Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2022 08:21
Static task
static1
Behavioral task
behavioral1
Sample
Adjunto comprobante de transferencia.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Adjunto comprobante de transferencia.exe
Resource
win10v2004-20220812-en
General
-
Target
Adjunto comprobante de transferencia.exe
-
Size
144KB
-
MD5
66cb0bdbdad8b6f432fec880e8f30139
-
SHA1
e0c501a8d1a6c85a5e534b83a52bc2feda43d6b5
-
SHA256
3dd0236bc47173fb5b7f6cddd06d5ca36bb00431f3eb0f4e641ac58e9244222e
-
SHA512
87d69debe9c7cea39fadfb021ab1688cf67d6340b6d0f658d1a42746a18b5e33f583f13312ced950d7da7bd7070db892db1b06756da17622fe2ab7d07601fd36
-
SSDEEP
3072:VcHL0ZrxLvY9i7NeKw4MNaCJYctsJVJRxODdIjGiC7okl4SA:KQfeBNNNKJV/xs9in
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5627356603:AAG-Mx0TbSHRRW6IwndrpX3VLZdhd6C-Zac/sendMessage?chat_id=5472437377
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/4120-141-0x0000000000FD0000-0x0000000000FEA000-memory.dmp family_stormkitty -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3916 set thread context of 3768 3916 Adjunto comprobante de transferencia.exe 79 PID 3768 set thread context of 4120 3768 Caspol.exe 80 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4120 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3768 Caspol.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3916 wrote to memory of 3768 3916 Adjunto comprobante de transferencia.exe 79 PID 3916 wrote to memory of 3768 3916 Adjunto comprobante de transferencia.exe 79 PID 3916 wrote to memory of 3768 3916 Adjunto comprobante de transferencia.exe 79 PID 3916 wrote to memory of 3768 3916 Adjunto comprobante de transferencia.exe 79 PID 3916 wrote to memory of 3768 3916 Adjunto comprobante de transferencia.exe 79 PID 3916 wrote to memory of 3768 3916 Adjunto comprobante de transferencia.exe 79 PID 3916 wrote to memory of 3768 3916 Adjunto comprobante de transferencia.exe 79 PID 3916 wrote to memory of 3768 3916 Adjunto comprobante de transferencia.exe 79 PID 3768 wrote to memory of 4120 3768 Caspol.exe 80 PID 3768 wrote to memory of 4120 3768 Caspol.exe 80 PID 3768 wrote to memory of 4120 3768 Caspol.exe 80 PID 3768 wrote to memory of 4120 3768 Caspol.exe 80 PID 3768 wrote to memory of 4120 3768 Caspol.exe 80 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Adjunto comprobante de transferencia.exe"C:\Users\Admin\AppData\Local\Temp\Adjunto comprobante de transferencia.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4120
-
-