blustealer | 16f2160476b2c78ec35b8fd9a4430b865cf3597c0da23795181196ea682f3df0

General

Target

Halkbank_Ekstre_20221230_114528_468568,PDF.exe
Size

415KB
MD5

dd57da0ba5835d49e8c85a41641c14b2
SHA1

8e823ca64e4f674953adbe045425f62f39955644
SHA256

16f2160476b2c78ec35b8fd9a4430b865cf3597c0da23795181196ea682f3df0
SHA512

368d505001ade291386265aa6fed0e7f6480174d3446232702174652c2fbfa1fe6906c4031efd5cc17f0330ecb38917ac95ad5a4d3b93f41453d183b3bb79602
SSDEEP

12288:yYxmJxRHHE6mRsc9gC8NLhPtD/fJomIA14mwQKEuaL2dZsLqrFNOA:yYtO/fJH4mBKmL2dtHb

Score

10^/10

blustealer stormkitty collection persistence stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5468731092:AAGGNQWBVRhX622u6xp1moMhaunIGtXuIxg/sendMessage?chat_id=1639214896

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 4 IoCs

resource	yara_rule
behavioral1/memory/1760-70-0x00000000001A0000-0x00000000001BA000-memory.dmp	family_stormkitty
behavioral1/memory/1760-71-0x00000000001B4F6E-mapping.dmp	family_stormkitty
behavioral1/memory/1760-73-0x00000000001A0000-0x00000000001BA000-memory.dmp	family_stormkitty
behavioral1/memory/1760-75-0x00000000001A0000-0x00000000001BA000-memory.dmp	family_stormkitty

Executes dropped EXE 2 IoCs

pid	Process
804	njujzs.exe
1124	njujzs.exe

Loads dropped DLL 2 IoCs

pid	Process
1280	Halkbank_Ekstre_20221230_114528_468568,PDF.exe
804	njujzs.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\kqvhvt = "C:\\Users\\Admin\\AppData\\Roaming\\kfxkqqisbptk\\fdoewhbuoylwh.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\njujzs.exe\" C:\\Users\\Admin\\AppDat"	njujzs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 804 set thread context of 1124	804	njujzs.exe	30
PID 1124 set thread context of 1760	1124	njujzs.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	AppLaunch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	AppLaunch.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
804	njujzs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	AppLaunch.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1124	njujzs.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 804	1280	Halkbank_Ekstre_20221230_114528_468568,PDF.exe	28
PID 1280 wrote to memory of 804	1280	Halkbank_Ekstre_20221230_114528_468568,PDF.exe	28
PID 1280 wrote to memory of 804	1280	Halkbank_Ekstre_20221230_114528_468568,PDF.exe	28
PID 1280 wrote to memory of 804	1280	Halkbank_Ekstre_20221230_114528_468568,PDF.exe	28
PID 804 wrote to memory of 1124	804	njujzs.exe	30
PID 804 wrote to memory of 1124	804	njujzs.exe	30
PID 804 wrote to memory of 1124	804	njujzs.exe	30
PID 804 wrote to memory of 1124	804	njujzs.exe	30
PID 804 wrote to memory of 1124	804	njujzs.exe	30
PID 1124 wrote to memory of 1760	1124	njujzs.exe	31
PID 1124 wrote to memory of 1760	1124	njujzs.exe	31
PID 1124 wrote to memory of 1760	1124	njujzs.exe	31
PID 1124 wrote to memory of 1760	1124	njujzs.exe	31
PID 1124 wrote to memory of 1760	1124	njujzs.exe	31
PID 1124 wrote to memory of 1760	1124	njujzs.exe	31
PID 1124 wrote to memory of 1760	1124	njujzs.exe	31
PID 1124 wrote to memory of 1760	1124	njujzs.exe	31
PID 1124 wrote to memory of 1760	1124	njujzs.exe	31

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20221230_114528_468568,PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20221230_114528_468568,PDF.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Local\Temp\njujzs.exe
  "C:\Users\Admin\AppData\Local\Temp\njujzs.exe" C:\Users\Admin\AppData\Local\Temp\rmdqhbe.yk
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Users\Admin\AppData\Local\Temp\njujzs.exe
    "C:\Users\Admin\AppData\Local\Temp\njujzs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      4⤵
      Accesses Microsoft Outlook profiles
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:1760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\njujzs.exe

Filesize
95KB

MD5
6bedd1849381be7520821c80ad790af9

SHA1
376794de15643277899d2872fb519ea53a7a36b8

SHA256
2e1ac21dce3010c92858e76393ca2488fad4896b4bd3521945f61062fd7bd71b

SHA512
78d584ea63273d0d3a34bbdc200cb3d464eff3eefba9ce0edcfb9dd46c97b5b846279874fc63479a0a7aa91fe953708348b48aa3c82bc18e3f2cae0f5dc907e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\njujzs.exe

Filesize
95KB

MD5
6bedd1849381be7520821c80ad790af9

SHA1
376794de15643277899d2872fb519ea53a7a36b8

SHA256
2e1ac21dce3010c92858e76393ca2488fad4896b4bd3521945f61062fd7bd71b

SHA512
78d584ea63273d0d3a34bbdc200cb3d464eff3eefba9ce0edcfb9dd46c97b5b846279874fc63479a0a7aa91fe953708348b48aa3c82bc18e3f2cae0f5dc907e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\njujzs.exe

Filesize
95KB

MD5
6bedd1849381be7520821c80ad790af9

SHA1
376794de15643277899d2872fb519ea53a7a36b8

SHA256
2e1ac21dce3010c92858e76393ca2488fad4896b4bd3521945f61062fd7bd71b

SHA512
78d584ea63273d0d3a34bbdc200cb3d464eff3eefba9ce0edcfb9dd46c97b5b846279874fc63479a0a7aa91fe953708348b48aa3c82bc18e3f2cae0f5dc907e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\pyuzwo.j

Filesize
156KB

MD5
c045a3912aca48a96a92468009b8ea72

SHA1
17a72cde28cbd888068b7e0ddc699a7330983296

SHA256
01fdc65386b7b50166ef2e6967e23acf414058c8ffc20012f059a5fa60abc31f

SHA512
390c5e1fe64228e62a5e243d7465275f4df359a99988746b523603027eaea7a2e67d1bf7e85d484bf185f34e88f4147f5e225a4f57431bfb8bf53401f97c1915

Download Submit
C:\Users\Admin\AppData\Local\Temp\rmdqhbe.yk

Filesize
7KB

MD5
1c3724de921fb39bbfd660f487c76877

SHA1
c991660ce88f417c36bef70d381e2b48a9157c73

SHA256
37c8b33fa13924c60eeb302d187badbe3b21589608d5eadb8050c88841cea4da

SHA512
5ba616c2696b251f1eeee1e4d19a0fa9586f21514df5d447cdedabb5e8179b5d9c6c71f9986477888979031e87bada4eaa9a542ec584b4fc5ab4033b1feacd6f

Download Submit
\Users\Admin\AppData\Local\Temp\njujzs.exe

Filesize
95KB

MD5
6bedd1849381be7520821c80ad790af9

SHA1
376794de15643277899d2872fb519ea53a7a36b8

SHA256
2e1ac21dce3010c92858e76393ca2488fad4896b4bd3521945f61062fd7bd71b

SHA512
78d584ea63273d0d3a34bbdc200cb3d464eff3eefba9ce0edcfb9dd46c97b5b846279874fc63479a0a7aa91fe953708348b48aa3c82bc18e3f2cae0f5dc907e3

Download Submit
\Users\Admin\AppData\Local\Temp\njujzs.exe

Filesize
95KB

MD5
6bedd1849381be7520821c80ad790af9

SHA1
376794de15643277899d2872fb519ea53a7a36b8

SHA256
2e1ac21dce3010c92858e76393ca2488fad4896b4bd3521945f61062fd7bd71b

SHA512
78d584ea63273d0d3a34bbdc200cb3d464eff3eefba9ce0edcfb9dd46c97b5b846279874fc63479a0a7aa91fe953708348b48aa3c82bc18e3f2cae0f5dc907e3

Download Submit
memory/1124-77-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1124-78-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1280-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/1760-68-0x00000000001A0000-0x00000000001BA000-memory.dmp

Filesize
104KB

Download
memory/1760-70-0x00000000001A0000-0x00000000001BA000-memory.dmp

Filesize
104KB

Download
memory/1760-73-0x00000000001A0000-0x00000000001BA000-memory.dmp

Filesize
104KB

Download
memory/1760-75-0x00000000001A0000-0x00000000001BA000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing