blustealer | df8573405d1b9e0d3bbd88adf1f5db88f8ced9d603b78b41881bd50de1d26cc5

General

Target

fatura64383,pdf.exe
Size

377KB
MD5

83518d0443578cfc48983898d2d92ba5
SHA1

4e40ef75cfccf1c4bbb91835d80c700ab244703c
SHA256

df8573405d1b9e0d3bbd88adf1f5db88f8ced9d603b78b41881bd50de1d26cc5
SHA512

b66b9ffcd5f411f8c59dc3a0c55bb888ec76f3ce2885c9ea476ca36d79c6e42c66b4b343997bc9ff82ef391dda6671dc50d6c704558c8ee454a766a5893f5517
SSDEEP

6144:cYa6OHPGTjpoBdZfRq5D3IcW6BLs3EqKyFTlY7Y2s44Xb+It:cY8HPGpeVKW6BY3UyNlYb143

Score

10^/10

blustealer stormkitty collection persistence stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5468731092:AAGGNQWBVRhX622u6xp1moMhaunIGtXuIxg/sendMessage?chat_id=1639214896

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 4 IoCs

resource	yara_rule
behavioral1/memory/660-70-0x0000000000090000-0x00000000000AA000-memory.dmp	family_stormkitty
behavioral1/memory/660-71-0x00000000000A4F6E-mapping.dmp	family_stormkitty
behavioral1/memory/660-73-0x0000000000090000-0x00000000000AA000-memory.dmp	family_stormkitty
behavioral1/memory/660-75-0x0000000000090000-0x00000000000AA000-memory.dmp	family_stormkitty

Executes dropped EXE 2 IoCs

pid	Process
1372	asensdljsr.exe
944	asensdljsr.exe

Loads dropped DLL 2 IoCs

pid	Process
1260	fatura64383,pdf.exe
1372	asensdljsr.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\eolycfeiffxx = "C:\\Users\\Admin\\AppData\\Roaming\\nhvocoeqaoaiu\\npoasqwds.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\asensdljsr.exe\" C:\\Users\\Admin\\AppDa"	asensdljsr.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1372 set thread context of 944	1372	asensdljsr.exe	27
PID 944 set thread context of 660	944	asensdljsr.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	AppLaunch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	AppLaunch.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1372	asensdljsr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	660	AppLaunch.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
944	asensdljsr.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1372	1260	fatura64383,pdf.exe	26
PID 1260 wrote to memory of 1372	1260	fatura64383,pdf.exe	26
PID 1260 wrote to memory of 1372	1260	fatura64383,pdf.exe	26
PID 1260 wrote to memory of 1372	1260	fatura64383,pdf.exe	26
PID 1372 wrote to memory of 944	1372	asensdljsr.exe	27
PID 1372 wrote to memory of 944	1372	asensdljsr.exe	27
PID 1372 wrote to memory of 944	1372	asensdljsr.exe	27
PID 1372 wrote to memory of 944	1372	asensdljsr.exe	27
PID 1372 wrote to memory of 944	1372	asensdljsr.exe	27
PID 944 wrote to memory of 660	944	asensdljsr.exe	28
PID 944 wrote to memory of 660	944	asensdljsr.exe	28
PID 944 wrote to memory of 660	944	asensdljsr.exe	28
PID 944 wrote to memory of 660	944	asensdljsr.exe	28
PID 944 wrote to memory of 660	944	asensdljsr.exe	28
PID 944 wrote to memory of 660	944	asensdljsr.exe	28
PID 944 wrote to memory of 660	944	asensdljsr.exe	28
PID 944 wrote to memory of 660	944	asensdljsr.exe	28
PID 944 wrote to memory of 660	944	asensdljsr.exe	28

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\fatura64383,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\fatura64383,pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\asensdljsr.exe
  "C:\Users\Admin\AppData\Local\Temp\asensdljsr.exe" C:\Users\Admin\AppData\Local\Temp\veexlhucb.c
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Users\Admin\AppData\Local\Temp\asensdljsr.exe
    "C:\Users\Admin\AppData\Local\Temp\asensdljsr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      4⤵
      Accesses Microsoft Outlook profiles
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asensdljsr.exe

Filesize
88KB

MD5
0616739e6d7e8f4fe8d1c9b174683a25

SHA1
16215e3678adb65899fee5fcdedf84475726aa4c

SHA256
588c4a98b730ca6a52535b759997e427305ef4d55653dd25ebf517c24fd4b97e

SHA512
63786b1d1bfb781689bef795bbcf5ecad32ea75cb28202d3d36ae79f9d19dc61144b09a8dcc4d772c08ae7ca37fc77d376a5011c3a849db1f2eec85a4e099c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\asensdljsr.exe

Filesize
88KB

MD5
0616739e6d7e8f4fe8d1c9b174683a25

SHA1
16215e3678adb65899fee5fcdedf84475726aa4c

SHA256
588c4a98b730ca6a52535b759997e427305ef4d55653dd25ebf517c24fd4b97e

SHA512
63786b1d1bfb781689bef795bbcf5ecad32ea75cb28202d3d36ae79f9d19dc61144b09a8dcc4d772c08ae7ca37fc77d376a5011c3a849db1f2eec85a4e099c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\asensdljsr.exe

Filesize
88KB

MD5
0616739e6d7e8f4fe8d1c9b174683a25

SHA1
16215e3678adb65899fee5fcdedf84475726aa4c

SHA256
588c4a98b730ca6a52535b759997e427305ef4d55653dd25ebf517c24fd4b97e

SHA512
63786b1d1bfb781689bef795bbcf5ecad32ea75cb28202d3d36ae79f9d19dc61144b09a8dcc4d772c08ae7ca37fc77d376a5011c3a849db1f2eec85a4e099c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpnuyuunpw.nx

Filesize
156KB

MD5
7547424fbfd2ab9d8710f2f488f9e261

SHA1
70c6afbfaaf45aff3ad14de8abc2b2f5491c84c3

SHA256
8b1c5c1609a73f8de1f59ce98061897f2e12c7509a7cfc91193d1dca3458a120

SHA512
23c07122b8b602ec0b49f47d12c02b031adf86f036558bc3f0b78bee4a6929837f7e0394f2256b62b69346dda8e0cb8ecdbd5901d7ad97fa9254b800948a152f

Download Submit
C:\Users\Admin\AppData\Local\Temp\veexlhucb.c

Filesize
7KB

MD5
f71ed7fadf6f55671a80a94ac3d5a278

SHA1
8ceca930be43133a9f63ebdf7338ab438b9bb8ff

SHA256
edfa4b05c8d1b8e963c8ce8874878123bb3ef4cc4c413b148bd1ae5086fea57d

SHA512
1d3a13aecd1a41cbf6e5a67ff2498d6f5246410f84853959eb3cf1e89e6a3ee54adce656d7a99206dc7ba7c720cdac8d52c6bad19e1606b0c2485fb0eb9be508

Download Submit
\Users\Admin\AppData\Local\Temp\asensdljsr.exe

Filesize
88KB

MD5
0616739e6d7e8f4fe8d1c9b174683a25

SHA1
16215e3678adb65899fee5fcdedf84475726aa4c

SHA256
588c4a98b730ca6a52535b759997e427305ef4d55653dd25ebf517c24fd4b97e

SHA512
63786b1d1bfb781689bef795bbcf5ecad32ea75cb28202d3d36ae79f9d19dc61144b09a8dcc4d772c08ae7ca37fc77d376a5011c3a849db1f2eec85a4e099c27

Download Submit
\Users\Admin\AppData\Local\Temp\asensdljsr.exe

Filesize
88KB

MD5
0616739e6d7e8f4fe8d1c9b174683a25

SHA1
16215e3678adb65899fee5fcdedf84475726aa4c

SHA256
588c4a98b730ca6a52535b759997e427305ef4d55653dd25ebf517c24fd4b97e

SHA512
63786b1d1bfb781689bef795bbcf5ecad32ea75cb28202d3d36ae79f9d19dc61144b09a8dcc4d772c08ae7ca37fc77d376a5011c3a849db1f2eec85a4e099c27

Download Submit
memory/660-68-0x0000000000090000-0x00000000000AA000-memory.dmp

Filesize
104KB

Download
memory/660-70-0x0000000000090000-0x00000000000AA000-memory.dmp

Filesize
104KB

Download
memory/660-73-0x0000000000090000-0x00000000000AA000-memory.dmp

Filesize
104KB

Download
memory/660-75-0x0000000000090000-0x00000000000AA000-memory.dmp

Filesize
104KB

Download
memory/944-77-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/944-78-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1260-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing