Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2022 04:38
Static task
static1
Behavioral task
behavioral1
Sample
7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe
Resource
win10v2004-20221111-en
General
-
Target
7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe
-
Size
568KB
-
MD5
62d82f1dfb55dde5554c8b278a819ac9
-
SHA1
01e84f817807005f8d557d5320ddf9c366486620
-
SHA256
7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc
-
SHA512
e1e629f928a1596325af166a50248794d0a4c8129442b25dd514a5ec6e9eef39c1d8867db6f85a72ffd3f0aa349c28af7ff70dd58027f8a04e15a8cb491a1d54
-
SSDEEP
12288:M3Ih6jMEb6Qyxao8Fhyq+rqSAl4zXh2J3Fi7mX/IkQkk36EZd/gnS9ZviI:W9Jb6Q28Fu9AvPI2k71fB
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5373590229:AAH5_bJ0JuiFbSG6WQwntRz245ybC0mPk0/sendMessage?chat_id=2005009509
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/3920-145-0x0000000000760000-0x000000000077A000-memory.dmp family_stormkitty -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 29 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4892 set thread context of 3640 4892 7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe 89 PID 3640 set thread context of 3920 3640 MSBuild.exe 91 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4892 7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe 4892 7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4892 7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe Token: SeDebugPrivilege 3920 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3640 MSBuild.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4892 wrote to memory of 3468 4892 7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe 88 PID 4892 wrote to memory of 3468 4892 7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe 88 PID 4892 wrote to memory of 3468 4892 7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe 88 PID 4892 wrote to memory of 3640 4892 7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe 89 PID 4892 wrote to memory of 3640 4892 7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe 89 PID 4892 wrote to memory of 3640 4892 7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe 89 PID 4892 wrote to memory of 3640 4892 7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe 89 PID 4892 wrote to memory of 3640 4892 7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe 89 PID 4892 wrote to memory of 3640 4892 7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe 89 PID 4892 wrote to memory of 3640 4892 7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe 89 PID 4892 wrote to memory of 3640 4892 7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe 89 PID 3640 wrote to memory of 3920 3640 MSBuild.exe 91 PID 3640 wrote to memory of 3920 3640 MSBuild.exe 91 PID 3640 wrote to memory of 3920 3640 MSBuild.exe 91 PID 3640 wrote to memory of 3920 3640 MSBuild.exe 91 PID 3640 wrote to memory of 3920 3640 MSBuild.exe 91 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe"C:\Users\Admin\AppData\Local\Temp\7b968e65480e574dbf93ace25a28a30ca1f7b77fa98aabe980435484c365efbc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵PID:3468
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3920
-
-