blustealer | 0cd6df14b5d34f847a65f9f9ba0137472f684ff494084283f21bbd1e27bce4f2

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2023, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fatura6245683,pdf.exe
Size 299KB
Sample230110-k96smsbc5w
SHA256 0cd6df14b5d34f847a65f9f9ba0137472f684ff494084283f21bbd1e27bce4f2
MD5 f53b84d2b3d3488d56270d278bb3154e
SHA1 19fbce18907e7dcd0f6d064812e12abb7be38206
SHA512 358375ea9a5b6cf3db8a83daf7a66855d47a13109bb03b6ba837b178af1d0a0c9837966d188f940d9ea642ba6063cf4e03f54319406785a2873b22d36f9d402a
SSDEEP 6144:QYa69gSECqpOY00S3J3xmX8bkkE+3G8c5J8FE:QYLgQqpOY00AJhTZ3G8cIFE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blustealer stormkitty collection persistence stealer

Malware Config

Extracted

Family

blustealer

https://api.telegram.org/bot5468731092:AAGGNQWBVRhX622u6xp1moMhaunIGtXuIxg/sendMessage?chat_id=1639214896

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/1876-143-0x0000000000970000-0x000000000098A000-memory.dmp	family_stormkitty

Executes dropped EXE 2 IoCs

pid	Process
4312	ylswv.exe
4420	ylswv.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riumysnv = "C:\\Users\\Admin\\AppData\\Roaming\\oqntha\\eyodjcpwo.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ylswv.exe\" C:\\Users\\Admin\\AppData\\Local\\Tem"	ylswv.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4312 set thread context of 4420	4312	ylswv.exe	80
PID 4420 set thread context of 1876	4420	ylswv.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	AppLaunch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	AppLaunch.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4312	ylswv.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	AppLaunch.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4420	ylswv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 4312	1572	fatura6245683,pdf.exe	79
PID 1572 wrote to memory of 4312	1572	fatura6245683,pdf.exe	79
PID 1572 wrote to memory of 4312	1572	fatura6245683,pdf.exe	79
PID 4312 wrote to memory of 4420	4312	ylswv.exe	80
PID 4312 wrote to memory of 4420	4312	ylswv.exe	80
PID 4312 wrote to memory of 4420	4312	ylswv.exe	80
PID 4312 wrote to memory of 4420	4312	ylswv.exe	80
PID 4420 wrote to memory of 1876	4420	ylswv.exe	81
PID 4420 wrote to memory of 1876	4420	ylswv.exe	81
PID 4420 wrote to memory of 1876	4420	ylswv.exe	81
PID 4420 wrote to memory of 1876	4420	ylswv.exe	81
PID 4420 wrote to memory of 1876	4420	ylswv.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\fatura6245683,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\fatura6245683,pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Users\Admin\AppData\Local\Temp\ylswv.exe
  "C:\Users\Admin\AppData\Local\Temp\ylswv.exe" C:\Users\Admin\AppData\Local\Temp\gcjgqzirclb.ktp
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Users\Admin\AppData\Local\Temp\ylswv.exe
    "C:\Users\Admin\AppData\Local\Temp\ylswv.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      4⤵
      Accesses Microsoft Outlook profiles
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gcjgqzirclb.ktp

Path C:\Users\Admin\AppData\Local\Temp\gcjgqzirclb.ktp
Size 7KB
SHA256 c2a2d1e8506743c7afb2ef28b1db287e625269f96eaaca2c156780b744663fce
MD5 172892505d62b8015ee94316b8e8706a
SHA1 2f4f34e5161daeb5bccbd19ca86080093f39b49e
SHA512 fde16359fdf1213e872e14f9566d62f3861cc1a20d209b546a2cfb0bdf6dd93e61426c85c546a4be5af736d349a803ef3a9afa98289d142930870db42d004d1c
SSDEEP 192:darcitQvArWiPvg6b9F+klyMsJGkw24i1D7:uCYrNPvg88JGk6ix7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ufvhlc.lr

Path C:\Users\Admin\AppData\Local\Temp\ufvhlc.lr
Size 156KB
SHA256 b484e9da6f6cfb67ac6c4a328e25ba200b67c64f045944a6bdd5aac333631c08
MD5 45ff14b890885eeb66d721199850a975
SHA1 843e916d2f0cf574033b0a22ea326a1cd679472e
SHA512 220e5c3d57a489e70702f5277e179aba1bb9cdf649e77f36ecf93aea574295914a8dbc0727855e32bc67c02c005b4fa56562ebfaf47d28bb50b025d98cb324b6
SSDEEP 3072:8f4M1etjmI2/MAejj9vNA6eqsBR/fpaVZh+o3Np46uQac:Y4M5+AejgNSyCXN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ylswv.exe

Path C:\Users\Admin\AppData\Local\Temp\ylswv.exe
Size 84KB
SHA256 9cdf6e8db1c54da7f017678493ab05ddc92806514192f009bb417260449e5d95
MD5 28294982f96a6e0c2e300b67f49cffe5
SHA1 39cb36ce11690f568153b60db47b17a6721a0535
SHA512 5cf11b46c8faa312f33cf906464384dfbe2c6d3fa35795f65f7075a2a9b677649a44d9945e6e06c83821b44b62a6290516d7e583c8e0ce717cb81387488b5a68
SSDEEP 1536:sv/Fb08hIFKD8jt+X5tNYgpWtEaXkNGw4vUODaB9cTryEDuubmfs7jzH:m08hqKiARlpWtEaXkNGBUODs+yEDXFjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ylswv.exe

Path C:\Users\Admin\AppData\Local\Temp\ylswv.exe
Size 84KB
SHA256 9cdf6e8db1c54da7f017678493ab05ddc92806514192f009bb417260449e5d95
MD5 28294982f96a6e0c2e300b67f49cffe5
SHA1 39cb36ce11690f568153b60db47b17a6721a0535
SHA512 5cf11b46c8faa312f33cf906464384dfbe2c6d3fa35795f65f7075a2a9b677649a44d9945e6e06c83821b44b62a6290516d7e583c8e0ce717cb81387488b5a68
SSDEEP 1536:sv/Fb08hIFKD8jt+X5tNYgpWtEaXkNGw4vUODaB9cTryEDuubmfs7jzH:m08hqKiARlpWtEaXkNGBUODs+yEDXFjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ylswv.exe

Path C:\Users\Admin\AppData\Local\Temp\ylswv.exe
Size 84KB
SHA256 9cdf6e8db1c54da7f017678493ab05ddc92806514192f009bb417260449e5d95
MD5 28294982f96a6e0c2e300b67f49cffe5
SHA1 39cb36ce11690f568153b60db47b17a6721a0535
SHA512 5cf11b46c8faa312f33cf906464384dfbe2c6d3fa35795f65f7075a2a9b677649a44d9945e6e06c83821b44b62a6290516d7e583c8e0ce717cb81387488b5a68
SSDEEP 1536:sv/Fb08hIFKD8jt+X5tNYgpWtEaXkNGw4vUODaB9cTryEDuubmfs7jzH:m08hqKiARlpWtEaXkNGBUODs+yEDXFjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1876-143-0x0000000000970000-0x000000000098A000-memory.dmp

Download

memory/1876-144-0x0000000005250000-0x00000000052B6000-memory.dmp

Download

memory/1876-145-0x0000000005CC0000-0x0000000005D5C000-memory.dmp

Download

memory/4420-141-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4420-146-0x0000000000400000-0x0000000000422000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads