blister | f9508e81f1ac31569646fde9e864e25212457ca62ac768e23fbb95c290950e99

Analysis

max time kernel
66s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-09-2022 15:53

Target

a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe
Size

589KB
MD5

f89d5185c912436e7c2b0ff037b55b0e
SHA1

14da45680aa662216e87cc7d392cae8666c56cc9
SHA256

a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f
SHA512

726415ccbbfecd8c58de96b7782208aedabcde2e8fc0eed73b7dc4cba914b250d909cc6d95d2c164967e1cabf8e58b82f26cee1d5aafb9281b3ed6ac84702714
SSDEEP

12288:ijxthLTUxMF5Np0oLwEcMTXgdlGkPHQUoGDcm32W6G1Dv2G:uh3Ueb0cwxOEvF3r6w+G

Score

10^/10

blister loader

BLISTER
BLISTER is a downloader used to deliver other malware families.
loader blister

Detect Blister loader x64 2 IoCs

loader

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\wimgapi_64\wimgapi.exe	family_blister_x64
behavioral3/memory/2016-56-0x000007FEFB2D0000-0x000007FEFB39A000-memory.dmp	family_blister_x64

Loads dropped DLL 1 IoCs

Processes:

a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe

pid process

2016 a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2016	a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe

C:\Users\Admin\AppData\Local\Temp\a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe
"C:\Users\Admin\AppData\Local\Temp\a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe"
1⤵
- Loads dropped DLL
PID:2016

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\wimgapi_64\wimgapi.exe

Filesize
791KB

MD5
c3fa9493f5bd07f9c506d250cfa54d4c

SHA1
6743bb204fc3004046ed8c7f4e8d9a921b3d568e

SHA256
d3d48aa32b062b6e767966a8bab354eded60e0a11be5bc5b7ad8329aa5718c76

SHA512
9d8114d194244da733adc69d7a9039ef44634a6eb54287ecd8bb05b98e9041bf415bcec5d1519c5894572942756994061e996e722fb97a059666f6dd46da0071

Download Submit
memory/2016-54-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x000007FEFB2D0000-0x000007FEFB39A000-memory.dmp

Filesize
808KB

Download