Overview
overview
10Static
static
10Install.lnk
windows7_x64
3Install.lnk
windows10-2004_x64
3Bloom/Bloom.exe
windows7_x64
7Bloom/Bloom.exe
windows10-2004_x64
7Bloom/d3dc...47.dll
windows7_x64
3Bloom/d3dc...47.dll
windows10-2004_x64
1Bloom/ffmpeg.dll
windows7_x64
1Bloom/ffmpeg.dll
windows10-2004_x64
1Bloom/libEGL.dll
windows7_x64
1Bloom/libEGL.dll
windows10-2004_x64
1Bloom/libGLESv2.dll
windows7_x64
3Bloom/libGLESv2.dll
windows10-2004_x64
3Bloom/node.dll
windows7_x64
1Bloom/node.dll
windows10-2004_x64
1Bloom/nw.dll
windows7_x64
3Bloom/nw.dll
windows10-2004_x64
3Bloom/nw_elf.dll
windows7_x64
1Bloom/nw_elf.dll
windows10-2004_x64
1resources.bat
windows7_x64
6resources.bat
windows10-2004_x64
10Analysis
-
max time kernel
54s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
22-03-2022 15:39
Static task
static1
Behavioral task
behavioral1
Sample
Install.lnk
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
Install.lnk
Resource
win10v2004-20220310-en
Behavioral task
behavioral3
Sample
Bloom/Bloom.exe
Resource
win7-20220311-en
Behavioral task
behavioral4
Sample
Bloom/Bloom.exe
Resource
win10v2004-20220310-en
Behavioral task
behavioral5
Sample
Bloom/d3dcompiler_47.dll
Resource
win7-20220311-en
Behavioral task
behavioral6
Sample
Bloom/d3dcompiler_47.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral7
Sample
Bloom/ffmpeg.dll
Resource
win7-20220310-en
Behavioral task
behavioral8
Sample
Bloom/ffmpeg.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral9
Sample
Bloom/libEGL.dll
Resource
win7-20220310-en
Behavioral task
behavioral10
Sample
Bloom/libEGL.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral11
Sample
Bloom/libGLESv2.dll
Resource
win7-20220311-en
Behavioral task
behavioral12
Sample
Bloom/libGLESv2.dll
Resource
win10v2004-20220310-en
Behavioral task
behavioral13
Sample
Bloom/node.dll
Resource
win7-20220311-en
Behavioral task
behavioral14
Sample
Bloom/node.dll
Resource
win10v2004-20220310-en
Behavioral task
behavioral15
Sample
Bloom/nw.dll
Resource
win7-20220311-en
Behavioral task
behavioral16
Sample
Bloom/nw.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral17
Sample
Bloom/nw_elf.dll
Resource
win7-20220310-en
Behavioral task
behavioral18
Sample
Bloom/nw_elf.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral19
Sample
resources.bat
Resource
win7-20220310-en
Behavioral task
behavioral20
Sample
resources.bat
Resource
win10v2004-en-20220113
General
-
Target
resources.bat
-
Size
297B
-
MD5
4f1e373b0722cbb9c21cc0ac8322ed74
-
SHA1
8049f6d60b0fc03ad792a13e634a661d1fc37af0
-
SHA256
1fd144713737510991caa7dbdf03451aee1edc80e7a99773b38ec1f0b436a4d8
-
SHA512
42b7710eaf3746a27dc7f4578ddebbc36adc075d4f68bb2fbddfdbf8c6d60018fe1d4246aa3a28becaec8990b9c9f51107c96321a526570c20e80351e22ed95d
Malware Config
Signatures
-
PlugX Rat Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Bloom\nw.dll PlugX C:\Users\Admin\AppData\Roaming\Bloom\nw.dll PlugX -
Executes dropped EXE 1 IoCs
Processes:
Bloom.exepid process 2232 Bloom.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation cmd.exe -
Loads dropped DLL 3 IoCs
Processes:
Bloom.exepid process 2232 Bloom.exe 2232 Bloom.exe 2232 Bloom.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bloom = "C:\\Users\\Admin\\AppData\\Roaming\\Bloom\\Bloom.exe --zAZsKBNE" reg.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cmd.exedescription pid process target process PID 1056 wrote to memory of 1576 1056 cmd.exe tar.exe PID 1056 wrote to memory of 1576 1056 cmd.exe tar.exe PID 1056 wrote to memory of 1796 1056 cmd.exe reg.exe PID 1056 wrote to memory of 1796 1056 cmd.exe reg.exe PID 1056 wrote to memory of 1952 1056 cmd.exe reg.exe PID 1056 wrote to memory of 1952 1056 cmd.exe reg.exe PID 1056 wrote to memory of 2232 1056 cmd.exe Bloom.exe PID 1056 wrote to memory of 2232 1056 cmd.exe Bloom.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\resources.bat"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\system32\tar.exetar -xvf "app.zip" -C "C:\Users\Admin\AppData\Roaming"2⤵PID:1576
-
C:\Windows\system32\reg.exereg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v Bloom /f2⤵PID:1796
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v Bloom /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Bloom\Bloom.exe --zAZsKBNE" /f2⤵
- Adds Run key to start application
PID:1952 -
C:\Users\Admin\AppData\Roaming\Bloom\Bloom.exe"C:\Users\Admin\AppData\Roaming\Bloom\Bloom.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
c8635ab554fb726513b5e6e54409e185
SHA1353e271c00088c4195bd12af3241038004906ed5
SHA256ae2b6557d6f2b37ba44cc8d7c80ebb66ec2d56392f7ee65ab3ca5108aed90674
SHA512ac1daff8596e9258d019dbcc5f1447bf2cd1ffad87629a1742eac3a725352ca52c2f51a898936c8eaf3ffedd5f4733c86fe56d7bd69be42a2ba2242a52620dfa
-
MD5
c8635ab554fb726513b5e6e54409e185
SHA1353e271c00088c4195bd12af3241038004906ed5
SHA256ae2b6557d6f2b37ba44cc8d7c80ebb66ec2d56392f7ee65ab3ca5108aed90674
SHA512ac1daff8596e9258d019dbcc5f1447bf2cd1ffad87629a1742eac3a725352ca52c2f51a898936c8eaf3ffedd5f4733c86fe56d7bd69be42a2ba2242a52620dfa
-
MD5
dd861e1e5a552fa88759b995d92a8c52
SHA1c1e8ab9f6abc84ce46ea3ddadbf7c5f5b671776a
SHA25609385bebc5b187013f61eadbbd78cc3ce57450f817ac015f80eeec088487e1a4
SHA5120ebc82b17fe04cedb97451183c6280fec3838bed8ed0944530ea025e7aa36dac73092d16a9b975094b2ac85b1184d2f985598bc1856776f1679303c0e4e6f42a
-
MD5
dd861e1e5a552fa88759b995d92a8c52
SHA1c1e8ab9f6abc84ce46ea3ddadbf7c5f5b671776a
SHA25609385bebc5b187013f61eadbbd78cc3ce57450f817ac015f80eeec088487e1a4
SHA5120ebc82b17fe04cedb97451183c6280fec3838bed8ed0944530ea025e7aa36dac73092d16a9b975094b2ac85b1184d2f985598bc1856776f1679303c0e4e6f42a
-
MD5
3d2dadc029a8b5fc745a956c1a5ee568
SHA1a353b0fec54f5c853109b175cea49893b72f539e
SHA256b756c3f4de49600d23f369718cad7eb8645f7ada1dfafc71f47c18e3e2c5aadd
SHA512c513823f9ffaaba52d90f0a7733274787cbc9f380b3670da145a96947b4e1f6a539393f29ee22b65432048b8e15bd4014b760ec73e4e63a7b80975706467a5b5
-
MD5
3d2dadc029a8b5fc745a956c1a5ee568
SHA1a353b0fec54f5c853109b175cea49893b72f539e
SHA256b756c3f4de49600d23f369718cad7eb8645f7ada1dfafc71f47c18e3e2c5aadd
SHA512c513823f9ffaaba52d90f0a7733274787cbc9f380b3670da145a96947b4e1f6a539393f29ee22b65432048b8e15bd4014b760ec73e4e63a7b80975706467a5b5
-
MD5
c73b8e71aa716278dda520c7f6d7d3b8
SHA12331fd8b3ed2cc02ee860f5faa0f12d6a80b00fe
SHA25651cd730f33682a99410117cdac984f2e1ea21f7c8af113b0e830532e9849b316
SHA5123475e87a75d0d5483945dd9fe81b56d66baca35342b1db0e21bc28b3dcccf193b834b067d268447a538343be81b23af4dbfbd864258261ce5d45d69ef88692a6
-
MD5
c73b8e71aa716278dda520c7f6d7d3b8
SHA12331fd8b3ed2cc02ee860f5faa0f12d6a80b00fe
SHA25651cd730f33682a99410117cdac984f2e1ea21f7c8af113b0e830532e9849b316
SHA5123475e87a75d0d5483945dd9fe81b56d66baca35342b1db0e21bc28b3dcccf193b834b067d268447a538343be81b23af4dbfbd864258261ce5d45d69ef88692a6