blustealer | 547e11f854149b57fd150f999595def28a46ce48d71b78dd3bf3310caeb18fdb

Analysis

max time kernel
146s
max time network
82s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-09-2022 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

903_RZ_2022 Souvenir.exe
Size

958KB
MD5

6b6257f6ce106df1b8bff72a80a07dd3
SHA1

f0d7b6d3e9c3ffc6e8fcf09deb748f6cd0e88f0a
SHA256

547e11f854149b57fd150f999595def28a46ce48d71b78dd3bf3310caeb18fdb
SHA512

1498e71938066081652d52894c8c81c93a19f63dd0ef982ffc5a45cb95df5a1df026ed365d25ca073effaac134d4797c585e6802b367148793fdc0084d98f866
SSDEEP

24576:/0EGAl/FZ2jn0mIRgPkQ1WkELViqPWlD:/0EflD2MUWkE1+D

Score

10^/10

blustealer stormkitty collection stealer

Malware Config

Extracted

Family

blustealer

https://api.telegram.org/bot5412597166:AAGUaWxuTxxhNb-NRhiURcTMzuW9nhGoEs/sendMessage?chat_id=932962718

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 4 IoCs

resource	yara_rule
behavioral1/memory/796-80-0x0000000000090000-0x00000000000AA000-memory.dmp	family_stormkitty
behavioral1/memory/796-81-0x00000000000A4F6E-mapping.dmp	family_stormkitty
behavioral1/memory/796-83-0x0000000000090000-0x00000000000AA000-memory.dmp	family_stormkitty
behavioral1/memory/796-85-0x0000000000090000-0x00000000000AA000-memory.dmp	family_stormkitty

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 472	1972	903_RZ_2022 Souvenir.exe	34
PID 472 set thread context of 796	472	903_RZ_2022 Souvenir.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	AppLaunch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1972	903_RZ_2022 Souvenir.exe
1972	903_RZ_2022 Souvenir.exe
1972	903_RZ_2022 Souvenir.exe
1972	903_RZ_2022 Souvenir.exe
1336	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
472	903_RZ_2022 Souvenir.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	903_RZ_2022 Souvenir.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeDebugPrivilege	796	AppLaunch.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
472	903_RZ_2022 Souvenir.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1336	1972	903_RZ_2022 Souvenir.exe	28
PID 1972 wrote to memory of 1336	1972	903_RZ_2022 Souvenir.exe	28
PID 1972 wrote to memory of 1336	1972	903_RZ_2022 Souvenir.exe	28
PID 1972 wrote to memory of 1336	1972	903_RZ_2022 Souvenir.exe	28
PID 1972 wrote to memory of 1588	1972	903_RZ_2022 Souvenir.exe	30
PID 1972 wrote to memory of 1588	1972	903_RZ_2022 Souvenir.exe	30
PID 1972 wrote to memory of 1588	1972	903_RZ_2022 Souvenir.exe	30
PID 1972 wrote to memory of 1588	1972	903_RZ_2022 Souvenir.exe	30
PID 1972 wrote to memory of 1272	1972	903_RZ_2022 Souvenir.exe	32
PID 1972 wrote to memory of 1272	1972	903_RZ_2022 Souvenir.exe	32
PID 1972 wrote to memory of 1272	1972	903_RZ_2022 Souvenir.exe	32
PID 1972 wrote to memory of 1272	1972	903_RZ_2022 Souvenir.exe	32
PID 1972 wrote to memory of 436	1972	903_RZ_2022 Souvenir.exe	33
PID 1972 wrote to memory of 436	1972	903_RZ_2022 Souvenir.exe	33
PID 1972 wrote to memory of 436	1972	903_RZ_2022 Souvenir.exe	33
PID 1972 wrote to memory of 436	1972	903_RZ_2022 Souvenir.exe	33
PID 1972 wrote to memory of 472	1972	903_RZ_2022 Souvenir.exe	34
PID 1972 wrote to memory of 472	1972	903_RZ_2022 Souvenir.exe	34
PID 1972 wrote to memory of 472	1972	903_RZ_2022 Souvenir.exe	34
PID 1972 wrote to memory of 472	1972	903_RZ_2022 Souvenir.exe	34
PID 1972 wrote to memory of 472	1972	903_RZ_2022 Souvenir.exe	34
PID 1972 wrote to memory of 472	1972	903_RZ_2022 Souvenir.exe	34
PID 1972 wrote to memory of 472	1972	903_RZ_2022 Souvenir.exe	34
PID 1972 wrote to memory of 472	1972	903_RZ_2022 Souvenir.exe	34
PID 1972 wrote to memory of 472	1972	903_RZ_2022 Souvenir.exe	34
PID 472 wrote to memory of 796	472	903_RZ_2022 Souvenir.exe	35
PID 472 wrote to memory of 796	472	903_RZ_2022 Souvenir.exe	35
PID 472 wrote to memory of 796	472	903_RZ_2022 Souvenir.exe	35
PID 472 wrote to memory of 796	472	903_RZ_2022 Souvenir.exe	35
PID 472 wrote to memory of 796	472	903_RZ_2022 Souvenir.exe	35
PID 472 wrote to memory of 796	472	903_RZ_2022 Souvenir.exe	35
PID 472 wrote to memory of 796	472	903_RZ_2022 Souvenir.exe	35
PID 472 wrote to memory of 796	472	903_RZ_2022 Souvenir.exe	35
PID 472 wrote to memory of 796	472	903_RZ_2022 Souvenir.exe	35

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\903_RZ_2022 Souvenir.exe
"C:\Users\Admin\AppData\Local\Temp\903_RZ_2022 Souvenir.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XCAuXmkvCKJ.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1336
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XCAuXmkvCKJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF45E.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1588
- C:\Users\Admin\AppData\Local\Temp\903_RZ_2022 Souvenir.exe
  "C:\Users\Admin\AppData\Local\Temp\903_RZ_2022 Souvenir.exe"
  2⤵
  PID:1272
- C:\Users\Admin\AppData\Local\Temp\903_RZ_2022 Souvenir.exe
  "C:\Users\Admin\AppData\Local\Temp\903_RZ_2022 Souvenir.exe"
  2⤵
  PID:436
- C:\Users\Admin\AppData\Local\Temp\903_RZ_2022 Souvenir.exe
  "C:\Users\Admin\AppData\Local\Temp\903_RZ_2022 Souvenir.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF45E.tmp

Filesize
1KB

MD5
22d5cb6b7e4c7eeb0e7b135f1ea78609

SHA1
2b021af886701aa8e0f90b8bfaba066b017a9deb

SHA256
9d78dacc337c59aa14b8f2df2890d6b9015d7f220e92fbdd5f0871372d17fc48

SHA512
13558929e2a114b1e27c6ddddbb94719780ca443146196500f61819c0ae4b22f4a6932b6fb51d6bf2618b5e346c772eba07831c622941d503a76205ded721278

Download Submit
memory/472-64-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/472-88-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/472-77-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/472-72-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/472-69-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/472-67-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/472-65-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/796-78-0x0000000000090000-0x00000000000AA000-memory.dmp

Filesize
104KB

Download
memory/796-85-0x0000000000090000-0x00000000000AA000-memory.dmp

Filesize
104KB

Download
memory/796-83-0x0000000000090000-0x00000000000AA000-memory.dmp

Filesize
104KB

Download
memory/796-80-0x0000000000090000-0x00000000000AA000-memory.dmp

Filesize
104KB

Download
memory/1336-87-0x000000006E760000-0x000000006ED0B000-memory.dmp

Filesize
5.7MB

Download
memory/1336-76-0x000000006E760000-0x000000006ED0B000-memory.dmp

Filesize
5.7MB

Download
memory/1972-58-0x0000000005F60000-0x000000000601C000-memory.dmp

Filesize
752KB

Download
memory/1972-54-0x00000000013D0000-0x00000000014C4000-memory.dmp

Filesize
976KB

Download
memory/1972-56-0x0000000000430000-0x0000000000444000-memory.dmp

Filesize
80KB

Download
memory/1972-57-0x0000000000440000-0x000000000044C000-memory.dmp

Filesize
48KB

Download
memory/1972-63-0x0000000008220000-0x0000000008288000-memory.dmp

Filesize
416KB

Download
memory/1972-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download