000000004E2C000-memory.dmp
memory/4528-24-0x00000000750A0000-0x0000000075850000-memory.dmp
memory/4528-5-0x0000000004E50000-0x0000000004E5A000-memory.dmp
memory/4528-4-0x0000000004F10000-0x0000000004FA2000-memory.dmp
memory/4528-7-0x00000000750A0000-0x0000000075850000-memory.dmp
memory/5076-20-0x0000000000400000-0x0000000000456000-memory.dmp
memory/5076-18-0x0000000000400000-0x0000000000456000-memory.dmp
memory/5076-65-0x0000000000400000-0x0000000000456000-memory.dmp