Analysis
-
max time kernel
141s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
15/08/2022, 16:25
Static task
static1
Behavioral task
behavioral1
Sample
200bbb757192fb530d38711a112338ba.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
200bbb757192fb530d38711a112338ba.exe
Resource
win10v2004-20220812-en
General
-
Target
200bbb757192fb530d38711a112338ba.exe
-
Size
847KB
-
MD5
200bbb757192fb530d38711a112338ba
-
SHA1
259c77525cf161a376a07ed9a035c3064e2a1f17
-
SHA256
dfdea8e5cc329e17847e129d8e515043b0dba31f1af48304f28dd181483607ae
-
SHA512
b387ea9263598db899501f202f754e0bbc39b72be177857809a70fc4608310b46e00fe9d96e9cc00d2a2c9ce48bec764f0f4aaa989724d0079711b8cd37866ea
Malware Config
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 4 IoCs
resource yara_rule behavioral1/memory/772-80-0x00000000000B0000-0x00000000000CA000-memory.dmp family_stormkitty behavioral1/memory/772-81-0x00000000000C4F6E-mapping.dmp family_stormkitty behavioral1/memory/772-83-0x00000000000B0000-0x00000000000CA000-memory.dmp family_stormkitty behavioral1/memory/772-85-0x00000000000B0000-0x00000000000CA000-memory.dmp family_stormkitty -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1488 set thread context of 1928 1488 200bbb757192fb530d38711a112338ba.exe 32 PID 1928 set thread context of 772 1928 200bbb757192fb530d38711a112338ba.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1396 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1488 200bbb757192fb530d38711a112338ba.exe 1712 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1928 200bbb757192fb530d38711a112338ba.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1488 200bbb757192fb530d38711a112338ba.exe Token: SeDebugPrivilege 1712 powershell.exe Token: SeDebugPrivilege 772 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1928 200bbb757192fb530d38711a112338ba.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1488 wrote to memory of 1712 1488 200bbb757192fb530d38711a112338ba.exe 27 PID 1488 wrote to memory of 1712 1488 200bbb757192fb530d38711a112338ba.exe 27 PID 1488 wrote to memory of 1712 1488 200bbb757192fb530d38711a112338ba.exe 27 PID 1488 wrote to memory of 1712 1488 200bbb757192fb530d38711a112338ba.exe 27 PID 1488 wrote to memory of 1396 1488 200bbb757192fb530d38711a112338ba.exe 29 PID 1488 wrote to memory of 1396 1488 200bbb757192fb530d38711a112338ba.exe 29 PID 1488 wrote to memory of 1396 1488 200bbb757192fb530d38711a112338ba.exe 29 PID 1488 wrote to memory of 1396 1488 200bbb757192fb530d38711a112338ba.exe 29 PID 1488 wrote to memory of 1320 1488 200bbb757192fb530d38711a112338ba.exe 31 PID 1488 wrote to memory of 1320 1488 200bbb757192fb530d38711a112338ba.exe 31 PID 1488 wrote to memory of 1320 1488 200bbb757192fb530d38711a112338ba.exe 31 PID 1488 wrote to memory of 1320 1488 200bbb757192fb530d38711a112338ba.exe 31 PID 1488 wrote to memory of 1928 1488 200bbb757192fb530d38711a112338ba.exe 32 PID 1488 wrote to memory of 1928 1488 200bbb757192fb530d38711a112338ba.exe 32 PID 1488 wrote to memory of 1928 1488 200bbb757192fb530d38711a112338ba.exe 32 PID 1488 wrote to memory of 1928 1488 200bbb757192fb530d38711a112338ba.exe 32 PID 1488 wrote to memory of 1928 1488 200bbb757192fb530d38711a112338ba.exe 32 PID 1488 wrote to memory of 1928 1488 200bbb757192fb530d38711a112338ba.exe 32 PID 1488 wrote to memory of 1928 1488 200bbb757192fb530d38711a112338ba.exe 32 PID 1488 wrote to memory of 1928 1488 200bbb757192fb530d38711a112338ba.exe 32 PID 1488 wrote to memory of 1928 1488 200bbb757192fb530d38711a112338ba.exe 32 PID 1928 wrote to memory of 772 1928 200bbb757192fb530d38711a112338ba.exe 33 PID 1928 wrote to memory of 772 1928 200bbb757192fb530d38711a112338ba.exe 33 PID 1928 wrote to memory of 772 1928 200bbb757192fb530d38711a112338ba.exe 33 PID 1928 wrote to memory of 772 1928 200bbb757192fb530d38711a112338ba.exe 33 PID 1928 wrote to memory of 772 1928 200bbb757192fb530d38711a112338ba.exe 33 PID 1928 wrote to memory of 772 1928 200bbb757192fb530d38711a112338ba.exe 33 PID 1928 wrote to memory of 772 1928 200bbb757192fb530d38711a112338ba.exe 33 PID 1928 wrote to memory of 772 1928 200bbb757192fb530d38711a112338ba.exe 33 PID 1928 wrote to memory of 772 1928 200bbb757192fb530d38711a112338ba.exe 33 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\200bbb757192fb530d38711a112338ba.exe"C:\Users\Admin\AppData\Local\Temp\200bbb757192fb530d38711a112338ba.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RAUXoDciVwKR.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RAUXoDciVwKR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEDD9.tmp"2⤵
- Creates scheduled task(s)
PID:1396
-
-
C:\Users\Admin\AppData\Local\Temp\200bbb757192fb530d38711a112338ba.exe"C:\Users\Admin\AppData\Local\Temp\200bbb757192fb530d38711a112338ba.exe"2⤵PID:1320
-
-
C:\Users\Admin\AppData\Local\Temp\200bbb757192fb530d38711a112338ba.exe"C:\Users\Admin\AppData\Local\Temp\200bbb757192fb530d38711a112338ba.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:772
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d7e3475b27b27ec1e6261ffab8aaaa1a
SHA1c6d7817fad852936e7ba762c86dcf3c5939de21a
SHA256937c90d8b9ae2700437d5cf6ebaeb21b16daa9644099074943aa08e0b5868d46
SHA51239fcef8997968efb9dc18c30b486cf4a64bd4671b6095f7800a9551298ddd4f78c0c58234a9a0d0cefecb12cbe62c2e8eb4fc20a7e92594164d046e86cd11740