blister | f9508e81f1ac31569646fde9e864e25212457ca62ac768e23fbb95c290950e99

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2022 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ac3fd9de619c934b0fad04b0384898d98cd69444da2d2bbf3bdd6a7e922fce2.exe
Size

3.5MB
MD5

5a400b8c8efe3eb9d70fa9ee4569ce5d
SHA1

1da1f81315aff1b7ffe320b9883dcac2ab05c6a8
SHA256

3ac3fd9de619c934b0fad04b0384898d98cd69444da2d2bbf3bdd6a7e922fce2
SHA512

af657f501ca949286dcfc0170cdedebe326c5836a2599de523bf68439d1128280d14cbe46e444f05c00de0777f803d4fa83adc48494d9d0a1a9c902ffb054b5e
SSDEEP

98304:q3ah4ACuy5iqfcnv6bePNMbSK2FP0C1wqF8CGIk:qQrCuygYePNiSZwqmCxk

Score

10^/10

blister loader

Malware Config

Signatures

BLISTER
BLISTER is a downloader used to deliver other malware families.
loader blister

Detect Blister loader x32 6 IoCs

loader

resource	yara_rule
behavioral28/files/0x0008000000022e06-133.dat	family_blister_x32
behavioral28/files/0x0008000000022e06-135.dat	family_blister_x32
behavioral28/files/0x0007000000022e56-137.dat	family_blister_x32
behavioral28/files/0x0007000000022e56-139.dat	family_blister_x32
behavioral28/memory/4928-140-0x0000000017170000-0x0000000017487000-memory.dmp	family_blister_x32
behavioral28/memory/4416-141-0x0000000017170000-0x000000001722B000-memory.dmp	family_blister_x32

Loads dropped DLL 2 IoCs

pid	Process
4928	rundll32.exe
4416	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 3360	5024	3ac3fd9de619c934b0fad04b0384898d98cd69444da2d2bbf3bdd6a7e922fce2.exe	82
PID 5024 wrote to memory of 3360	5024	3ac3fd9de619c934b0fad04b0384898d98cd69444da2d2bbf3bdd6a7e922fce2.exe	82
PID 3360 wrote to memory of 4928	3360	Rundll32.exe	83
PID 3360 wrote to memory of 4928	3360	Rundll32.exe	83
PID 3360 wrote to memory of 4928	3360	Rundll32.exe	83
PID 5024 wrote to memory of 528	5024	3ac3fd9de619c934b0fad04b0384898d98cd69444da2d2bbf3bdd6a7e922fce2.exe	84
PID 5024 wrote to memory of 528	5024	3ac3fd9de619c934b0fad04b0384898d98cd69444da2d2bbf3bdd6a7e922fce2.exe	84
PID 528 wrote to memory of 4416	528	Rundll32.exe	85
PID 528 wrote to memory of 4416	528	Rundll32.exe	85
PID 528 wrote to memory of 4416	528	Rundll32.exe	85

C:\Users\Admin\AppData\Local\Temp\3ac3fd9de619c934b0fad04b0384898d98cd69444da2d2bbf3bdd6a7e922fce2.exe
"C:\Users\Admin\AppData\Local\Temp\3ac3fd9de619c934b0fad04b0384898d98cd69444da2d2bbf3bdd6a7e922fce2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SYSTEM32\Rundll32.exe
  Rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tempfile\interfacegui.dll,LaunchColorCpl
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\SysWOW64\rundll32.exe
    Rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tempfile\interfacegui.dll,LaunchColorCpl
    3⤵
    - Loads dropped DLL
    PID:4928
- C:\Windows\SYSTEM32\Rundll32.exe
  Rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tempfile\colorui.dll,LaunchColorCpl
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:528
- - C:\Windows\SysWOW64\rundll32.exe
    Rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tempfile\colorui.dll,LaunchColorCpl
    3⤵
    - Loads dropped DLL
    PID:4416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tempfile\colorui.dll

Filesize
736KB

MD5
51c97b49ac56ec2183077a127305ea52

SHA1
4fc99ab0e17fbadbb6cf1bb92398f57c0b71e4c7

SHA256
25a0d6a839c4dc708dcdd1ef9395570cc86d54d4725b7daf56964017f66be3c1

SHA512
99160fd02e10429d15232e984781e57e8caf9e86fd07f904b2a6a26d33803186187ebadd87a30b16d52998631ec8ab351f52b43ecaa5da428457c317aa9f0fd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tempfile\colorui.dll

Filesize
736KB

MD5
51c97b49ac56ec2183077a127305ea52

SHA1
4fc99ab0e17fbadbb6cf1bb92398f57c0b71e4c7

SHA256
25a0d6a839c4dc708dcdd1ef9395570cc86d54d4725b7daf56964017f66be3c1

SHA512
99160fd02e10429d15232e984781e57e8caf9e86fd07f904b2a6a26d33803186187ebadd87a30b16d52998631ec8ab351f52b43ecaa5da428457c317aa9f0fd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tempfile\interfacegui.dll

Filesize
3.1MB

MD5
9360132c2ca6e068f3cfda5f7ec2e8b8

SHA1
b45ab5bb6561daecdb36e075ce15f765bf9b5cc0

SHA256
3c7480998ade344b74e956f7d3a3f1a989aaf43446163a62f0a8ed34b0c010d0

SHA512
4f8eb75b504c89e4b5b3fc7b55f21e8e85269ddb626fcecf2b101ba5fc563fe6e160c31e47444ea17328b2c13bf9a84e6be7b4d671b005c4ac2b6bf77c641002

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tempfile\interfacegui.dll

Filesize
3.1MB

MD5
9360132c2ca6e068f3cfda5f7ec2e8b8

SHA1
b45ab5bb6561daecdb36e075ce15f765bf9b5cc0

SHA256
3c7480998ade344b74e956f7d3a3f1a989aaf43446163a62f0a8ed34b0c010d0

SHA512
4f8eb75b504c89e4b5b3fc7b55f21e8e85269ddb626fcecf2b101ba5fc563fe6e160c31e47444ea17328b2c13bf9a84e6be7b4d671b005c4ac2b6bf77c641002

Download Submit
memory/4416-141-0x0000000017170000-0x000000001722B000-memory.dmp

Filesize
748KB

Download
memory/4928-140-0x0000000017170000-0x0000000017487000-memory.dmp

Filesize
3.1MB

Download