blustealer | 0cd6df14b5d34f847a65f9f9ba0137472f684ff494084283f21bbd1e27bce4f2

General

Target

fatura6245683,pdf.exe
Size

299KB
MD5

f53b84d2b3d3488d56270d278bb3154e
SHA1

19fbce18907e7dcd0f6d064812e12abb7be38206
SHA256

0cd6df14b5d34f847a65f9f9ba0137472f684ff494084283f21bbd1e27bce4f2
SHA512

358375ea9a5b6cf3db8a83daf7a66855d47a13109bb03b6ba837b178af1d0a0c9837966d188f940d9ea642ba6063cf4e03f54319406785a2873b22d36f9d402a
SSDEEP

6144:QYa69gSECqpOY00S3J3xmX8bkkE+3G8c5J8FE:QYLgQqpOY00AJhTZ3G8cIFE

Score

10^/10

blustealer stormkitty collection persistence stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5468731092:AAGGNQWBVRhX622u6xp1moMhaunIGtXuIxg/sendMessage?chat_id=1639214896

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/1876-143-0x0000000000970000-0x000000000098A000-memory.dmp	family_stormkitty

Executes dropped EXE 2 IoCs

pid	Process
4312	ylswv.exe
4420	ylswv.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riumysnv = "C:\\Users\\Admin\\AppData\\Roaming\\oqntha\\eyodjcpwo.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ylswv.exe\" C:\\Users\\Admin\\AppData\\Local\\Tem"	ylswv.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4312 set thread context of 4420	4312	ylswv.exe	80
PID 4420 set thread context of 1876	4420	ylswv.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	AppLaunch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	AppLaunch.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4312	ylswv.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	AppLaunch.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4420	ylswv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 4312	1572	fatura6245683,pdf.exe	79
PID 1572 wrote to memory of 4312	1572	fatura6245683,pdf.exe	79
PID 1572 wrote to memory of 4312	1572	fatura6245683,pdf.exe	79
PID 4312 wrote to memory of 4420	4312	ylswv.exe	80
PID 4312 wrote to memory of 4420	4312	ylswv.exe	80
PID 4312 wrote to memory of 4420	4312	ylswv.exe	80
PID 4312 wrote to memory of 4420	4312	ylswv.exe	80
PID 4420 wrote to memory of 1876	4420	ylswv.exe	81
PID 4420 wrote to memory of 1876	4420	ylswv.exe	81
PID 4420 wrote to memory of 1876	4420	ylswv.exe	81
PID 4420 wrote to memory of 1876	4420	ylswv.exe	81
PID 4420 wrote to memory of 1876	4420	ylswv.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\fatura6245683,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\fatura6245683,pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Users\Admin\AppData\Local\Temp\ylswv.exe
  "C:\Users\Admin\AppData\Local\Temp\ylswv.exe" C:\Users\Admin\AppData\Local\Temp\gcjgqzirclb.ktp
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Users\Admin\AppData\Local\Temp\ylswv.exe
    "C:\Users\Admin\AppData\Local\Temp\ylswv.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      4⤵
      Accesses Microsoft Outlook profiles
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gcjgqzirclb.ktp

Filesize
7KB

MD5
172892505d62b8015ee94316b8e8706a

SHA1
2f4f34e5161daeb5bccbd19ca86080093f39b49e

SHA256
c2a2d1e8506743c7afb2ef28b1db287e625269f96eaaca2c156780b744663fce

SHA512
fde16359fdf1213e872e14f9566d62f3861cc1a20d209b546a2cfb0bdf6dd93e61426c85c546a4be5af736d349a803ef3a9afa98289d142930870db42d004d1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ufvhlc.lr

Filesize
156KB

MD5
45ff14b890885eeb66d721199850a975

SHA1
843e916d2f0cf574033b0a22ea326a1cd679472e

SHA256
b484e9da6f6cfb67ac6c4a328e25ba200b67c64f045944a6bdd5aac333631c08

SHA512
220e5c3d57a489e70702f5277e179aba1bb9cdf649e77f36ecf93aea574295914a8dbc0727855e32bc67c02c005b4fa56562ebfaf47d28bb50b025d98cb324b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ylswv.exe

Filesize
84KB

MD5
28294982f96a6e0c2e300b67f49cffe5

SHA1
39cb36ce11690f568153b60db47b17a6721a0535

SHA256
9cdf6e8db1c54da7f017678493ab05ddc92806514192f009bb417260449e5d95

SHA512
5cf11b46c8faa312f33cf906464384dfbe2c6d3fa35795f65f7075a2a9b677649a44d9945e6e06c83821b44b62a6290516d7e583c8e0ce717cb81387488b5a68

Download Submit
C:\Users\Admin\AppData\Local\Temp\ylswv.exe

Filesize
84KB

MD5
28294982f96a6e0c2e300b67f49cffe5

SHA1
39cb36ce11690f568153b60db47b17a6721a0535

SHA256
9cdf6e8db1c54da7f017678493ab05ddc92806514192f009bb417260449e5d95

SHA512
5cf11b46c8faa312f33cf906464384dfbe2c6d3fa35795f65f7075a2a9b677649a44d9945e6e06c83821b44b62a6290516d7e583c8e0ce717cb81387488b5a68

Download Submit
C:\Users\Admin\AppData\Local\Temp\ylswv.exe

Filesize
84KB

MD5
28294982f96a6e0c2e300b67f49cffe5

SHA1
39cb36ce11690f568153b60db47b17a6721a0535

SHA256
9cdf6e8db1c54da7f017678493ab05ddc92806514192f009bb417260449e5d95

SHA512
5cf11b46c8faa312f33cf906464384dfbe2c6d3fa35795f65f7075a2a9b677649a44d9945e6e06c83821b44b62a6290516d7e583c8e0ce717cb81387488b5a68

Download Submit
memory/1876-143-0x0000000000970000-0x000000000098A000-memory.dmp

Filesize
104KB

Download
memory/1876-144-0x0000000005250000-0x00000000052B6000-memory.dmp

Filesize
408KB

Download
memory/1876-145-0x0000000005CC0000-0x0000000005D5C000-memory.dmp

Filesize
624KB

Download
memory/4420-141-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4420-146-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing