Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-10-2022 07:48

General

  • Target

    Dekont.PDF.exe

  • Size

    1.3MB

  • MD5

    8feabe088c948dc8f387c098e6840ed4

  • SHA1

    52522a7e7bae6061fc3b32ec3a25af902f164af8

  • SHA256

    8908acf28585acbad787f5b1fc7b53b99ca8fb7d03ef05cdb6cd436102fd82cc

  • SHA512

    593af500334afd603b4ab82d315362123000a078772a5f1f5dd5eb29aae39606eb87ef96cb9915bb243365c851de54646ffd81eff666b4277144184c008bef01

  • SSDEEP

    24576:br3xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNussBq5fr+:0qhrk1QmY9OrXS76Fdj

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5310184325:AAFI3fSQ6VcGu_NSTmv7d-qK2WCVhYY_qfg/sendMessage?chat_id=1293496579

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4916
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GuYxLKsycrfSBi.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:852
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GuYxLKsycrfSBi" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD8D.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1528
    • C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5092
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        3⤵
        • Accesses Microsoft Outlook profiles
        • outlook_office_path
        • outlook_win_path
        PID:928

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpD8D.tmp

    Filesize

    1KB

    MD5

    9ef83d5be86dc05966ceb8adf8b16f7a

    SHA1

    d6bea484192c5fba77797e826d0b031da58872ca

    SHA256

    95aa45973be63404e641611c1682a8665d7057135d49185bf11ecec76b03cbcf

    SHA512

    d59aefa9f11cb0def9c7bdc6a4f2ac4997edb976ff5756646798f29f099ed9e5a69bf18fe22cb8fb76477736c9889dfc7d102a222d4dfad686cad745f136658d

  • memory/852-156-0x0000000007360000-0x00000000079DA000-memory.dmp

    Filesize

    6.5MB

  • memory/852-142-0x0000000004B70000-0x0000000005198000-memory.dmp

    Filesize

    6.2MB

  • memory/852-151-0x0000000005A00000-0x0000000005A1E000-memory.dmp

    Filesize

    120KB

  • memory/852-149-0x0000000005350000-0x00000000053B6000-memory.dmp

    Filesize

    408KB

  • memory/852-164-0x0000000007040000-0x0000000007048000-memory.dmp

    Filesize

    32KB

  • memory/852-154-0x0000000071080000-0x00000000710CC000-memory.dmp

    Filesize

    304KB

  • memory/852-140-0x00000000020E0000-0x0000000002116000-memory.dmp

    Filesize

    216KB

  • memory/852-163-0x0000000007060000-0x000000000707A000-memory.dmp

    Filesize

    104KB

  • memory/852-155-0x00000000069A0000-0x00000000069BE000-memory.dmp

    Filesize

    120KB

  • memory/852-162-0x0000000006F50000-0x0000000006F5E000-memory.dmp

    Filesize

    56KB

  • memory/852-161-0x0000000006FA0000-0x0000000007036000-memory.dmp

    Filesize

    600KB

  • memory/852-160-0x0000000006D90000-0x0000000006D9A000-memory.dmp

    Filesize

    40KB

  • memory/852-148-0x0000000004A50000-0x0000000004A72000-memory.dmp

    Filesize

    136KB

  • memory/852-153-0x00000000069C0000-0x00000000069F2000-memory.dmp

    Filesize

    200KB

  • memory/852-157-0x0000000006D20000-0x0000000006D3A000-memory.dmp

    Filesize

    104KB

  • memory/928-159-0x0000000000F10000-0x0000000000F76000-memory.dmp

    Filesize

    408KB

  • memory/4916-133-0x0000000005D80000-0x0000000006324000-memory.dmp

    Filesize

    5.6MB

  • memory/4916-132-0x0000000000C10000-0x0000000000D5C000-memory.dmp

    Filesize

    1.3MB

  • memory/4916-135-0x00000000058C0000-0x00000000058CA000-memory.dmp

    Filesize

    40KB

  • memory/4916-134-0x0000000005710000-0x00000000057A2000-memory.dmp

    Filesize

    584KB

  • memory/4916-137-0x000000000C670000-0x000000000C6D6000-memory.dmp

    Filesize

    408KB

  • memory/4916-136-0x000000000C390000-0x000000000C42C000-memory.dmp

    Filesize

    624KB

  • memory/5092-152-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/5092-165-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/5092-146-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/5092-144-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB