Analysis
-
max time kernel
158s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 13:19
Static task
static1
Behavioral task
behavioral1
Sample
xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe
Resource
win10v2004-20220812-en
General
-
Target
xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe
-
Size
943KB
-
MD5
779aba07d9e38600f5d56b1cdb4b13b3
-
SHA1
978dbdd1de6938658fd2bb7fa62504bc9854e7df
-
SHA256
c6deef7825e9fc588ee77c25398896ac695e0c02c44276fc4382218807b01e17
-
SHA512
c1cb51a4be7c0c76b038aa22bdb3e171e7a07104ca87195f5dd854bfd56b48d101b630addce08d3bae5b86e6cf6ac82c5ce01cf0d2d1c8254b0f3e6c51a743ad
-
SSDEEP
12288:njm1ajgVIqHZCWRehw84H+ZzF0ImT9JfeDH8EM1xr:cajysjhw+MImTbfmrwxr
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5412597166:AAGUaWxuTxxhNb-NRhiURcTMzuW9nhGoEs/sendMessage?chat_id=932962718
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/3908-153-0x0000000000980000-0x000000000099A000-memory.dmp family_stormkitty -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 34 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4140 set thread context of 792 4140 xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe 88 PID 792 set thread context of 3908 792 RegSvcs.exe 89 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2024 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1216 powershell.exe 1216 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 792 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1216 powershell.exe Token: SeDebugPrivilege 3908 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 792 RegSvcs.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4140 wrote to memory of 1216 4140 xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe 84 PID 4140 wrote to memory of 1216 4140 xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe 84 PID 4140 wrote to memory of 1216 4140 xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe 84 PID 4140 wrote to memory of 2024 4140 xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe 86 PID 4140 wrote to memory of 2024 4140 xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe 86 PID 4140 wrote to memory of 2024 4140 xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe 86 PID 4140 wrote to memory of 792 4140 xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe 88 PID 4140 wrote to memory of 792 4140 xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe 88 PID 4140 wrote to memory of 792 4140 xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe 88 PID 4140 wrote to memory of 792 4140 xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe 88 PID 4140 wrote to memory of 792 4140 xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe 88 PID 4140 wrote to memory of 792 4140 xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe 88 PID 4140 wrote to memory of 792 4140 xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe 88 PID 4140 wrote to memory of 792 4140 xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe 88 PID 792 wrote to memory of 3908 792 RegSvcs.exe 89 PID 792 wrote to memory of 3908 792 RegSvcs.exe 89 PID 792 wrote to memory of 3908 792 RegSvcs.exe 89 PID 792 wrote to memory of 3908 792 RegSvcs.exe 89 PID 792 wrote to memory of 3908 792 RegSvcs.exe 89 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe"C:\Users\Admin\AppData\Local\Temp\xt7veCXp-FiO53wlOYiWrGleDALEQnb8Q4IhiAewHhc.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lOtOQV.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lOtOQV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB43C.tmp"2⤵
- Creates scheduled task(s)
PID:2024
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3908
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5101fdfc3cc667336114c755c1563295c
SHA1a12ad8607e96c67462308d078e227bba821bddd8
SHA256ab07337c190fa76a03d48aaf81ce537b7a5f44e9620117dae901c0c00b7dae48
SHA512f98877e4f7c39087d87cf6b97d5c9d4000a703f6d04b16f0fbe98b89b3a90638ee5f0b61753fb2e730b32754cdb0127874df4756f10908a37202f6f325627f3a