Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2022 11:17
Static task
static1
Behavioral task
behavioral1
Sample
Dekont.PDF.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Dekont.PDF.exe
Resource
win10v2004-20220901-en
General
-
Target
Dekont.PDF.exe
-
Size
1.3MB
-
MD5
dd351940dad3168f60d1b3d7cd10347b
-
SHA1
9cf4ff25559de1a6cbaeac06123abf04c2ec12b0
-
SHA256
33f6177e2d98b8b7a93daed5f05883a111f706ed3bcba925c9740c4feac6111e
-
SHA512
1cd9340b1ca9e5c460f69cda5410daa0a8791505b0367a0794b7f2f8fcd2a822d13574c0313fd1997525208a3af2a4e3a9a391d006e2576de13bd3792a78c8fa
-
SSDEEP
24576:hExxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNusswO7Sayb:ualphF78zLyc/YFdj
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5310184325:AAFI3fSQ6VcGu_NSTmv7d-qK2WCVhYY_qfg/sendMessage?chat_id=1293496579
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Dekont.PDF.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1792 set thread context of 4784 1792 Dekont.PDF.exe 97 PID 4784 set thread context of 4640 4784 Dekont.PDF.exe 98 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3540 schtasks.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 38 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1792 Dekont.PDF.exe 2156 powershell.exe 1792 Dekont.PDF.exe 1792 Dekont.PDF.exe 1792 Dekont.PDF.exe 2156 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1792 Dekont.PDF.exe Token: SeDebugPrivilege 2156 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4784 Dekont.PDF.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1792 wrote to memory of 2156 1792 Dekont.PDF.exe 92 PID 1792 wrote to memory of 2156 1792 Dekont.PDF.exe 92 PID 1792 wrote to memory of 2156 1792 Dekont.PDF.exe 92 PID 1792 wrote to memory of 3540 1792 Dekont.PDF.exe 94 PID 1792 wrote to memory of 3540 1792 Dekont.PDF.exe 94 PID 1792 wrote to memory of 3540 1792 Dekont.PDF.exe 94 PID 1792 wrote to memory of 4700 1792 Dekont.PDF.exe 96 PID 1792 wrote to memory of 4700 1792 Dekont.PDF.exe 96 PID 1792 wrote to memory of 4700 1792 Dekont.PDF.exe 96 PID 1792 wrote to memory of 4784 1792 Dekont.PDF.exe 97 PID 1792 wrote to memory of 4784 1792 Dekont.PDF.exe 97 PID 1792 wrote to memory of 4784 1792 Dekont.PDF.exe 97 PID 1792 wrote to memory of 4784 1792 Dekont.PDF.exe 97 PID 1792 wrote to memory of 4784 1792 Dekont.PDF.exe 97 PID 1792 wrote to memory of 4784 1792 Dekont.PDF.exe 97 PID 1792 wrote to memory of 4784 1792 Dekont.PDF.exe 97 PID 1792 wrote to memory of 4784 1792 Dekont.PDF.exe 97 PID 4784 wrote to memory of 4640 4784 Dekont.PDF.exe 98 PID 4784 wrote to memory of 4640 4784 Dekont.PDF.exe 98 PID 4784 wrote to memory of 4640 4784 Dekont.PDF.exe 98 PID 4784 wrote to memory of 4640 4784 Dekont.PDF.exe 98 PID 4784 wrote to memory of 4640 4784 Dekont.PDF.exe 98 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gPgpDcrGk.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gPgpDcrGk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp666B.tmp"2⤵
- Creates scheduled task(s)
PID:3540
-
-
C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe"2⤵PID:4700
-
-
C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:4640
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD507f52e07bc9de82446beca23cf14599f
SHA19687d522950bbbabe740265f4643bc31950142ba
SHA25699b1fbf0fd3b2ee15e5c135c6a71d84058b11993f3a6c0f28fa77c0849ad6a47
SHA5125bd2d3c3ad327c7f36633c526be6cec5b611367bb96f3032c4d845cb9cbdc807680bff7c87d6ba9cfbae1a2f46758e1ca17e040bf195fb64e6dad82fafca2c15