blister | f9508e81f1ac31569646fde9e864e25212457ca62ac768e23fbb95c290950e99

Analysis

max time kernel
66s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-09-2022 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe
Size

589KB
MD5

f89d5185c912436e7c2b0ff037b55b0e
SHA1

14da45680aa662216e87cc7d392cae8666c56cc9
SHA256

a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f
SHA512

726415ccbbfecd8c58de96b7782208aedabcde2e8fc0eed73b7dc4cba914b250d909cc6d95d2c164967e1cabf8e58b82f26cee1d5aafb9281b3ed6ac84702714
SSDEEP

12288:ijxthLTUxMF5Np0oLwEcMTXgdlGkPHQUoGDcm32W6G1Dv2G:uh3Ueb0cwxOEvF3r6w+G

Score

10^/10

blister loader

Malware Config

Signatures

BLISTER
BLISTER is a downloader used to deliver other malware families.
loader blister

Detect Blister loader x64 2 IoCs

loader

resource	yara_rule
behavioral3/files/0x000b0000000122f1-55.dat	family_blister_x64
behavioral3/memory/2016-56-0x000007FEFB2D0000-0x000007FEFB39A000-memory.dmp	family_blister_x64

Loads dropped DLL 1 IoCs

pid	Process
2016	a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe
"C:\Users\Admin\AppData\Local\Temp\a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe"
1⤵
- Loads dropped DLL
PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\wimgapi_64\wimgapi.exe

Filesize
791KB

MD5
c3fa9493f5bd07f9c506d250cfa54d4c

SHA1
6743bb204fc3004046ed8c7f4e8d9a921b3d568e

SHA256
d3d48aa32b062b6e767966a8bab354eded60e0a11be5bc5b7ad8329aa5718c76

SHA512
9d8114d194244da733adc69d7a9039ef44634a6eb54287ecd8bb05b98e9041bf415bcec5d1519c5894572942756994061e996e722fb97a059666f6dd46da0071

Download Submit
memory/2016-54-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x000007FEFB2D0000-0x000007FEFB39A000-memory.dmp

Filesize
808KB

Download