blister | f9508e81f1ac31569646fde9e864e25212457ca62ac768e23fbb95c290950e99

Analysis

max time kernel
28s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-09-2022 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb949ebe87c55c0ba6cf0525161e2e6670c1ae186ab83ce46047446e9753a926.exe
Size

1.2MB
MD5

755f50457416aeb7fee95a67abfea9fe
SHA1

c039362e891b01040c20e75e16b02169c512aebd
SHA256

cb949ebe87c55c0ba6cf0525161e2e6670c1ae186ab83ce46047446e9753a926
SHA512

323fb73160be9ecfba5518a11cd32c8bf863b0e4ba27800ca0e89af986e28231311c25cf547dca6dc12790c3f9fdd0ef39363a97b616e84e61d07230dbe5e028
SSDEEP

24576:jyr9LuOU3WK7/zMjWd/xlLbTkgS/rqk1E198I9yI1b:jA9L8n/zMjWd/xBTurqk1KxJ

Score

10^/10

blister loader

Malware Config

Signatures

BLISTER
BLISTER is a downloader used to deliver other malware families.
loader blister

Detect Blister loader x32 4 IoCs

loader

resource	yara_rule
behavioral29/files/0x00080000000142c0-56.dat	family_blister_x32
behavioral29/files/0x00080000000142c0-59.dat	family_blister_x32
behavioral29/files/0x00080000000142c0-60.dat	family_blister_x32
behavioral29/memory/552-61-0x0000000017170000-0x000000001728A000-memory.dmp	family_blister_x32

Loads dropped DLL 2 IoCs

pid	Process
552	rundll32.exe
552	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 268	1576	cb949ebe87c55c0ba6cf0525161e2e6670c1ae186ab83ce46047446e9753a926.exe	27
PID 1576 wrote to memory of 268	1576	cb949ebe87c55c0ba6cf0525161e2e6670c1ae186ab83ce46047446e9753a926.exe	27
PID 1576 wrote to memory of 268	1576	cb949ebe87c55c0ba6cf0525161e2e6670c1ae186ab83ce46047446e9753a926.exe	27
PID 268 wrote to memory of 552	268	Rundll32.exe	28
PID 268 wrote to memory of 552	268	Rundll32.exe	28
PID 268 wrote to memory of 552	268	Rundll32.exe	28
PID 268 wrote to memory of 552	268	Rundll32.exe	28
PID 268 wrote to memory of 552	268	Rundll32.exe	28
PID 268 wrote to memory of 552	268	Rundll32.exe	28
PID 268 wrote to memory of 552	268	Rundll32.exe	28

C:\Users\Admin\AppData\Local\Temp\cb949ebe87c55c0ba6cf0525161e2e6670c1ae186ab83ce46047446e9753a926.exe
"C:\Users\Admin\AppData\Local\Temp\cb949ebe87c55c0ba6cf0525161e2e6670c1ae186ab83ce46047446e9753a926.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\system32\Rundll32.exe
  Rundll32.exe C:\Users\Admin\AppData\Local\Temp\oarimgamings\holorui.dll,LaunchColorCpl
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\SysWOW64\rundll32.exe
    Rundll32.exe C:\Users\Admin\AppData\Local\Temp\oarimgamings\holorui.dll,LaunchColorCpl
    3⤵
    - Loads dropped DLL
    PID:552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\oarimgamings\holorui.dll

Filesize
1.1MB

MD5
365eed1bb1afdb4a31770850a1901341

SHA1
3b81f39cd1d5ff021a69e48d7842afba0414b26b

SHA256
ca09d9cd2f3cfcc06b33eff91d55602cb33a66ab3fd4f540b9212fce5ddae54a

SHA512
ee6c58c90bd4c872e028a0c8e73baa41fc76e757e7f6be68759098d460692e568f12dac89537e68a7e645a78333350e16a3ebc04cc3674dcb40590e52ce99c3f

Download Submit
\Users\Admin\AppData\Local\Temp\oarimgamings\holorui.dll

Filesize
1.1MB

MD5
365eed1bb1afdb4a31770850a1901341

SHA1
3b81f39cd1d5ff021a69e48d7842afba0414b26b

SHA256
ca09d9cd2f3cfcc06b33eff91d55602cb33a66ab3fd4f540b9212fce5ddae54a

SHA512
ee6c58c90bd4c872e028a0c8e73baa41fc76e757e7f6be68759098d460692e568f12dac89537e68a7e645a78333350e16a3ebc04cc3674dcb40590e52ce99c3f

Download Submit
\Users\Admin\AppData\Local\Temp\oarimgamings\holorui.dll

Filesize
1.1MB

MD5
365eed1bb1afdb4a31770850a1901341

SHA1
3b81f39cd1d5ff021a69e48d7842afba0414b26b

SHA256
ca09d9cd2f3cfcc06b33eff91d55602cb33a66ab3fd4f540b9212fce5ddae54a

SHA512
ee6c58c90bd4c872e028a0c8e73baa41fc76e757e7f6be68759098d460692e568f12dac89537e68a7e645a78333350e16a3ebc04cc3674dcb40590e52ce99c3f

Download Submit
memory/552-58-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/552-61-0x0000000017170000-0x000000001728A000-memory.dmp

Filesize
1.1MB

Download
memory/1576-54-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmp

Filesize
8KB

Download