Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31-10-2022 07:59
Static task
static1
Behavioral task
behavioral1
Sample
hesaphareketi-01.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
hesaphareketi-01.exe
Resource
win10v2004-20220812-en
General
-
Target
hesaphareketi-01.exe
-
Size
25KB
-
MD5
aef764d141280332ade9518ffdcdcb98
-
SHA1
65d4f7cfcd3732a45312aa38e112513ef63a4c1f
-
SHA256
2aad22bee9e2bb4ef6370fde5e0a43b06e541235e314b5a4a52dfb8357d477c3
-
SHA512
802f9a05a2e39863a6ddf8e1f0eabdf4c7ccd2c94d52a08fac24e7a60721d95400801ed31eb72fcb6e2bd75981a797e67ce9ef84950ea65a02e8ce3a58662c70
-
SSDEEP
384:70EWl++F6Lv9OecKbgQBSsMcptYcFmVc03K:evsVvEsMotYcFmVc6K
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5412597166:AAGUaWxuTxxhNb-NRhiURcTMzuW9nhGoEs/sendMessage?chat_id=932962718
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/4332-6473-0x0000000000D80000-0x0000000000D9A000-memory.dmp family_stormkitty -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation hesaphareketi-01.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rdhaw = "\"C:\\Users\\Admin\\AppData\\Roaming\\Rafksgpgf\\Rdhaw.exe\"" hesaphareketi-01.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 40 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4948 set thread context of 1876 4948 hesaphareketi-01.exe 91 PID 1876 set thread context of 4332 1876 InstallUtil.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4520 powershell.exe 4520 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1876 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4948 hesaphareketi-01.exe Token: SeDebugPrivilege 4520 powershell.exe Token: SeDebugPrivilege 4332 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1876 InstallUtil.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4948 wrote to memory of 4520 4948 hesaphareketi-01.exe 83 PID 4948 wrote to memory of 4520 4948 hesaphareketi-01.exe 83 PID 4948 wrote to memory of 4520 4948 hesaphareketi-01.exe 83 PID 4948 wrote to memory of 1876 4948 hesaphareketi-01.exe 91 PID 4948 wrote to memory of 1876 4948 hesaphareketi-01.exe 91 PID 4948 wrote to memory of 1876 4948 hesaphareketi-01.exe 91 PID 4948 wrote to memory of 1876 4948 hesaphareketi-01.exe 91 PID 4948 wrote to memory of 1876 4948 hesaphareketi-01.exe 91 PID 4948 wrote to memory of 1876 4948 hesaphareketi-01.exe 91 PID 4948 wrote to memory of 1876 4948 hesaphareketi-01.exe 91 PID 4948 wrote to memory of 1876 4948 hesaphareketi-01.exe 91 PID 1876 wrote to memory of 4332 1876 InstallUtil.exe 92 PID 1876 wrote to memory of 4332 1876 InstallUtil.exe 92 PID 1876 wrote to memory of 4332 1876 InstallUtil.exe 92 PID 1876 wrote to memory of 4332 1876 InstallUtil.exe 92 PID 1876 wrote to memory of 4332 1876 InstallUtil.exe 92 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4332
-
-