Overview

overview

10

Static

static

hesaphareketi-01.xlsm

windows7-x64

10

hesaphareketi-01.xlsm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    hesaphareketi-01.xlsm

  • Size

    42KB

  • Sample

    220905-pgln8abdf3

  • MD5

    071ebe9503a886684b900b9c76c12291

  • SHA1

    cbce45a21f2a79fe4da70e3921754bdb3b70fa9d

  • SHA256

    42a5596ce75dd6798e7a5564fa6741abd1f8418683ea576f399627b039a393be

  • SHA512

    e8768a1b0412e788f3384aed662bc6e6e6d1ffb6621d33b84a4195aa026cb4392994b4a5c22fe46256055a96dd014ffc7c053932e7e15f9da75a4c370f152d64

  • SSDEEP

    768:uvfGcv4ssnzWBIJYfTH+niSpUvDH/Lv+nWHFFiKk/fNqtf3hzRL+ng8RuQnhu:uvPv4TzWG1BAT/Lv+sFFi3/Fq1xzUg8i

Score
10/10
blustealerstormkittycollectionpersistencestealer

Malware Config

Targets

    • Target

      hesaphareketi-01.xlsm

    • Size

      42KB

    • MD5

      071ebe9503a886684b900b9c76c12291

    • SHA1

      cbce45a21f2a79fe4da70e3921754bdb3b70fa9d

    • SHA256

      42a5596ce75dd6798e7a5564fa6741abd1f8418683ea576f399627b039a393be

    • SHA512

      e8768a1b0412e788f3384aed662bc6e6e6d1ffb6621d33b84a4195aa026cb4392994b4a5c22fe46256055a96dd014ffc7c053932e7e15f9da75a4c370f152d64

    • SSDEEP

      768:uvfGcv4ssnzWBIJYfTH+niSpUvDH/Lv+nWHFFiKk/fNqtf3hzRL+ng8RuQnhu:uvPv4TzWG1BAT/Lv+sFFi3/Fq1xzUg8i

    Score
    10/10
    blustealerstormkittycollectionpersistencestealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks