blister | c0f3b27ae4f7db457a86a38244225cca35aa0960eb6a685ed350e99a36c32b61

Analysis

Target
c0f3b27ae4f7db457a86a38244225cca35aa0960eb6a685ed350e99a36c32b61.dll
Size 1.2MB
Sample220512-epmldaadd4
SHA256 c0f3b27ae4f7db457a86a38244225cca35aa0960eb6a685ed350e99a36c32b61
MD5 a6d49b646ed61b91bcfe9c2170b258cd
SHA1 75c7cdddfbf538f51da8b74cbad11c302206750e
SHA512 18be0707af33a9c4e3b9c57e7c6a3a00b0a249acf606ccb7cc0d968a722637e8bfdc4f7d09da208cd9477ef915fd019ff171df8977c55481093c35d0ccf6a2cc
MD5 SHA1 SHA512

Score

10^/10

blister loader

BLISTER
BLISTER is a downloader used to deliver other malware families.
loader blister

Detect Blister loader x32 1 IoCs

loader

resource	yara_rule
behavioral1/memory/1128-57-0x0000000074D00000-0x0000000074E30000-memory.dmp	family_blister_x32

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1128	1652	regsvr32.exe	28
PID 1652 wrote to memory of 1128	1652	regsvr32.exe	28
PID 1652 wrote to memory of 1128	1652	regsvr32.exe	28
PID 1652 wrote to memory of 1128	1652	regsvr32.exe	28
PID 1652 wrote to memory of 1128	1652	regsvr32.exe	28
PID 1652 wrote to memory of 1128	1652	regsvr32.exe	28
PID 1652 wrote to memory of 1128	1652	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c0f3b27ae4f7db457a86a38244225cca35aa0960eb6a685ed350e99a36c32b61.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c0f3b27ae4f7db457a86a38244225cca35aa0960eb6a685ed350e99a36c32b61.dll
  2⤵
  PID:1128

memory/1128-56-0x00000000765C1000-0x00000000765C3000-memory.dmp

Download

memory/1128-57-0x0000000074D00000-0x0000000074E30000-memory.dmp

Download

memory/1652-54-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Download