blister | f9508e81f1ac31569646fde9e864e25212457ca62ac768e23fbb95c290950e99

Analysis

max time kernel
144s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2022 15:53

Target

a783bb9eddc40876a80504615a40e65649b910eeb0b5041ca7e8635d39b1d209.exe
Size

3.0MB
MD5

40eb9bde74fea00ee1f2f4828c8045fe
SHA1

8937335e51134bfc44580b6d86036724898b0bcf
SHA256

a783bb9eddc40876a80504615a40e65649b910eeb0b5041ca7e8635d39b1d209
SHA512

4865780df2cb52df703619177b4d6dad357dc9eecd78941e2057b4e11c83498e9027691cfc3ed0b5c66bfbd83a7805536465836453bc39ac2c8b45f66231c201
SSDEEP

49152:t3XMPCONzTX+tH44VTZkMc+Jn/0IO2qaL+53OSlZyzpEf9041F+VmYo+9jX+jWkI:dCNNf6z8MHJ/0wi53DZUEfO41OmYoAj3

Score

10^/10

blister loader

BLISTER
BLISTER is a downloader used to deliver other malware families.
loader blister

Detect Blister loader x32 3 IoCs

loader

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\importmp\colorui.dll	family_blister_x32
C:\Users\Admin\AppData\Local\Temp\importmp\colorui.dll	family_blister_x32
behavioral8/memory/4676-136-0x0000000017170000-0x000000001748A000-memory.dmp	family_blister_x32

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4676 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
4676	rundll32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

a783bb9eddc40876a80504615a40e65649b910eeb0b5041ca7e8635d39b1d209.exeRundll32.exe

description	pid	process	target process
PID 3900 wrote to memory of 4692	3900	a783bb9eddc40876a80504615a40e65649b910eeb0b5041ca7e8635d39b1d209.exe	Rundll32.exe
PID 3900 wrote to memory of 4692	3900	a783bb9eddc40876a80504615a40e65649b910eeb0b5041ca7e8635d39b1d209.exe	Rundll32.exe
PID 4692 wrote to memory of 4676	4692	Rundll32.exe	rundll32.exe
PID 4692 wrote to memory of 4676	4692	Rundll32.exe	rundll32.exe
PID 4692 wrote to memory of 4676	4692	Rundll32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\a783bb9eddc40876a80504615a40e65649b910eeb0b5041ca7e8635d39b1d209.exe
"C:\Users\Admin\AppData\Local\Temp\a783bb9eddc40876a80504615a40e65649b910eeb0b5041ca7e8635d39b1d209.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\SYSTEM32\Rundll32.exe
  Rundll32.exe C:\Users\Admin\AppData\Local\Temp\importmp\colorui.dll,LaunchColorCpl
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SysWOW64\rundll32.exe
    Rundll32.exe C:\Users\Admin\AppData\Local\Temp\importmp\colorui.dll,LaunchColorCpl
    3⤵
    - Loads dropped DLL
    PID:4676

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\importmp\colorui.dll

Filesize
3.1MB

MD5
219bd69677c86db257153f2336373c92

SHA1
cd03f4cf4e8462fc78c545ef0d015e5fdb8ab625

SHA256
fe7357d48906b68f094a81d19cc0ff93f56cc40454ac5f00e2e2d9c8ccdbc388

SHA512
46a51c93aed073bc61d4db457ac54ead0eadd47394752b4ae66f7bfc648be5f517d6914c4c75052c7b2a6f688292cb932d454c8f76bd6729f414785ac160471f

Download Submit
C:\Users\Admin\AppData\Local\Temp\importmp\colorui.dll

Filesize
3.1MB

MD5
219bd69677c86db257153f2336373c92

SHA1
cd03f4cf4e8462fc78c545ef0d015e5fdb8ab625

SHA256
fe7357d48906b68f094a81d19cc0ff93f56cc40454ac5f00e2e2d9c8ccdbc388

SHA512
46a51c93aed073bc61d4db457ac54ead0eadd47394752b4ae66f7bfc648be5f517d6914c4c75052c7b2a6f688292cb932d454c8f76bd6729f414785ac160471f

Download Submit
memory/4676-134-0x0000000000000000-mapping.dmp

Download
memory/4676-136-0x0000000017170000-0x000000001748A000-memory.dmp

Filesize
3.1MB

Download
memory/4692-132-0x0000000000000000-mapping.dmp

Download