Analysis
-
max time kernel
125s -
max time network
63s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 06:38
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe
Resource
win10v2004-20220812-en
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe
-
Size
943KB
-
MD5
779aba07d9e38600f5d56b1cdb4b13b3
-
SHA1
978dbdd1de6938658fd2bb7fa62504bc9854e7df
-
SHA256
c6deef7825e9fc588ee77c25398896ac695e0c02c44276fc4382218807b01e17
-
SHA512
c1cb51a4be7c0c76b038aa22bdb3e171e7a07104ca87195f5dd854bfd56b48d101b630addce08d3bae5b86e6cf6ac82c5ce01cf0d2d1c8254b0f3e6c51a743ad
-
SSDEEP
12288:njm1ajgVIqHZCWRehw84H+ZzF0ImT9JfeDH8EM1xr:cajysjhw+MImTbfmrwxr
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5412597166:AAGUaWxuTxxhNb-NRhiURcTMzuW9nhGoEs/sendMessage?chat_id=932962718
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 4 IoCs
resource yara_rule behavioral1/memory/868-80-0x0000000000090000-0x00000000000AA000-memory.dmp family_stormkitty behavioral1/memory/868-81-0x00000000000A4F6E-mapping.dmp family_stormkitty behavioral1/memory/868-83-0x0000000000090000-0x00000000000AA000-memory.dmp family_stormkitty behavioral1/memory/868-85-0x0000000000090000-0x00000000000AA000-memory.dmp family_stormkitty -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1280 set thread context of 592 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 33 PID 592 set thread context of 868 592 RegSvcs.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1760 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 624 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 592 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe Token: SeDebugPrivilege 624 powershell.exe Token: SeDebugPrivilege 868 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 592 RegSvcs.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1280 wrote to memory of 624 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 28 PID 1280 wrote to memory of 624 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 28 PID 1280 wrote to memory of 624 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 28 PID 1280 wrote to memory of 624 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 28 PID 1280 wrote to memory of 1760 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 30 PID 1280 wrote to memory of 1760 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 30 PID 1280 wrote to memory of 1760 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 30 PID 1280 wrote to memory of 1760 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 30 PID 1280 wrote to memory of 904 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 32 PID 1280 wrote to memory of 904 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 32 PID 1280 wrote to memory of 904 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 32 PID 1280 wrote to memory of 904 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 32 PID 1280 wrote to memory of 904 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 32 PID 1280 wrote to memory of 904 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 32 PID 1280 wrote to memory of 904 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 32 PID 1280 wrote to memory of 592 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 33 PID 1280 wrote to memory of 592 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 33 PID 1280 wrote to memory of 592 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 33 PID 1280 wrote to memory of 592 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 33 PID 1280 wrote to memory of 592 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 33 PID 1280 wrote to memory of 592 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 33 PID 1280 wrote to memory of 592 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 33 PID 1280 wrote to memory of 592 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 33 PID 1280 wrote to memory of 592 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 33 PID 1280 wrote to memory of 592 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 33 PID 1280 wrote to memory of 592 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 33 PID 1280 wrote to memory of 592 1280 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 33 PID 592 wrote to memory of 868 592 RegSvcs.exe 34 PID 592 wrote to memory of 868 592 RegSvcs.exe 34 PID 592 wrote to memory of 868 592 RegSvcs.exe 34 PID 592 wrote to memory of 868 592 RegSvcs.exe 34 PID 592 wrote to memory of 868 592 RegSvcs.exe 34 PID 592 wrote to memory of 868 592 RegSvcs.exe 34 PID 592 wrote to memory of 868 592 RegSvcs.exe 34 PID 592 wrote to memory of 868 592 RegSvcs.exe 34 PID 592 wrote to memory of 868 592 RegSvcs.exe 34 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lOtOQV.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:624
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lOtOQV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8A46.tmp"2⤵
- Creates scheduled task(s)
PID:1760
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:904
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:868
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50114a3f68744cc8b05d1fa67fb62c9f5
SHA13f779d5f0d7d5622cb792181913fe9f075f01269
SHA25691cc2da060eebdce2bdb1f10313c283c609fad7e0017b63919fb4e0cfc647cbb
SHA512b079c533d1779d703584add24f39645f2bfb09b5837f3955a1734f7f33352aa3cadcba9e0176ff36a88c61c8c5c4e223b611e8881f0329720ebb527a70dd8e35