blister | f9508e81f1ac31569646fde9e864e25212457ca62ac768e23fbb95c290950e99

Analysis

max time kernel
110s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2022 15:53

Target

ac89e5c3ba69bb41f4bb4bb7f7af39514b5a211ec6b641d45408777b30c75c5a.exe
Size

572KB
MD5

1ef4ef71230454934d759745e1e1240d
SHA1

774012f2dd2f71d58b94faa83292503710eeb49c
SHA256

ac89e5c3ba69bb41f4bb4bb7f7af39514b5a211ec6b641d45408777b30c75c5a
SHA512

3445eacec6afe88214aa936ace0adec541d80c216886f3c99aa1053031a5a2eb57068c5e073e720e6db17d74ab3479a1fa49eb08e9a33feb358c1180db953098
SSDEEP

12288:ojvtdyOr+WX4QbM9Vl9nlVgDlWkyRm30N9R:EjqAuy7ez

Score

10^/10

blister loader

BLISTER
BLISTER is a downloader used to deliver other malware families.
loader blister

Detect Blister loader x64 2 IoCs

loader

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\wimgapi_64\wimgapi.dll	family_blister_x64
behavioral10/memory/2404-133-0x00007FF844E50000-0x00007FF844F18000-memory.dmp	family_blister_x64

Loads dropped DLL 1 IoCs

Processes:

ac89e5c3ba69bb41f4bb4bb7f7af39514b5a211ec6b641d45408777b30c75c5a.exe

pid process

2404 ac89e5c3ba69bb41f4bb4bb7f7af39514b5a211ec6b641d45408777b30c75c5a.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2404	ac89e5c3ba69bb41f4bb4bb7f7af39514b5a211ec6b641d45408777b30c75c5a.exe

C:\Users\Admin\AppData\Local\Temp\ac89e5c3ba69bb41f4bb4bb7f7af39514b5a211ec6b641d45408777b30c75c5a.exe
"C:\Users\Admin\AppData\Local\Temp\ac89e5c3ba69bb41f4bb4bb7f7af39514b5a211ec6b641d45408777b30c75c5a.exe"
1⤵
- Loads dropped DLL
PID:2404

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\wimgapi_64\wimgapi.dll

Filesize
784KB

MD5
642aa70b188eb7e76273130246419f1d

SHA1
6f1ed28b7660af5bdf36b06cc47ac763a96b46b8

SHA256
8e6c0d338f201630b5c5ba4f1757e931bc065c49559c514658b4c2090a23e57b

SHA512
ae485df1909fb504ea627a529d8650cd4249a9997ead8409e041302102b0eb3605c33406f1166eda7a4e3ddb8ca8bca9cf3fc0492b1606b8ac1d50842c59b312

Download Submit
memory/2404-133-0x00007FF844E50000-0x00007FF844F18000-memory.dmp

Filesize
800KB

Download