blister | f9508e81f1ac31569646fde9e864e25212457ca62ac768e23fbb95c290950e99

Analysis

max time kernel
96s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2022 15:53

Target

a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe
Size

589KB
MD5

f89d5185c912436e7c2b0ff037b55b0e
SHA1

14da45680aa662216e87cc7d392cae8666c56cc9
SHA256

a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f
SHA512

726415ccbbfecd8c58de96b7782208aedabcde2e8fc0eed73b7dc4cba914b250d909cc6d95d2c164967e1cabf8e58b82f26cee1d5aafb9281b3ed6ac84702714
SSDEEP

12288:ijxthLTUxMF5Np0oLwEcMTXgdlGkPHQUoGDcm32W6G1Dv2G:uh3Ueb0cwxOEvF3r6w+G

Score

10^/10

blister loader

BLISTER
BLISTER is a downloader used to deliver other malware families.
loader blister

Detect Blister loader x64 2 IoCs

loader

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\wimgapi_64\wimgapi.exe	family_blister_x64
behavioral4/memory/2948-133-0x00007FFC3D900000-0x00007FFC3D9CA000-memory.dmp	family_blister_x64

Loads dropped DLL 1 IoCs

Processes:

a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe

pid process

2948 a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2948	a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe

C:\Users\Admin\AppData\Local\Temp\a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe
"C:\Users\Admin\AppData\Local\Temp\a69cf4fa61217f8230e032089a8f56f7ebf31e4cd35124e6ad104db86851f17f.exe"
1⤵
- Loads dropped DLL
PID:2948

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\wimgapi_64\wimgapi.exe

Filesize
791KB

MD5
c3fa9493f5bd07f9c506d250cfa54d4c

SHA1
6743bb204fc3004046ed8c7f4e8d9a921b3d568e

SHA256
d3d48aa32b062b6e767966a8bab354eded60e0a11be5bc5b7ad8329aa5718c76

SHA512
9d8114d194244da733adc69d7a9039ef44634a6eb54287ecd8bb05b98e9041bf415bcec5d1519c5894572942756994061e996e722fb97a059666f6dd46da0071

Download Submit
memory/2948-133-0x00007FFC3D900000-0x00007FFC3D9CA000-memory.dmp

Filesize
808KB

Download