blister | f9508e81f1ac31569646fde9e864e25212457ca62ac768e23fbb95c290950e99

Analysis

max time kernel
162s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2022 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099.exe
Size

430KB
MD5

f380f09609171148b842223b439aad4c
SHA1

1cb9344fdbe5bc4830adb3fe36f71e0be3a5121f
SHA256

cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099
SHA512

abd83d2ee893f3a4bd05d76a2a73d7b01609bf3d5a415e29e93822d7ee0ff46c8844a642700121b852803458f3ced247233577072a4d8c2a377aec66b4879d86
SSDEEP

12288:dsOol4Xi9tQjNFrQ2RHJ2s843DdtCDVVscEfMDJ8t3+392Exh:dyxQjHHJ2s5BtYVnEfYM3eEExh

Score

10^/10

blister cobaltstrike backdoor loader trojan

Malware Config

Signatures

BLISTER
BLISTER is a downloader used to deliver other malware families.
loader blister
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Detect Blister loader x64 2 IoCs

loader

resource	yara_rule
behavioral32/files/0x0008000000022f51-132.dat	family_blister_x64
behavioral32/memory/3216-133-0x00007FFDEFB80000-0x00007FFDEFC22000-memory.dmp	family_blister_x64

Loads dropped DLL 1 IoCs

pid	Process
3216	cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099.exe
"C:\Users\Admin\AppData\Local\Temp\cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099.exe"
1⤵
- Loads dropped DLL
PID:3216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sppcommdlg_64\sppcommdlg.dll

Filesize
633KB

MD5
229a758e232aeb49196c862655797e12

SHA1
73067102a6b37818f83121b9033087e291c667db

SHA256
49ba10b4264a68605d0b9ea7891b7078aeef4fa0a7b7831f2df6b600aae77776

SHA512
daf8f965e4f6f2b908c1dc104f4482412c6a972e58ee068774ca95f42a67ac5a91722909dd03b7101c0e4d5230befe6643c6d907d5170bf8321ab4960f3c0fae

Download Submit
memory/3216-133-0x00007FFDEFB80000-0x00007FFDEFC22000-memory.dmp

Filesize
648KB

Download
memory/3216-134-0x0000000002020000-0x0000000002061000-memory.dmp

Filesize
260KB

Download
memory/3216-137-0x0000000002020000-0x000000000204B000-memory.dmp

Filesize
172KB

Download
memory/3216-138-0x0000000002020000-0x000000000204B000-memory.dmp

Filesize
172KB

Download