blister | f9508e81f1ac31569646fde9e864e25212457ca62ac768e23fbb95c290950e99

Analysis

max time kernel
150s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2022 15:50

Target

4fe551bcea5e07879ec84a7f1cea1036cfd0a3b03151403542cab6bd8541f8e5.exe
Size

710KB
MD5

97784e623f9efc0ca6533245fc0fcf70
SHA1

8ced24f78ffe0a40d4f098e6cf409270795e3194
SHA256

4fe551bcea5e07879ec84a7f1cea1036cfd0a3b03151403542cab6bd8541f8e5
SHA512

20bc90e883737298925e2d34c24ed6072b11867764ce13f0bc616572a7a7247b2c27a02c17fb48d421120637c9ff10527bb4b65a0c82cffb7836be8392bbcb05
SSDEEP

12288:LsOol4XilY6i8PtMDx5c2cC2LLEHdXPOwzXlEr3Ou0AIy1QD+vnxfbNr+5C4/qeE:Ly3f91MDx5mTwfOwz2reuV91QWxm9/9O

Score

10^/10

blister loader

BLISTER
BLISTER is a downloader used to deliver other malware families.
loader blister

Detect Blister loader x32 3 IoCs

loader

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\guirtsframworks\Pasade.dll	family_blister_x32
C:\Users\Admin\AppData\Local\Temp\guirtsframworks\Pasade.dll	family_blister_x32
behavioral32/memory/2344-136-0x0000000017170000-0x0000000017245000-memory.dmp	family_blister_x32

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2344 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2344	rundll32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

4fe551bcea5e07879ec84a7f1cea1036cfd0a3b03151403542cab6bd8541f8e5.exeRundll32.exe

description	pid	process	target process
PID 3552 wrote to memory of 3340	3552	4fe551bcea5e07879ec84a7f1cea1036cfd0a3b03151403542cab6bd8541f8e5.exe	Rundll32.exe
PID 3552 wrote to memory of 3340	3552	4fe551bcea5e07879ec84a7f1cea1036cfd0a3b03151403542cab6bd8541f8e5.exe	Rundll32.exe
PID 3340 wrote to memory of 2344	3340	Rundll32.exe	rundll32.exe
PID 3340 wrote to memory of 2344	3340	Rundll32.exe	rundll32.exe
PID 3340 wrote to memory of 2344	3340	Rundll32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\4fe551bcea5e07879ec84a7f1cea1036cfd0a3b03151403542cab6bd8541f8e5.exe
"C:\Users\Admin\AppData\Local\Temp\4fe551bcea5e07879ec84a7f1cea1036cfd0a3b03151403542cab6bd8541f8e5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SYSTEM32\Rundll32.exe
  Rundll32.exe C:\Users\Admin\AppData\Local\Temp\guirtsframworks\Pasade.dll,LaunchColorCpl
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\SysWOW64\rundll32.exe
    Rundll32.exe C:\Users\Admin\AppData\Local\Temp\guirtsframworks\Pasade.dll,LaunchColorCpl
    3⤵
    - Loads dropped DLL
    PID:2344

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\guirtsframworks\Pasade.dll

Filesize
847KB

MD5
3c06be1ef63f32b72d5fb850ff2e1fd9

SHA1
b5c5b1bb2b47c6ed4ecbfaaa29eaea4a6c4b82a5

SHA256
f5104d0ead2f178711b1e23db3c16846de7d1a3ac04dbe09bacebb847775d76d

SHA512
45cad5db5b4eb3d0d1674e12be8c99733e335b990b3cef07e6b532f292e984bd87bc75a59b4d595732249031942e59a06b58d635cbd0a337a8913f5054edde2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\guirtsframworks\Pasade.dll

Filesize
847KB

MD5
3c06be1ef63f32b72d5fb850ff2e1fd9

SHA1
b5c5b1bb2b47c6ed4ecbfaaa29eaea4a6c4b82a5

SHA256
f5104d0ead2f178711b1e23db3c16846de7d1a3ac04dbe09bacebb847775d76d

SHA512
45cad5db5b4eb3d0d1674e12be8c99733e335b990b3cef07e6b532f292e984bd87bc75a59b4d595732249031942e59a06b58d635cbd0a337a8913f5054edde2d

Download Submit
memory/2344-134-0x0000000000000000-mapping.dmp

Download
memory/2344-136-0x0000000017170000-0x0000000017245000-memory.dmp

Filesize
852KB

Download
memory/3340-132-0x0000000000000000-mapping.dmp

Download