Analysis

  • max time kernel
    65s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    18-10-2022 07:48

General

  • Target

    Dekont.PDF.exe

  • Size

    1.3MB

  • MD5

    8feabe088c948dc8f387c098e6840ed4

  • SHA1

    52522a7e7bae6061fc3b32ec3a25af902f164af8

  • SHA256

    8908acf28585acbad787f5b1fc7b53b99ca8fb7d03ef05cdb6cd436102fd82cc

  • SHA512

    593af500334afd603b4ab82d315362123000a078772a5f1f5dd5eb29aae39606eb87ef96cb9915bb243365c851de54646ffd81eff666b4277144184c008bef01

  • SSDEEP

    24576:br3xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNussBq5fr+:0qhrk1QmY9OrXS76Fdj

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5310184325:AAFI3fSQ6VcGu_NSTmv7d-qK2WCVhYY_qfg/sendMessage?chat_id=1293496579

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GuYxLKsycrfSBi.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1424
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GuYxLKsycrfSBi" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAEB7.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1344
    • C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1936
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        3⤵
        • Accesses Microsoft Outlook profiles
        • outlook_office_path
        • outlook_win_path
        PID:872

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpAEB7.tmp

    Filesize

    1KB

    MD5

    df5b9e5d095db2b0c1e8ab07218dd6ff

    SHA1

    d85b421f6d489d7a34faee2b57f6586bff8e77fc

    SHA256

    b8189c4e4fa9bf5fcd452382cdc4bdc5046ae22238bab0263f8434a53b04a9e4

    SHA512

    41e355cda46b8630d82c6df5b36e797fbf1612f870c921cdc15ea06669231863b3c1f5359823bdb9887ef53da2206b3121aefa5cb86c298a380eb6867068aa95

  • memory/872-78-0x0000000000090000-0x00000000000F6000-memory.dmp

    Filesize

    408KB

  • memory/872-76-0x0000000000090000-0x00000000000F6000-memory.dmp

    Filesize

    408KB

  • memory/872-81-0x0000000000090000-0x00000000000F6000-memory.dmp

    Filesize

    408KB

  • memory/872-87-0x0000000000A10000-0x0000000000ACC000-memory.dmp

    Filesize

    752KB

  • memory/872-83-0x0000000000090000-0x00000000000F6000-memory.dmp

    Filesize

    408KB

  • memory/1048-57-0x0000000000600000-0x000000000060C000-memory.dmp

    Filesize

    48KB

  • memory/1048-63-0x000000000A860000-0x000000000A8D4000-memory.dmp

    Filesize

    464KB

  • memory/1048-54-0x0000000001160000-0x00000000012AC000-memory.dmp

    Filesize

    1.3MB

  • memory/1048-58-0x000000000A790000-0x000000000A85A000-memory.dmp

    Filesize

    808KB

  • memory/1048-56-0x0000000000650000-0x0000000000668000-memory.dmp

    Filesize

    96KB

  • memory/1048-55-0x0000000076171000-0x0000000076173000-memory.dmp

    Filesize

    8KB

  • memory/1424-86-0x000000006EEF0000-0x000000006F49B000-memory.dmp

    Filesize

    5.7MB

  • memory/1424-88-0x000000006EEF0000-0x000000006F49B000-memory.dmp

    Filesize

    5.7MB

  • memory/1936-72-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/1936-69-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/1936-67-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/1936-65-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/1936-64-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/1936-85-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/1936-89-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB