Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-12-2024 22:35

General

  • Target

    dec7bbc61e5fac7b9dcc798e85c6cffc_JaffaCakes118.exe

  • Size

    2.6MB

  • MD5

    dec7bbc61e5fac7b9dcc798e85c6cffc

  • SHA1

    353315e4cf6cd85aa6cf574761f7b5e706b35597

  • SHA256

    ff067dcb1df6837231a965295ce09eb39ddc7856b72f23c59f8bd950bcc8c3f8

  • SHA512

    4edb7b2028045a70dc95ff3956904c19499f5442b87f402d7e3f8e0b861c0bb7e25ee906774d8a25e6ee92c428dad8db35881f401e426985e80914fb0129bbfa

  • SSDEEP

    24576:lVe3u2JKwQ1rDRYgkCL9m9YgYXr0hLzwMTR3jllk+x0a2XQFsZxhoED:f9pqOyeMxlpYr

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot1949235546:AAFJ8hWHynuHinrzOjcAE-TQlS6bYGcf8J8/sendMessage?chat_id=1947722068

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Blustealer family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dec7bbc61e5fac7b9dcc798e85c6cffc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dec7bbc61e5fac7b9dcc798e85c6cffc_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4016
    • C:\Users\Admin\AppData\Local\Temp\dec7bbc61e5fac7b9dcc798e85c6cffc_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\dec7bbc61e5fac7b9dcc798e85c6cffc_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3940-10-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3940-17-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3940-13-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4016-6-0x0000000074650000-0x0000000074E00000-memory.dmp

    Filesize

    7.7MB

  • memory/4016-4-0x0000000005530000-0x00000000055A6000-memory.dmp

    Filesize

    472KB

  • memory/4016-5-0x0000000005650000-0x00000000056EC000-memory.dmp

    Filesize

    624KB

  • memory/4016-0-0x000000007465E000-0x000000007465F000-memory.dmp

    Filesize

    4KB

  • memory/4016-7-0x00000000054B0000-0x00000000054CE000-memory.dmp

    Filesize

    120KB

  • memory/4016-8-0x00000000056F0000-0x000000000586A000-memory.dmp

    Filesize

    1.5MB

  • memory/4016-9-0x0000000004E10000-0x0000000004E26000-memory.dmp

    Filesize

    88KB

  • memory/4016-3-0x0000000005410000-0x00000000054A2000-memory.dmp

    Filesize

    584KB

  • memory/4016-2-0x0000000005910000-0x0000000005EB4000-memory.dmp

    Filesize

    5.6MB

  • memory/4016-15-0x0000000074650000-0x0000000074E00000-memory.dmp

    Filesize

    7.7MB

  • memory/4016-1-0x0000000000900000-0x0000000000BA4000-memory.dmp

    Filesize

    2.6MB