blister | fbc0d088fd0e84edcd9685d3e62ac7c57d5abe98a04c09c6a6ec71e42d6024fd

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-09-2022 18:11

Target

fbc0d088fd0e84edcd9685d3e62ac7c57d5abe98a04c09c6a6ec71e42d6024fd.exe
Size

442KB
MD5

1fc1474748659cba880dd52ebc05fc5a
SHA1

3c43f5b327ee4d985ef39528d707cc2ceb97c86f
SHA256

fbc0d088fd0e84edcd9685d3e62ac7c57d5abe98a04c09c6a6ec71e42d6024fd
SHA512

8f9efa239e55c0261f5690481b8226b159f956aaca0d2b635be83bd09f4f28a31e9ba2f647aea0a2b8a65f293bc0747f5c9c954cfae6ef7ab3d29dbffc4441a2
SSDEEP

12288:dsOol4Xi9t0za9jFUA4lAk3H/+414qgUbNDx99H:dyxrvU3m414qgUj99H

Score

10^/10

blister loader

BLISTER
BLISTER is a downloader used to deliver other malware families.
loader blister

Detect Blister loader x64 2 IoCs

loader

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\sppcommdlg_64\sppcommdlg.dll	family_blister_x64
behavioral1/memory/992-56-0x000007FEFB290000-0x000007FEFB335000-memory.dmp	family_blister_x64

Loads dropped DLL 1 IoCs

Processes:

fbc0d088fd0e84edcd9685d3e62ac7c57d5abe98a04c09c6a6ec71e42d6024fd.exe

pid process

992 fbc0d088fd0e84edcd9685d3e62ac7c57d5abe98a04c09c6a6ec71e42d6024fd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
992	fbc0d088fd0e84edcd9685d3e62ac7c57d5abe98a04c09c6a6ec71e42d6024fd.exe

C:\Users\Admin\AppData\Local\Temp\fbc0d088fd0e84edcd9685d3e62ac7c57d5abe98a04c09c6a6ec71e42d6024fd.exe
"C:\Users\Admin\AppData\Local\Temp\fbc0d088fd0e84edcd9685d3e62ac7c57d5abe98a04c09c6a6ec71e42d6024fd.exe"
1⤵
- Loads dropped DLL
PID:992

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\sppcommdlg_64\sppcommdlg.dll

Filesize
645KB

MD5
3c5c693ba9b161fa1c1c67390ff22c96

SHA1
d829cc3b86c2238d1da3f5f0c07c13c5e7c5fcfc

SHA256
b062dd516cfa972993b6109e68a4a023ccc501c9613634468b2a5a508760873e

SHA512
3fa154a7b35a0187b854fc38825860cd259d294b0c9615b35a82293d52114163dcde02a8aafddde2144ef922b5dc064393ae835f184eadcc96d34b2119909e97

Download Submit
memory/992-54-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Filesize
8KB

Download
memory/992-56-0x000007FEFB290000-0x000007FEFB335000-memory.dmp

Filesize
660KB

Download