Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
30-06-2022 10:00
Static task
static1
Behavioral task
behavioral1
Sample
Re-2181718.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Re-2181718.exe
Resource
win10v2004-20220414-en
General
-
Target
Re-2181718.exe
-
Size
172KB
-
MD5
be2d1ca01da2a323960e94dcae0d4696
-
SHA1
a0a404c6ef2dcb77f65ddf072402eeeecdd1dc2e
-
SHA256
f1ff4fbaa6991440428ea8b228268b6ba82595aa8cdbcf2e7bb8a69835753b31
-
SHA512
883cb35116de50ee923fb5101aa1a6b3dea61897d96a73a51e1bc351dc7181f116dc1e290bf86946300b8998f53e106a064b73e1ebf3f503e1e5e65e2a5ed27c
Malware Config
Extracted
blustealer
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
t.liaen@yandex.com - Password:
@vZe#$#28990
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1111
62.197.136.167:6606
62.197.136.167:7707
62.197.136.167:8808
62.197.136.167:1111
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3636-171-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
Jcsbrafiyvpxtqostory5m.exepid process 4936 Jcsbrafiyvpxtqostory5m.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Re-2181718.exeJcsbrafiyvpxtqostory5m.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation Re-2181718.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation Jcsbrafiyvpxtqostory5m.exe -
Loads dropped DLL 2 IoCs
Processes:
InstallUtil.exepid process 612 InstallUtil.exe 612 InstallUtil.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Re-2181718.exeJcsbrafiyvpxtqostory5m.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aeigqqh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tupbtqbro\\Aeigqqh.exe\"" Re-2181718.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aeigqqh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tupbtqbro\\Aeigqqh.exe\"" Jcsbrafiyvpxtqostory5m.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Re-2181718.exeInstallUtil.exeJcsbrafiyvpxtqostory5m.exedescription pid process target process PID 4704 set thread context of 612 4704 Re-2181718.exe InstallUtil.exe PID 612 set thread context of 3076 612 InstallUtil.exe InstallUtil.exe PID 4936 set thread context of 3636 4936 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
powershell.exepowershell.exeRe-2181718.exepowershell.exepowershell.exeJcsbrafiyvpxtqostory5m.exepid process 4780 powershell.exe 4780 powershell.exe 404 powershell.exe 404 powershell.exe 4704 Re-2181718.exe 4704 Re-2181718.exe 5116 powershell.exe 5116 powershell.exe 2488 powershell.exe 2488 powershell.exe 4936 Jcsbrafiyvpxtqostory5m.exe 4936 Jcsbrafiyvpxtqostory5m.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
powershell.exeRe-2181718.exepowershell.exepowershell.exeJcsbrafiyvpxtqostory5m.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 4780 powershell.exe Token: SeDebugPrivilege 4704 Re-2181718.exe Token: SeDebugPrivilege 404 powershell.exe Token: SeDebugPrivilege 5116 powershell.exe Token: SeDebugPrivilege 4936 Jcsbrafiyvpxtqostory5m.exe Token: SeDebugPrivilege 2488 powershell.exe Token: SeDebugPrivilege 3636 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 612 InstallUtil.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
Re-2181718.exeJcsbrafiyvpxtqostory5m.exeInstallUtil.exedescription pid process target process PID 4704 wrote to memory of 4780 4704 Re-2181718.exe powershell.exe PID 4704 wrote to memory of 4780 4704 Re-2181718.exe powershell.exe PID 4704 wrote to memory of 4780 4704 Re-2181718.exe powershell.exe PID 4704 wrote to memory of 404 4704 Re-2181718.exe powershell.exe PID 4704 wrote to memory of 404 4704 Re-2181718.exe powershell.exe PID 4704 wrote to memory of 404 4704 Re-2181718.exe powershell.exe PID 4704 wrote to memory of 4936 4704 Re-2181718.exe Jcsbrafiyvpxtqostory5m.exe PID 4704 wrote to memory of 4936 4704 Re-2181718.exe Jcsbrafiyvpxtqostory5m.exe PID 4704 wrote to memory of 4936 4704 Re-2181718.exe Jcsbrafiyvpxtqostory5m.exe PID 4704 wrote to memory of 612 4704 Re-2181718.exe InstallUtil.exe PID 4704 wrote to memory of 612 4704 Re-2181718.exe InstallUtil.exe PID 4704 wrote to memory of 612 4704 Re-2181718.exe InstallUtil.exe PID 4936 wrote to memory of 5116 4936 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 4936 wrote to memory of 5116 4936 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 4936 wrote to memory of 5116 4936 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 4704 wrote to memory of 612 4704 Re-2181718.exe InstallUtil.exe PID 4704 wrote to memory of 612 4704 Re-2181718.exe InstallUtil.exe PID 4704 wrote to memory of 612 4704 Re-2181718.exe InstallUtil.exe PID 4704 wrote to memory of 612 4704 Re-2181718.exe InstallUtil.exe PID 4704 wrote to memory of 612 4704 Re-2181718.exe InstallUtil.exe PID 4936 wrote to memory of 2488 4936 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 4936 wrote to memory of 2488 4936 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 4936 wrote to memory of 2488 4936 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 612 wrote to memory of 3076 612 InstallUtil.exe InstallUtil.exe PID 612 wrote to memory of 3076 612 InstallUtil.exe InstallUtil.exe PID 612 wrote to memory of 3076 612 InstallUtil.exe InstallUtil.exe PID 612 wrote to memory of 3076 612 InstallUtil.exe InstallUtil.exe PID 612 wrote to memory of 3076 612 InstallUtil.exe InstallUtil.exe PID 4936 wrote to memory of 3636 4936 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 4936 wrote to memory of 3636 4936 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 4936 wrote to memory of 3636 4936 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 4936 wrote to memory of 3636 4936 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 4936 wrote to memory of 3636 4936 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 4936 wrote to memory of 3636 4936 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 4936 wrote to memory of 3636 4936 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 4936 wrote to memory of 3636 4936 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Re-2181718.exe"C:\Users\Admin\AppData\Local\Temp\Re-2181718.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exe"C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD53337d66209faa998d52d781d0ff2d804
SHA16594b85a70f998f79f43cdf1ca56137997534156
SHA2569b946b062865f68b9f0f43a011d33d7ea0926a3c8f78fb20d9cab6144314e1bd
SHA5128bbd14bd73111f7b55712f5d1e1b727e41db8e6e0c1243ee6809ff32b509e52dec7af34c064151fb5beccd59dda434a3f83abe987c561a25abfbb4cbcf9c7f1f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
15KB
MD53a55dd28fa62972eed8d90ee9d094836
SHA1170b12b3b742dd289f40557448345061ea590ab2
SHA256b600a111405e842d91f0abfb2265e5c219791b0b5f81ec58ff4b4d4779622da8
SHA5127025568b583de52bfc0a735719c0f906925cc68f9735ac8d7305744779a0fdf3742b27fc398597f170b74313e6681dbbca841d6596e49478148b27f794b5eb12
-
C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
C:\Users\Admin\AppData\Roaming\Tupbtqbro\Aeigqqh.exeFilesize
172KB
MD55419ab9562088c956e56967db9a2a977
SHA16b2b5a640bbac460e36608cc40a45e841e48d66e
SHA25628e2bb86c87d0aa961e3a1cc289a53d897cb8ea49b9e1b4751df8115c5e07983
SHA5121efbc09ff6b631de4acef6489822422c1f0c2ee54b69d74d4617621d817d6e983d75dbe677e3c3be7a75d2094a6d3716620e73e99da89935851c378d366f6b3a
-
C:\Users\Public\3037384246424646303030333036443242464246463030303330\SQLite3_StdCall.dllFilesize
59KB
MD5d77b227a28a78627c2323cac75948390
SHA1e228c3951f2a9fd0febfe07390633ab4f35727f4
SHA256527ec201dcd7695bd9830eb82ab35a3986121de9ea156193834aed9d79223b82
SHA5125627fbc8bbb98f644e21f101a68f0e0b07b87c264d00ea227286bed8ab6dd4ebf5114f03b632604f775ff93666a409a1a179a81ebfc9246956ba8150ff5b0587
-
C:\Users\Public\3037384246424646303030333036443242464246463030303330\sqlite3.dllFilesize
585KB
MD55405413fff79b8d9c747aa900f60f082
SHA171caf8907ddd9a3a25d71356bd2ce09bd293bd78
SHA2563e5a28ffde07ac661c26b6ccf94e64c1c90b1f25b3b24c90605aa922b87642eb
SHA5122f09a30fc4da5166bd665210fefa1d44ce344f0ec6a37f127d677aeb3ca4fc0d09b7c9c1540f57da1e3449b7f588a1c61115395e965fa153d4baa5033266ed66
-
memory/404-145-0x0000000000000000-mapping.dmp
-
memory/612-156-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/612-153-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/612-160-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/612-159-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/612-151-0x0000000000000000-mapping.dmp
-
memory/2488-161-0x0000000000000000-mapping.dmp
-
memory/3076-163-0x0000000000000000-mapping.dmp
-
memory/3076-168-0x000000006F360000-0x000000006F911000-memory.dmpFilesize
5.7MB
-
memory/3076-164-0x0000000001210000-0x000000000121E000-memory.dmpFilesize
56KB
-
memory/3076-167-0x000000006F360000-0x000000006F911000-memory.dmpFilesize
5.7MB
-
memory/3636-171-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3636-172-0x0000000005B50000-0x0000000005BEC000-memory.dmpFilesize
624KB
-
memory/3636-170-0x0000000000000000-mapping.dmp
-
memory/4704-133-0x0000000004D80000-0x0000000004D8A000-memory.dmpFilesize
40KB
-
memory/4704-132-0x0000000004BD0000-0x0000000004C62000-memory.dmpFilesize
584KB
-
memory/4704-130-0x0000000000210000-0x0000000000240000-memory.dmpFilesize
192KB
-
memory/4704-131-0x0000000005240000-0x00000000057E4000-memory.dmpFilesize
5.6MB
-
memory/4780-140-0x0000000005580000-0x000000000559E000-memory.dmpFilesize
120KB
-
memory/4780-141-0x0000000006DA0000-0x0000000006DE4000-memory.dmpFilesize
272KB
-
memory/4780-134-0x0000000000000000-mapping.dmp
-
memory/4780-135-0x0000000002F00000-0x0000000002F36000-memory.dmpFilesize
216KB
-
memory/4780-144-0x0000000007BC0000-0x0000000007BDA000-memory.dmpFilesize
104KB
-
memory/4780-143-0x0000000008220000-0x000000000889A000-memory.dmpFilesize
6.5MB
-
memory/4780-142-0x0000000007920000-0x0000000007996000-memory.dmpFilesize
472KB
-
memory/4780-136-0x0000000005AC0000-0x00000000060E8000-memory.dmpFilesize
6.2MB
-
memory/4780-139-0x00000000061E0000-0x0000000006246000-memory.dmpFilesize
408KB
-
memory/4780-138-0x0000000005A20000-0x0000000005A86000-memory.dmpFilesize
408KB
-
memory/4780-137-0x0000000005980000-0x00000000059A2000-memory.dmpFilesize
136KB
-
memory/4936-147-0x0000000000000000-mapping.dmp
-
memory/4936-150-0x00000000005E0000-0x0000000000610000-memory.dmpFilesize
192KB
-
memory/5116-152-0x0000000000000000-mapping.dmp