Analysis
-
max time kernel
96s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 12:13
Static task
static1
Behavioral task
behavioral1
Sample
Re-2181718.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Re-2181718.exe
Resource
win10v2004-20220414-en
General
-
Target
Re-2181718.exe
-
Size
172KB
-
MD5
be2d1ca01da2a323960e94dcae0d4696
-
SHA1
a0a404c6ef2dcb77f65ddf072402eeeecdd1dc2e
-
SHA256
f1ff4fbaa6991440428ea8b228268b6ba82595aa8cdbcf2e7bb8a69835753b31
-
SHA512
883cb35116de50ee923fb5101aa1a6b3dea61897d96a73a51e1bc351dc7181f116dc1e290bf86946300b8998f53e106a064b73e1ebf3f503e1e5e65e2a5ed27c
Malware Config
Extracted
blustealer
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
t.liaen@yandex.com - Password:
@vZe#$#28990
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1111
62.197.136.167:6606
62.197.136.167:7707
62.197.136.167:8808
62.197.136.167:1111
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1736-115-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1736-116-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1736-117-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1736-118-0x000000000040C75E-mapping.dmp asyncrat behavioral1/memory/1736-120-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1736-122-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
Jcsbrafiyvpxtqostory5m.exepid process 1340 Jcsbrafiyvpxtqostory5m.exe -
Loads dropped DLL 3 IoCs
Processes:
Re-2181718.exeInstallUtil.exepid process 1684 Re-2181718.exe 360 InstallUtil.exe 360 InstallUtil.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Re-2181718.exeJcsbrafiyvpxtqostory5m.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aeigqqh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tupbtqbro\\Aeigqqh.exe\"" Re-2181718.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aeigqqh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tupbtqbro\\Aeigqqh.exe\"" Jcsbrafiyvpxtqostory5m.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Re-2181718.exeInstallUtil.exeJcsbrafiyvpxtqostory5m.exedescription pid process target process PID 1684 set thread context of 360 1684 Re-2181718.exe InstallUtil.exe PID 360 set thread context of 552 360 InstallUtil.exe InstallUtil.exe PID 1340 set thread context of 1736 1340 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepowershell.exepowershell.exeRe-2181718.exepowershell.exeJcsbrafiyvpxtqostory5m.exepid process 1680 powershell.exe 1512 powershell.exe 1744 powershell.exe 1684 Re-2181718.exe 1684 Re-2181718.exe 1824 powershell.exe 1340 Jcsbrafiyvpxtqostory5m.exe 1340 Jcsbrafiyvpxtqostory5m.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
powershell.exeRe-2181718.exepowershell.exepowershell.exeJcsbrafiyvpxtqostory5m.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1680 powershell.exe Token: SeDebugPrivilege 1684 Re-2181718.exe Token: SeDebugPrivilege 1512 powershell.exe Token: SeDebugPrivilege 1744 powershell.exe Token: SeDebugPrivilege 1340 Jcsbrafiyvpxtqostory5m.exe Token: SeDebugPrivilege 1824 powershell.exe Token: SeDebugPrivilege 1736 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 360 InstallUtil.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
Re-2181718.exeJcsbrafiyvpxtqostory5m.exeInstallUtil.exedescription pid process target process PID 1684 wrote to memory of 1680 1684 Re-2181718.exe powershell.exe PID 1684 wrote to memory of 1680 1684 Re-2181718.exe powershell.exe PID 1684 wrote to memory of 1680 1684 Re-2181718.exe powershell.exe PID 1684 wrote to memory of 1680 1684 Re-2181718.exe powershell.exe PID 1684 wrote to memory of 1512 1684 Re-2181718.exe powershell.exe PID 1684 wrote to memory of 1512 1684 Re-2181718.exe powershell.exe PID 1684 wrote to memory of 1512 1684 Re-2181718.exe powershell.exe PID 1684 wrote to memory of 1512 1684 Re-2181718.exe powershell.exe PID 1684 wrote to memory of 1340 1684 Re-2181718.exe Jcsbrafiyvpxtqostory5m.exe PID 1684 wrote to memory of 1340 1684 Re-2181718.exe Jcsbrafiyvpxtqostory5m.exe PID 1684 wrote to memory of 1340 1684 Re-2181718.exe Jcsbrafiyvpxtqostory5m.exe PID 1684 wrote to memory of 1340 1684 Re-2181718.exe Jcsbrafiyvpxtqostory5m.exe PID 1340 wrote to memory of 1744 1340 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 1340 wrote to memory of 1744 1340 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 1340 wrote to memory of 1744 1340 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 1340 wrote to memory of 1744 1340 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 1684 wrote to memory of 360 1684 Re-2181718.exe InstallUtil.exe PID 1684 wrote to memory of 360 1684 Re-2181718.exe InstallUtil.exe PID 1684 wrote to memory of 360 1684 Re-2181718.exe InstallUtil.exe PID 1684 wrote to memory of 360 1684 Re-2181718.exe InstallUtil.exe PID 1684 wrote to memory of 360 1684 Re-2181718.exe InstallUtil.exe PID 1684 wrote to memory of 360 1684 Re-2181718.exe InstallUtil.exe PID 1684 wrote to memory of 360 1684 Re-2181718.exe InstallUtil.exe PID 1684 wrote to memory of 360 1684 Re-2181718.exe InstallUtil.exe PID 1684 wrote to memory of 360 1684 Re-2181718.exe InstallUtil.exe PID 1684 wrote to memory of 360 1684 Re-2181718.exe InstallUtil.exe PID 1684 wrote to memory of 360 1684 Re-2181718.exe InstallUtil.exe PID 1684 wrote to memory of 360 1684 Re-2181718.exe InstallUtil.exe PID 360 wrote to memory of 552 360 InstallUtil.exe InstallUtil.exe PID 360 wrote to memory of 552 360 InstallUtil.exe InstallUtil.exe PID 360 wrote to memory of 552 360 InstallUtil.exe InstallUtil.exe PID 360 wrote to memory of 552 360 InstallUtil.exe InstallUtil.exe PID 360 wrote to memory of 552 360 InstallUtil.exe InstallUtil.exe PID 360 wrote to memory of 552 360 InstallUtil.exe InstallUtil.exe PID 360 wrote to memory of 552 360 InstallUtil.exe InstallUtil.exe PID 360 wrote to memory of 552 360 InstallUtil.exe InstallUtil.exe PID 360 wrote to memory of 552 360 InstallUtil.exe InstallUtil.exe PID 1340 wrote to memory of 1824 1340 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 1340 wrote to memory of 1824 1340 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 1340 wrote to memory of 1824 1340 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 1340 wrote to memory of 1824 1340 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 1340 wrote to memory of 1736 1340 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1340 wrote to memory of 1736 1340 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1340 wrote to memory of 1736 1340 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1340 wrote to memory of 1736 1340 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1340 wrote to memory of 1736 1340 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1340 wrote to memory of 1736 1340 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1340 wrote to memory of 1736 1340 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1340 wrote to memory of 1736 1340 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1340 wrote to memory of 1736 1340 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1340 wrote to memory of 1736 1340 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1340 wrote to memory of 1736 1340 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1340 wrote to memory of 1736 1340 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Re-2181718.exe"C:\Users\Admin\AppData\Local\Temp\Re-2181718.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exe"C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5a9aca8499df4f04449b608b9e1882b56
SHA1e9a7b239896c2f7c556d2be3f89d075261147cc0
SHA256b1eb565c0d6a9c044b34e9ce36f96447deb158cd27825a8910f0bd1fcfbe0b11
SHA51289f941a06a75efa38ddb237452dd7ca0c0b3f747ca18f5b7c27cc00af28f3eb4e372f1e81fcdd09eb9b14ca86dfd8c398ed61f6d849d8f51c4e9b493ac7d3994
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5a9aca8499df4f04449b608b9e1882b56
SHA1e9a7b239896c2f7c556d2be3f89d075261147cc0
SHA256b1eb565c0d6a9c044b34e9ce36f96447deb158cd27825a8910f0bd1fcfbe0b11
SHA51289f941a06a75efa38ddb237452dd7ca0c0b3f747ca18f5b7c27cc00af28f3eb4e372f1e81fcdd09eb9b14ca86dfd8c398ed61f6d849d8f51c4e9b493ac7d3994
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5a9aca8499df4f04449b608b9e1882b56
SHA1e9a7b239896c2f7c556d2be3f89d075261147cc0
SHA256b1eb565c0d6a9c044b34e9ce36f96447deb158cd27825a8910f0bd1fcfbe0b11
SHA51289f941a06a75efa38ddb237452dd7ca0c0b3f747ca18f5b7c27cc00af28f3eb4e372f1e81fcdd09eb9b14ca86dfd8c398ed61f6d849d8f51c4e9b493ac7d3994
-
C:\Users\Admin\AppData\Roaming\Tupbtqbro\Aeigqqh.exeMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
\Users\Public\3037384246424646303030333036443242464246463030303330\SQLite3_StdCall.dllFilesize
59KB
MD5d77b227a28a78627c2323cac75948390
SHA1e228c3951f2a9fd0febfe07390633ab4f35727f4
SHA256527ec201dcd7695bd9830eb82ab35a3986121de9ea156193834aed9d79223b82
SHA5125627fbc8bbb98f644e21f101a68f0e0b07b87c264d00ea227286bed8ab6dd4ebf5114f03b632604f775ff93666a409a1a179a81ebfc9246956ba8150ff5b0587
-
\Users\Public\3037384246424646303030333036443242464246463030303330\sqlite3.dllFilesize
585KB
MD55405413fff79b8d9c747aa900f60f082
SHA171caf8907ddd9a3a25d71356bd2ce09bd293bd78
SHA2563e5a28ffde07ac661c26b6ccf94e64c1c90b1f25b3b24c90605aa922b87642eb
SHA5122f09a30fc4da5166bd665210fefa1d44ce344f0ec6a37f127d677aeb3ca4fc0d09b7c9c1540f57da1e3449b7f588a1c61115395e965fa153d4baa5033266ed66
-
memory/360-86-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/360-77-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/360-104-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/360-90-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/360-84-0x0000000000403528-mapping.dmp
-
memory/360-83-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/360-80-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/360-78-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/552-98-0x0000000000090000-0x000000000009E000-memory.dmpFilesize
56KB
-
memory/552-91-0x0000000000090000-0x000000000009E000-memory.dmpFilesize
56KB
-
memory/552-102-0x000000006F6F0000-0x000000006FC9B000-memory.dmpFilesize
5.7MB
-
memory/552-96-0x0000000000090000-0x000000000009E000-memory.dmpFilesize
56KB
-
memory/552-94-0x0000000000099C22-mapping.dmp
-
memory/552-93-0x0000000000090000-0x000000000009E000-memory.dmpFilesize
56KB
-
memory/1340-68-0x0000000000000000-mapping.dmp
-
memory/1340-71-0x00000000010D0000-0x0000000001100000-memory.dmpFilesize
192KB
-
memory/1340-105-0x0000000005170000-0x0000000005234000-memory.dmpFilesize
784KB
-
memory/1512-65-0x000000006F6F0000-0x000000006FC9B000-memory.dmpFilesize
5.7MB
-
memory/1512-62-0x0000000000000000-mapping.dmp
-
memory/1512-66-0x000000006F6F0000-0x000000006FC9B000-memory.dmpFilesize
5.7MB
-
memory/1680-59-0x000000006F6F0000-0x000000006FC9B000-memory.dmpFilesize
5.7MB
-
memory/1680-58-0x000000006F6F0000-0x000000006FC9B000-memory.dmpFilesize
5.7MB
-
memory/1680-56-0x0000000000000000-mapping.dmp
-
memory/1684-54-0x0000000000E90000-0x0000000000EC0000-memory.dmpFilesize
192KB
-
memory/1684-55-0x0000000076431000-0x0000000076433000-memory.dmpFilesize
8KB
-
memory/1684-60-0x0000000005B20000-0x0000000005C4C000-memory.dmpFilesize
1.2MB
-
memory/1684-61-0x0000000004BA0000-0x0000000004BEC000-memory.dmpFilesize
304KB
-
memory/1736-112-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1736-117-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1736-122-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1736-120-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1736-118-0x000000000040C75E-mapping.dmp
-
memory/1736-116-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1736-115-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1736-113-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1744-73-0x0000000000000000-mapping.dmp
-
memory/1744-82-0x000000006F6F0000-0x000000006FC9B000-memory.dmpFilesize
5.7MB
-
memory/1744-103-0x000000006F6F0000-0x000000006FC9B000-memory.dmpFilesize
5.7MB
-
memory/1824-106-0x0000000000000000-mapping.dmp
-
memory/1824-110-0x000000006F6F0000-0x000000006FC9B000-memory.dmpFilesize
5.7MB
-
memory/1824-109-0x000000006F6F0000-0x000000006FC9B000-memory.dmpFilesize
5.7MB