Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 06:38
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe
Resource
win10v2004-20220812-en
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe
-
Size
943KB
-
MD5
779aba07d9e38600f5d56b1cdb4b13b3
-
SHA1
978dbdd1de6938658fd2bb7fa62504bc9854e7df
-
SHA256
c6deef7825e9fc588ee77c25398896ac695e0c02c44276fc4382218807b01e17
-
SHA512
c1cb51a4be7c0c76b038aa22bdb3e171e7a07104ca87195f5dd854bfd56b48d101b630addce08d3bae5b86e6cf6ac82c5ce01cf0d2d1c8254b0f3e6c51a743ad
-
SSDEEP
12288:njm1ajgVIqHZCWRehw84H+ZzF0ImT9JfeDH8EM1xr:cajysjhw+MImTbfmrwxr
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5412597166:AAGUaWxuTxxhNb-NRhiURcTMzuW9nhGoEs/sendMessage?chat_id=932962718
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/4924-153-0x0000000000D00000-0x0000000000D1A000-memory.dmp family_stormkitty -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 29 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2540 set thread context of 444 2540 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 87 PID 444 set thread context of 4924 444 RegSvcs.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2640 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4760 powershell.exe 4760 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 444 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4760 powershell.exe Token: SeDebugPrivilege 4924 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 444 RegSvcs.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2540 wrote to memory of 4760 2540 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 83 PID 2540 wrote to memory of 4760 2540 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 83 PID 2540 wrote to memory of 4760 2540 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 83 PID 2540 wrote to memory of 2640 2540 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 85 PID 2540 wrote to memory of 2640 2540 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 85 PID 2540 wrote to memory of 2640 2540 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 85 PID 2540 wrote to memory of 444 2540 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 87 PID 2540 wrote to memory of 444 2540 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 87 PID 2540 wrote to memory of 444 2540 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 87 PID 2540 wrote to memory of 444 2540 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 87 PID 2540 wrote to memory of 444 2540 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 87 PID 2540 wrote to memory of 444 2540 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 87 PID 2540 wrote to memory of 444 2540 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 87 PID 2540 wrote to memory of 444 2540 SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe 87 PID 444 wrote to memory of 4924 444 RegSvcs.exe 88 PID 444 wrote to memory of 4924 444 RegSvcs.exe 88 PID 444 wrote to memory of 4924 444 RegSvcs.exe 88 PID 444 wrote to memory of 4924 444 RegSvcs.exe 88 PID 444 wrote to memory of 4924 444 RegSvcs.exe 88 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.16062.16220.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lOtOQV.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lOtOQV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp520.tmp"2⤵
- Creates scheduled task(s)
PID:2640
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4924
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5101fdfc3cc667336114c755c1563295c
SHA1a12ad8607e96c67462308d078e227bba821bddd8
SHA256ab07337c190fa76a03d48aaf81ce537b7a5f44e9620117dae901c0c00b7dae48
SHA512f98877e4f7c39087d87cf6b97d5c9d4000a703f6d04b16f0fbe98b89b3a90638ee5f0b61753fb2e730b32754cdb0127874df4756f10908a37202f6f325627f3a