Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
30-06-2022 12:13
Static task
static1
Behavioral task
behavioral1
Sample
Re-2181718.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Re-2181718.exe
Resource
win10v2004-20220414-en
General
-
Target
Re-2181718.exe
-
Size
172KB
-
MD5
be2d1ca01da2a323960e94dcae0d4696
-
SHA1
a0a404c6ef2dcb77f65ddf072402eeeecdd1dc2e
-
SHA256
f1ff4fbaa6991440428ea8b228268b6ba82595aa8cdbcf2e7bb8a69835753b31
-
SHA512
883cb35116de50ee923fb5101aa1a6b3dea61897d96a73a51e1bc351dc7181f116dc1e290bf86946300b8998f53e106a064b73e1ebf3f503e1e5e65e2a5ed27c
Malware Config
Extracted
blustealer
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
t.liaen@yandex.com - Password:
@vZe#$#28990
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1111
62.197.136.167:6606
62.197.136.167:7707
62.197.136.167:8808
62.197.136.167:1111
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1692-174-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
Jcsbrafiyvpxtqostory5m.exepid process 4468 Jcsbrafiyvpxtqostory5m.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Re-2181718.exeJcsbrafiyvpxtqostory5m.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation Re-2181718.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation Jcsbrafiyvpxtqostory5m.exe -
Loads dropped DLL 2 IoCs
Processes:
InstallUtil.exepid process 3324 InstallUtil.exe 3324 InstallUtil.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Re-2181718.exeJcsbrafiyvpxtqostory5m.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aeigqqh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tupbtqbro\\Aeigqqh.exe\"" Re-2181718.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aeigqqh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tupbtqbro\\Aeigqqh.exe\"" Jcsbrafiyvpxtqostory5m.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Re-2181718.exeInstallUtil.exeJcsbrafiyvpxtqostory5m.exedescription pid process target process PID 3136 set thread context of 3324 3136 Re-2181718.exe InstallUtil.exe PID 3324 set thread context of 3836 3324 InstallUtil.exe InstallUtil.exe PID 4468 set thread context of 1692 4468 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
powershell.exepowershell.exeRe-2181718.exepowershell.exepowershell.exeJcsbrafiyvpxtqostory5m.exepid process 2616 powershell.exe 2616 powershell.exe 524 powershell.exe 524 powershell.exe 3136 Re-2181718.exe 3136 Re-2181718.exe 3136 Re-2181718.exe 3136 Re-2181718.exe 3136 Re-2181718.exe 3136 Re-2181718.exe 3136 Re-2181718.exe 3136 Re-2181718.exe 3136 Re-2181718.exe 3136 Re-2181718.exe 3120 powershell.exe 3136 Re-2181718.exe 3136 Re-2181718.exe 3136 Re-2181718.exe 3136 Re-2181718.exe 3120 powershell.exe 3656 powershell.exe 3656 powershell.exe 4468 Jcsbrafiyvpxtqostory5m.exe 4468 Jcsbrafiyvpxtqostory5m.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
powershell.exeRe-2181718.exepowershell.exepowershell.exeJcsbrafiyvpxtqostory5m.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2616 powershell.exe Token: SeDebugPrivilege 3136 Re-2181718.exe Token: SeDebugPrivilege 524 powershell.exe Token: SeDebugPrivilege 3120 powershell.exe Token: SeDebugPrivilege 4468 Jcsbrafiyvpxtqostory5m.exe Token: SeDebugPrivilege 3656 powershell.exe Token: SeDebugPrivilege 1692 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 3324 InstallUtil.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
Re-2181718.exeJcsbrafiyvpxtqostory5m.exeInstallUtil.exedescription pid process target process PID 3136 wrote to memory of 2616 3136 Re-2181718.exe powershell.exe PID 3136 wrote to memory of 2616 3136 Re-2181718.exe powershell.exe PID 3136 wrote to memory of 2616 3136 Re-2181718.exe powershell.exe PID 3136 wrote to memory of 524 3136 Re-2181718.exe powershell.exe PID 3136 wrote to memory of 524 3136 Re-2181718.exe powershell.exe PID 3136 wrote to memory of 524 3136 Re-2181718.exe powershell.exe PID 3136 wrote to memory of 4468 3136 Re-2181718.exe Jcsbrafiyvpxtqostory5m.exe PID 3136 wrote to memory of 4468 3136 Re-2181718.exe Jcsbrafiyvpxtqostory5m.exe PID 3136 wrote to memory of 4468 3136 Re-2181718.exe Jcsbrafiyvpxtqostory5m.exe PID 4468 wrote to memory of 3120 4468 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 4468 wrote to memory of 3120 4468 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 4468 wrote to memory of 3120 4468 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 3136 wrote to memory of 4768 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 4768 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 4768 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 3988 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 3988 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 3988 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 4000 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 4000 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 4000 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 3324 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 3324 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 3324 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 3324 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 3324 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 3324 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 3324 3136 Re-2181718.exe InstallUtil.exe PID 3136 wrote to memory of 3324 3136 Re-2181718.exe InstallUtil.exe PID 3324 wrote to memory of 3836 3324 InstallUtil.exe InstallUtil.exe PID 3324 wrote to memory of 3836 3324 InstallUtil.exe InstallUtil.exe PID 3324 wrote to memory of 3836 3324 InstallUtil.exe InstallUtil.exe PID 3324 wrote to memory of 3836 3324 InstallUtil.exe InstallUtil.exe PID 3324 wrote to memory of 3836 3324 InstallUtil.exe InstallUtil.exe PID 4468 wrote to memory of 3656 4468 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 4468 wrote to memory of 3656 4468 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 4468 wrote to memory of 3656 4468 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 4468 wrote to memory of 1692 4468 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 4468 wrote to memory of 1692 4468 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 4468 wrote to memory of 1692 4468 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 4468 wrote to memory of 1692 4468 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 4468 wrote to memory of 1692 4468 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 4468 wrote to memory of 1692 4468 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 4468 wrote to memory of 1692 4468 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 4468 wrote to memory of 1692 4468 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Re-2181718.exe"C:\Users\Admin\AppData\Local\Temp\Re-2181718.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exe"C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD53337d66209faa998d52d781d0ff2d804
SHA16594b85a70f998f79f43cdf1ca56137997534156
SHA2569b946b062865f68b9f0f43a011d33d7ea0926a3c8f78fb20d9cab6144314e1bd
SHA5128bbd14bd73111f7b55712f5d1e1b727e41db8e6e0c1243ee6809ff32b509e52dec7af34c064151fb5beccd59dda434a3f83abe987c561a25abfbb4cbcf9c7f1f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
15KB
MD5255f2c6efa484bd1bf9e35de1a0f0a3f
SHA17adf1c0a00095e9c9606f0dc14508851128c4c0f
SHA25679cf2a8006d9e45ce918f70ce02733f3ae757416098435027f094a8635627508
SHA5123a1b1ed99c8eb55453eed8ea02bf3a9971b6f303eff89987f07d26d474649cefb1417463be05523cb7598a1f63e0ce744455a32f4accd591b51837676cab971d
-
C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
C:\Users\Admin\AppData\Roaming\Tupbtqbro\Aeigqqh.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
C:\Users\Public\3037384246424646303030333036443242464246463030303330\SQLite3_StdCall.dllFilesize
59KB
MD5d77b227a28a78627c2323cac75948390
SHA1e228c3951f2a9fd0febfe07390633ab4f35727f4
SHA256527ec201dcd7695bd9830eb82ab35a3986121de9ea156193834aed9d79223b82
SHA5125627fbc8bbb98f644e21f101a68f0e0b07b87c264d00ea227286bed8ab6dd4ebf5114f03b632604f775ff93666a409a1a179a81ebfc9246956ba8150ff5b0587
-
C:\Users\Public\3037384246424646303030333036443242464246463030303330\sqlite3.dllFilesize
585KB
MD55405413fff79b8d9c747aa900f60f082
SHA171caf8907ddd9a3a25d71356bd2ce09bd293bd78
SHA2563e5a28ffde07ac661c26b6ccf94e64c1c90b1f25b3b24c90605aa922b87642eb
SHA5122f09a30fc4da5166bd665210fefa1d44ce344f0ec6a37f127d677aeb3ca4fc0d09b7c9c1540f57da1e3449b7f588a1c61115395e965fa153d4baa5033266ed66
-
memory/524-145-0x0000000000000000-mapping.dmp
-
memory/1692-173-0x0000000000000000-mapping.dmp
-
memory/1692-174-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1692-175-0x0000000005720000-0x00000000057BC000-memory.dmpFilesize
624KB
-
memory/2616-143-0x0000000007B60000-0x00000000081DA000-memory.dmpFilesize
6.5MB
-
memory/2616-138-0x0000000005930000-0x0000000005996000-memory.dmpFilesize
408KB
-
memory/2616-144-0x0000000007500000-0x000000000751A000-memory.dmpFilesize
104KB
-
memory/2616-142-0x0000000007460000-0x00000000074D6000-memory.dmpFilesize
472KB
-
memory/2616-135-0x0000000002840000-0x0000000002876000-memory.dmpFilesize
216KB
-
memory/2616-134-0x0000000000000000-mapping.dmp
-
memory/2616-137-0x00000000051A0000-0x00000000051C2000-memory.dmpFilesize
136KB
-
memory/2616-141-0x00000000066B0000-0x00000000066F4000-memory.dmpFilesize
272KB
-
memory/2616-140-0x0000000006140000-0x000000000615E000-memory.dmpFilesize
120KB
-
memory/2616-139-0x0000000005B10000-0x0000000005B76000-memory.dmpFilesize
408KB
-
memory/2616-136-0x0000000005300000-0x0000000005928000-memory.dmpFilesize
6.2MB
-
memory/3120-151-0x0000000000000000-mapping.dmp
-
memory/3136-132-0x0000000004A50000-0x0000000004AE2000-memory.dmpFilesize
584KB
-
memory/3136-131-0x0000000005100000-0x00000000056A4000-memory.dmpFilesize
5.6MB
-
memory/3136-130-0x0000000000090000-0x00000000000C0000-memory.dmpFilesize
192KB
-
memory/3136-133-0x0000000004B00000-0x0000000004B0A000-memory.dmpFilesize
40KB
-
memory/3324-156-0x0000000000000000-mapping.dmp
-
memory/3324-157-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/3324-159-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/3324-162-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/3324-168-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/3656-170-0x0000000000000000-mapping.dmp
-
memory/3836-163-0x0000000000000000-mapping.dmp
-
memory/3836-167-0x000000006F520000-0x000000006FAD1000-memory.dmpFilesize
5.7MB
-
memory/3836-169-0x000000006F520000-0x000000006FAD1000-memory.dmpFilesize
5.7MB
-
memory/3836-164-0x00000000001E0000-0x00000000001EE000-memory.dmpFilesize
56KB
-
memory/3988-154-0x0000000000000000-mapping.dmp
-
memory/4000-155-0x0000000000000000-mapping.dmp
-
memory/4468-150-0x0000000000920000-0x0000000000950000-memory.dmpFilesize
192KB
-
memory/4468-147-0x0000000000000000-mapping.dmp
-
memory/4768-152-0x0000000000000000-mapping.dmp