blustealer | 101b3cc3a483b862054173d2c367eb0bcfb072e28687a7aa52914a43fb28aed4

General

Target

swift.img_20220930_011_001.exe
Size

744KB
MD5

c97c519b7b00a60d9dd9f8ced68c5c2b
SHA1

9bbd320ae5901ba787cb5ecef1d71bef332d3e66
SHA256

25c4ee0823873ad0e9fed128dcfb45ebb821fe7a17c396026b8d8be1c2400557
SHA512

b79135c8e231c89552e74002b2a3d8a0e3a247fc9607dbc7c2d4146fb6f6b3c3ddda2c5132bc41462e67bebf0d3c37dba6133b962831359e301ee3db44bc83a9
SSDEEP

12288:nu2iNq4nBuC43I3mQxtri2ti2NYl8so/PaSsiMWQunh3:u1lQ342QfrzYlsbFEa

Score

10^/10

blustealer stormkitty stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5732817033:AAFBYIIZmJ7NuvVwD7WRcbV9qwcOqT7RpwM/sendMessage?chat_id=1638137774

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 4 IoCs

resource	yara_rule
behavioral1/memory/1520-78-0x0000000000090000-0x00000000000AA000-memory.dmp	family_stormkitty
behavioral1/memory/1520-79-0x00000000000A4F6E-mapping.dmp	family_stormkitty
behavioral1/memory/1520-81-0x0000000000090000-0x00000000000AA000-memory.dmp	family_stormkitty
behavioral1/memory/1520-83-0x0000000000090000-0x00000000000AA000-memory.dmp	family_stormkitty

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 764	1488	swift.img_20220930_011_001.exe	30
PID 764 set thread context of 1520	764	swift.img_20220930_011_001.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1488	swift.img_20220930_011_001.exe
1488	swift.img_20220930_011_001.exe
1488	swift.img_20220930_011_001.exe
1488	swift.img_20220930_011_001.exe
1488	swift.img_20220930_011_001.exe
1488	swift.img_20220930_011_001.exe
1488	swift.img_20220930_011_001.exe
1488	swift.img_20220930_011_001.exe
1488	swift.img_20220930_011_001.exe
1488	swift.img_20220930_011_001.exe
1488	swift.img_20220930_011_001.exe
1488	swift.img_20220930_011_001.exe
1488	swift.img_20220930_011_001.exe
1488	swift.img_20220930_011_001.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	swift.img_20220930_011_001.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
764	swift.img_20220930_011_001.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1632	1488	swift.img_20220930_011_001.exe	26
PID 1488 wrote to memory of 1632	1488	swift.img_20220930_011_001.exe	26
PID 1488 wrote to memory of 1632	1488	swift.img_20220930_011_001.exe	26
PID 1488 wrote to memory of 1632	1488	swift.img_20220930_011_001.exe	26
PID 1488 wrote to memory of 1816	1488	swift.img_20220930_011_001.exe	28
PID 1488 wrote to memory of 1816	1488	swift.img_20220930_011_001.exe	28
PID 1488 wrote to memory of 1816	1488	swift.img_20220930_011_001.exe	28
PID 1488 wrote to memory of 1816	1488	swift.img_20220930_011_001.exe	28
PID 1488 wrote to memory of 764	1488	swift.img_20220930_011_001.exe	30
PID 1488 wrote to memory of 764	1488	swift.img_20220930_011_001.exe	30
PID 1488 wrote to memory of 764	1488	swift.img_20220930_011_001.exe	30
PID 1488 wrote to memory of 764	1488	swift.img_20220930_011_001.exe	30
PID 1488 wrote to memory of 764	1488	swift.img_20220930_011_001.exe	30
PID 1488 wrote to memory of 764	1488	swift.img_20220930_011_001.exe	30
PID 1488 wrote to memory of 764	1488	swift.img_20220930_011_001.exe	30
PID 1488 wrote to memory of 764	1488	swift.img_20220930_011_001.exe	30
PID 1488 wrote to memory of 764	1488	swift.img_20220930_011_001.exe	30
PID 764 wrote to memory of 1520	764	swift.img_20220930_011_001.exe	31
PID 764 wrote to memory of 1520	764	swift.img_20220930_011_001.exe	31
PID 764 wrote to memory of 1520	764	swift.img_20220930_011_001.exe	31
PID 764 wrote to memory of 1520	764	swift.img_20220930_011_001.exe	31
PID 764 wrote to memory of 1520	764	swift.img_20220930_011_001.exe	31
PID 764 wrote to memory of 1520	764	swift.img_20220930_011_001.exe	31
PID 764 wrote to memory of 1520	764	swift.img_20220930_011_001.exe	31
PID 764 wrote to memory of 1520	764	swift.img_20220930_011_001.exe	31
PID 764 wrote to memory of 1520	764	swift.img_20220930_011_001.exe	31

C:\Users\Admin\AppData\Local\Temp\swift.img_20220930_011_001.exe
"C:\Users\Admin\AppData\Local\Temp\swift.img_20220930_011_001.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qfnkeztGEzHx.exe"
  2⤵
  PID:1632
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qfnkeztGEzHx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC9D5.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1816
- C:\Users\Admin\AppData\Local\Temp\swift.img_20220930_011_001.exe
  "C:\Users\Admin\AppData\Local\Temp\swift.img_20220930_011_001.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    - Checks processor information in registry
    PID:1520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC9D5.tmp

Filesize
1KB

MD5
7b48743db5860407a331a9736483e8bd

SHA1
b5e4613162dc7be0a466c28505d70f3660d76851

SHA256
930f6228bbfd01452537c8c9212fa420dd28796b44df1ba8035a451c7ef8d365

SHA512
d43db101ad9b994199bdc3344cfa32aba22b94fdeded3e859cd5c5b2b37d8105b2c6820497b988d250255f4e0ea2f4eb08208c579385a90246ef243e21314f10

Download Submit
memory/764-64-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/764-69-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/764-72-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/764-67-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/764-85-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/764-65-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1488-57-0x0000000000330000-0x000000000033C000-memory.dmp

Filesize
48KB

Download
memory/1488-63-0x0000000004350000-0x000000000437A000-memory.dmp

Filesize
168KB

Download
memory/1488-54-0x0000000000DA0000-0x0000000000E60000-memory.dmp

Filesize
768KB

Download
memory/1488-58-0x0000000005320000-0x00000000053A2000-memory.dmp

Filesize
520KB

Download
memory/1488-56-0x0000000000320000-0x0000000000334000-memory.dmp

Filesize
80KB

Download
memory/1488-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1520-76-0x0000000000090000-0x00000000000AA000-memory.dmp

Filesize
104KB

Download
memory/1520-78-0x0000000000090000-0x00000000000AA000-memory.dmp

Filesize
104KB

Download
memory/1520-81-0x0000000000090000-0x00000000000AA000-memory.dmp

Filesize
104KB

Download
memory/1520-83-0x0000000000090000-0x00000000000AA000-memory.dmp

Filesize
104KB

Download
memory/1632-86-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads