Analysis

  • max time kernel
    109s
  • max time network
    41s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    18-10-2022 19:16

General

  • Target

    Dekont.PDF.exe

  • Size

    1.3MB

  • MD5

    dd351940dad3168f60d1b3d7cd10347b

  • SHA1

    9cf4ff25559de1a6cbaeac06123abf04c2ec12b0

  • SHA256

    33f6177e2d98b8b7a93daed5f05883a111f706ed3bcba925c9740c4feac6111e

  • SHA512

    1cd9340b1ca9e5c460f69cda5410daa0a8791505b0367a0794b7f2f8fcd2a822d13574c0313fd1997525208a3af2a4e3a9a391d006e2576de13bd3792a78c8fa

  • SSDEEP

    24576:hExxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNusswO7Sayb:ualphF78zLyc/YFdj

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5310184325:AAFI3fSQ6VcGu_NSTmv7d-qK2WCVhYY_qfg/sendMessage?chat_id=1293496579

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gPgpDcrGk.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:952
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gPgpDcrGk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9F6C.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1704
    • C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe"
      2⤵
        PID:820
      • C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe
        "C:\Users\Admin\AppData\Local\Temp\Dekont.PDF.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1072
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          3⤵
          • Accesses Microsoft Outlook profiles
          • outlook_office_path
          • outlook_win_path
          PID:1728

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp9F6C.tmp

      Filesize

      1KB

      MD5

      d78306655c92759ef83f2793a56abe59

      SHA1

      dfc4d7ea955e51d5e74c546655f52827a71f507c

      SHA256

      fc6766a1bf6d5f6cfc7b79bc4e7f409d0827bac8a77276179256265c5361823d

      SHA512

      ff4b306141f1baa7c64732b9549395cb6633fe1e2a00e646fc90c1accaf6689ecaeac80625b2adf972f802698dde6c29cb4b9ac3fe820b82f2441ebb1dacf554

    • memory/952-77-0x0000000074E50000-0x00000000753FB000-memory.dmp

      Filesize

      5.7MB

    • memory/952-88-0x0000000074E50000-0x00000000753FB000-memory.dmp

      Filesize

      5.7MB

    • memory/1072-64-0x0000000000400000-0x000000000046E000-memory.dmp

      Filesize

      440KB

    • memory/1072-89-0x0000000000400000-0x000000000046E000-memory.dmp

      Filesize

      440KB

    • memory/1072-76-0x0000000000400000-0x000000000046E000-memory.dmp

      Filesize

      440KB

    • memory/1072-72-0x0000000000400000-0x000000000046E000-memory.dmp

      Filesize

      440KB

    • memory/1072-65-0x0000000000400000-0x000000000046E000-memory.dmp

      Filesize

      440KB

    • memory/1072-67-0x0000000000400000-0x000000000046E000-memory.dmp

      Filesize

      440KB

    • memory/1072-69-0x0000000000400000-0x000000000046E000-memory.dmp

      Filesize

      440KB

    • memory/1384-58-0x00000000063B0000-0x000000000647A000-memory.dmp

      Filesize

      808KB

    • memory/1384-63-0x000000000A9E0000-0x000000000AA54000-memory.dmp

      Filesize

      464KB

    • memory/1384-54-0x0000000001370000-0x00000000014BC000-memory.dmp

      Filesize

      1.3MB

    • memory/1384-57-0x0000000000610000-0x000000000061C000-memory.dmp

      Filesize

      48KB

    • memory/1384-56-0x00000000005F0000-0x0000000000608000-memory.dmp

      Filesize

      96KB

    • memory/1384-55-0x0000000076701000-0x0000000076703000-memory.dmp

      Filesize

      8KB

    • memory/1728-83-0x0000000000270000-0x00000000002D6000-memory.dmp

      Filesize

      408KB

    • memory/1728-85-0x0000000000270000-0x00000000002D6000-memory.dmp

      Filesize

      408KB

    • memory/1728-87-0x0000000004CB0000-0x0000000004D6C000-memory.dmp

      Filesize

      752KB

    • memory/1728-80-0x0000000000270000-0x00000000002D6000-memory.dmp

      Filesize

      408KB

    • memory/1728-78-0x0000000000270000-0x00000000002D6000-memory.dmp

      Filesize

      408KB