Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15/08/2022, 16:25
Static task
static1
Behavioral task
behavioral1
Sample
200bbb757192fb530d38711a112338ba.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
200bbb757192fb530d38711a112338ba.exe
Resource
win10v2004-20220812-en
General
-
Target
200bbb757192fb530d38711a112338ba.exe
-
Size
847KB
-
MD5
200bbb757192fb530d38711a112338ba
-
SHA1
259c77525cf161a376a07ed9a035c3064e2a1f17
-
SHA256
dfdea8e5cc329e17847e129d8e515043b0dba31f1af48304f28dd181483607ae
-
SHA512
b387ea9263598db899501f202f754e0bbc39b72be177857809a70fc4608310b46e00fe9d96e9cc00d2a2c9ce48bec764f0f4aaa989724d0079711b8cd37866ea
Malware Config
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/5020-159-0x00000000003D0000-0x00000000003EA000-memory.dmp family_stormkitty -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation 200bbb757192fb530d38711a112338ba.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3536 set thread context of 1688 3536 200bbb757192fb530d38711a112338ba.exe 83 PID 1688 set thread context of 5020 1688 200bbb757192fb530d38711a112338ba.exe 84 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4488 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1916 powershell.exe 1916 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1688 200bbb757192fb530d38711a112338ba.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1916 powershell.exe Token: SeDebugPrivilege 5020 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1688 200bbb757192fb530d38711a112338ba.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3536 wrote to memory of 1916 3536 200bbb757192fb530d38711a112338ba.exe 79 PID 3536 wrote to memory of 1916 3536 200bbb757192fb530d38711a112338ba.exe 79 PID 3536 wrote to memory of 1916 3536 200bbb757192fb530d38711a112338ba.exe 79 PID 3536 wrote to memory of 4488 3536 200bbb757192fb530d38711a112338ba.exe 81 PID 3536 wrote to memory of 4488 3536 200bbb757192fb530d38711a112338ba.exe 81 PID 3536 wrote to memory of 4488 3536 200bbb757192fb530d38711a112338ba.exe 81 PID 3536 wrote to memory of 1688 3536 200bbb757192fb530d38711a112338ba.exe 83 PID 3536 wrote to memory of 1688 3536 200bbb757192fb530d38711a112338ba.exe 83 PID 3536 wrote to memory of 1688 3536 200bbb757192fb530d38711a112338ba.exe 83 PID 3536 wrote to memory of 1688 3536 200bbb757192fb530d38711a112338ba.exe 83 PID 3536 wrote to memory of 1688 3536 200bbb757192fb530d38711a112338ba.exe 83 PID 3536 wrote to memory of 1688 3536 200bbb757192fb530d38711a112338ba.exe 83 PID 3536 wrote to memory of 1688 3536 200bbb757192fb530d38711a112338ba.exe 83 PID 3536 wrote to memory of 1688 3536 200bbb757192fb530d38711a112338ba.exe 83 PID 1688 wrote to memory of 5020 1688 200bbb757192fb530d38711a112338ba.exe 84 PID 1688 wrote to memory of 5020 1688 200bbb757192fb530d38711a112338ba.exe 84 PID 1688 wrote to memory of 5020 1688 200bbb757192fb530d38711a112338ba.exe 84 PID 1688 wrote to memory of 5020 1688 200bbb757192fb530d38711a112338ba.exe 84 PID 1688 wrote to memory of 5020 1688 200bbb757192fb530d38711a112338ba.exe 84 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\200bbb757192fb530d38711a112338ba.exe"C:\Users\Admin\AppData\Local\Temp\200bbb757192fb530d38711a112338ba.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RAUXoDciVwKR.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RAUXoDciVwKR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7C73.tmp"2⤵
- Creates scheduled task(s)
PID:4488
-
-
C:\Users\Admin\AppData\Local\Temp\200bbb757192fb530d38711a112338ba.exe"C:\Users\Admin\AppData\Local\Temp\200bbb757192fb530d38711a112338ba.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:5020
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD586c304d66ae87054431621624f040ff9
SHA1a3fd556f753098ec4ee4df5b91317466231ee238
SHA25666568b4daeacc8526fd7f269568a9cbb20d0fa0e094be5bed56cb8c0eab959ba
SHA512bde871b1bc6b58cde54509e1abe34475fdb8e56d4bfdb54a68a1cc601f64625a3bac379a9a9b8107f4293bd5e451a87f5572babb18810526e17a297f23976f7a