blister | f9508e81f1ac31569646fde9e864e25212457ca62ac768e23fbb95c290950e99

Analysis

max time kernel
162s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2022 15:53

Target

cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099.exe
Size

430KB
MD5

f380f09609171148b842223b439aad4c
SHA1

1cb9344fdbe5bc4830adb3fe36f71e0be3a5121f
SHA256

cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099
SHA512

abd83d2ee893f3a4bd05d76a2a73d7b01609bf3d5a415e29e93822d7ee0ff46c8844a642700121b852803458f3ced247233577072a4d8c2a377aec66b4879d86
SSDEEP

12288:dsOol4Xi9tQjNFrQ2RHJ2s843DdtCDVVscEfMDJ8t3+392Exh:dyxQjHHJ2s5BtYVnEfYM3eEExh

Score

10^/10

BLISTER
BLISTER is a downloader used to deliver other malware families.
loader blister
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Detect Blister loader x64 2 IoCs

loader

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\sppcommdlg_64\sppcommdlg.dll	family_blister_x64
behavioral32/memory/3216-133-0x00007FFDEFB80000-0x00007FFDEFC22000-memory.dmp	family_blister_x64

Loads dropped DLL 1 IoCs

Processes:

cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099.exe

pid process

3216 cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
3216	cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099.exe

C:\Users\Admin\AppData\Local\Temp\cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099.exe
"C:\Users\Admin\AppData\Local\Temp\cbc0718c3c45ed4311aec5f83572b7b92d364ab4d16bc43582e781843bdef099.exe"
1⤵
- Loads dropped DLL
PID:3216

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\sppcommdlg_64\sppcommdlg.dll

Filesize
633KB

MD5
229a758e232aeb49196c862655797e12

SHA1
73067102a6b37818f83121b9033087e291c667db

SHA256
49ba10b4264a68605d0b9ea7891b7078aeef4fa0a7b7831f2df6b600aae77776

SHA512
daf8f965e4f6f2b908c1dc104f4482412c6a972e58ee068774ca95f42a67ac5a91722909dd03b7101c0e4d5230befe6643c6d907d5170bf8321ab4960f3c0fae

Download Submit
memory/3216-133-0x00007FFDEFB80000-0x00007FFDEFC22000-memory.dmp

Filesize
648KB

Download
memory/3216-134-0x0000000002020000-0x0000000002061000-memory.dmp

Filesize
260KB

Download
memory/3216-137-0x0000000002020000-0x000000000204B000-memory.dmp

Filesize
172KB

Download
memory/3216-138-0x0000000002020000-0x000000000204B000-memory.dmp

Filesize
172KB

Download