Analysis
-
max time kernel
88s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-10-2022 08:21
Static task
static1
Behavioral task
behavioral1
Sample
Adjunto comprobante de transferencia.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Adjunto comprobante de transferencia.exe
Resource
win10v2004-20220812-en
General
-
Target
Adjunto comprobante de transferencia.exe
-
Size
144KB
-
MD5
66cb0bdbdad8b6f432fec880e8f30139
-
SHA1
e0c501a8d1a6c85a5e534b83a52bc2feda43d6b5
-
SHA256
3dd0236bc47173fb5b7f6cddd06d5ca36bb00431f3eb0f4e641ac58e9244222e
-
SHA512
87d69debe9c7cea39fadfb021ab1688cf67d6340b6d0f658d1a42746a18b5e33f583f13312ced950d7da7bd7070db892db1b06756da17622fe2ab7d07601fd36
-
SSDEEP
3072:VcHL0ZrxLvY9i7NeKw4MNaCJYctsJVJRxODdIjGiC7okl4SA:KQfeBNNNKJV/xs9in
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5627356603:AAG-Mx0TbSHRRW6IwndrpX3VLZdhd6C-Zac/sendMessage?chat_id=5472437377
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 4 IoCs
resource yara_rule behavioral1/memory/1204-72-0x0000000000090000-0x00000000000AA000-memory.dmp family_stormkitty behavioral1/memory/1204-73-0x00000000000A4F6E-mapping.dmp family_stormkitty behavioral1/memory/1204-75-0x0000000000090000-0x00000000000AA000-memory.dmp family_stormkitty behavioral1/memory/1204-77-0x0000000000090000-0x00000000000AA000-memory.dmp family_stormkitty -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1680 set thread context of 1744 1680 Adjunto comprobante de transferencia.exe 28 PID 1744 set thread context of 1204 1744 Caspol.exe 29 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1204 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1744 Caspol.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1680 wrote to memory of 1744 1680 Adjunto comprobante de transferencia.exe 28 PID 1680 wrote to memory of 1744 1680 Adjunto comprobante de transferencia.exe 28 PID 1680 wrote to memory of 1744 1680 Adjunto comprobante de transferencia.exe 28 PID 1680 wrote to memory of 1744 1680 Adjunto comprobante de transferencia.exe 28 PID 1680 wrote to memory of 1744 1680 Adjunto comprobante de transferencia.exe 28 PID 1680 wrote to memory of 1744 1680 Adjunto comprobante de transferencia.exe 28 PID 1680 wrote to memory of 1744 1680 Adjunto comprobante de transferencia.exe 28 PID 1680 wrote to memory of 1744 1680 Adjunto comprobante de transferencia.exe 28 PID 1680 wrote to memory of 1744 1680 Adjunto comprobante de transferencia.exe 28 PID 1744 wrote to memory of 1204 1744 Caspol.exe 29 PID 1744 wrote to memory of 1204 1744 Caspol.exe 29 PID 1744 wrote to memory of 1204 1744 Caspol.exe 29 PID 1744 wrote to memory of 1204 1744 Caspol.exe 29 PID 1744 wrote to memory of 1204 1744 Caspol.exe 29 PID 1744 wrote to memory of 1204 1744 Caspol.exe 29 PID 1744 wrote to memory of 1204 1744 Caspol.exe 29 PID 1744 wrote to memory of 1204 1744 Caspol.exe 29 PID 1744 wrote to memory of 1204 1744 Caspol.exe 29 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Adjunto comprobante de transferencia.exe"C:\Users\Admin\AppData\Local\Temp\Adjunto comprobante de transferencia.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1204
-
-