blustealer | da74712fd5cd155ff0404941b52156174ba6a52d8044c32657fa24901ba8dd74

General

Target

hesaphareketi-01.exe
Size

304KB
MD5

437350bea5c6a15743708e40d626f6a2
SHA1

84bcc16bd74838d3103308d1c34cf86f5870f2ce
SHA256

da74712fd5cd155ff0404941b52156174ba6a52d8044c32657fa24901ba8dd74
SHA512

8202e803cd81867320d4555d097b11b569020bc14e45b165233d4e6cf7e07d34fb88daf18be7944a5c2295f6087c3cc8e18656d3e9a4d5a99b80ff829d9c189c
SSDEEP

6144:QYa69gSECqpOY0XngP6sW+/2zPELRV0nYvusV4Lh+FDciFq2FVIyMRX7J:QYLgQqpOY0XngPkLzAAnYvVV1DVNVIhX

Score

10^/10

blustealer stormkitty collection stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5468731092:AAGGNQWBVRhX622u6xp1moMhaunIGtXuIxg/sendMessage?chat_id=1639214896

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/956-143-0x00000000009D0000-0x00000000009EA000-memory.dmp	family_stormkitty

Executes dropped EXE 2 IoCs

pid	Process
5012	mxpuetljkl.exe
1428	mxpuetljkl.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5012 set thread context of 1428	5012	mxpuetljkl.exe	82
PID 1428 set thread context of 956	1428	mxpuetljkl.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	AppLaunch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	AppLaunch.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5012	mxpuetljkl.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	AppLaunch.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1428	mxpuetljkl.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 5012	812	hesaphareketi-01.exe	81
PID 812 wrote to memory of 5012	812	hesaphareketi-01.exe	81
PID 812 wrote to memory of 5012	812	hesaphareketi-01.exe	81
PID 5012 wrote to memory of 1428	5012	mxpuetljkl.exe	82
PID 5012 wrote to memory of 1428	5012	mxpuetljkl.exe	82
PID 5012 wrote to memory of 1428	5012	mxpuetljkl.exe	82
PID 5012 wrote to memory of 1428	5012	mxpuetljkl.exe	82
PID 1428 wrote to memory of 956	1428	mxpuetljkl.exe	83
PID 1428 wrote to memory of 956	1428	mxpuetljkl.exe	83
PID 1428 wrote to memory of 956	1428	mxpuetljkl.exe	83
PID 1428 wrote to memory of 956	1428	mxpuetljkl.exe	83
PID 1428 wrote to memory of 956	1428	mxpuetljkl.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe
"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Local\Temp\mxpuetljkl.exe
  "C:\Users\Admin\AppData\Local\Temp\mxpuetljkl.exe" C:\Users\Admin\AppData\Local\Temp\qhqhwg.d
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Users\Admin\AppData\Local\Temp\mxpuetljkl.exe
    "C:\Users\Admin\AppData\Local\Temp\mxpuetljkl.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      4⤵
      Accesses Microsoft Outlook profiles
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mxpuetljkl.exe

Filesize
99KB

MD5
285ff1b03012886ef1ef6584efbc0cba

SHA1
8c1e409b7e042515ca0d8f41ab0d4b70c615bf00

SHA256
f9984c39b846c01e616aa4ba885d0f4bf910726e3b455d720c3d80fac2df1140

SHA512
2840eb4acd049e7f17626acc6d55350b636652a20e40385104f695a57334b3cf9c5e06711ded658fe9754d2f33f4c14a89626e63e6f5363f7949e25f79553d7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\mxpuetljkl.exe

Filesize
99KB

MD5
285ff1b03012886ef1ef6584efbc0cba

SHA1
8c1e409b7e042515ca0d8f41ab0d4b70c615bf00

SHA256
f9984c39b846c01e616aa4ba885d0f4bf910726e3b455d720c3d80fac2df1140

SHA512
2840eb4acd049e7f17626acc6d55350b636652a20e40385104f695a57334b3cf9c5e06711ded658fe9754d2f33f4c14a89626e63e6f5363f7949e25f79553d7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\mxpuetljkl.exe

Filesize
99KB

MD5
285ff1b03012886ef1ef6584efbc0cba

SHA1
8c1e409b7e042515ca0d8f41ab0d4b70c615bf00

SHA256
f9984c39b846c01e616aa4ba885d0f4bf910726e3b455d720c3d80fac2df1140

SHA512
2840eb4acd049e7f17626acc6d55350b636652a20e40385104f695a57334b3cf9c5e06711ded658fe9754d2f33f4c14a89626e63e6f5363f7949e25f79553d7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\qhqhwg.d

Filesize
5KB

MD5
32e2bb3d700f3d0f602ee07e4f5e2985

SHA1
ce03af3a40af53ed5be5c58e1fb4bbf77d91c7ff

SHA256
92a0b3c1754da8273a49c44eb3fd3dc5d90d27203978d344eb3e412398a47b2f

SHA512
12f53ad57aa5f89b073102d233d2cd522e4f024d74157abb432302b54de7d7f1212fc5a0383968d38b09a1d1e8af00f7a472c605de1957c35faad2a924a180db

Download Submit
C:\Users\Admin\AppData\Local\Temp\wuonttwptxj.lm

Filesize
156KB

MD5
50fc6928badf9499f3d70e920c3ae5b3

SHA1
d6f9b6f1c68fa8938b6d2f979ec02078b969e160

SHA256
3b23a5db430003f3c3fc4ee7f3faf79eda3287b8e993293fc41dbd80667efb09

SHA512
30ca8f4b0062c6bdafae6341e039d6f6a926ed15e51b20080d85c6b63ce796c1aa31e5104650ef858ca42fe0ef42b0a7c9c821ac18397fad56d9ef8662801310

Download Submit
memory/956-143-0x00000000009D0000-0x00000000009EA000-memory.dmp

Filesize
104KB

Download
memory/956-144-0x0000000005260000-0x00000000052C6000-memory.dmp

Filesize
408KB

Download
memory/956-145-0x0000000005C00000-0x0000000005C9C000-memory.dmp

Filesize
624KB

Download
memory/1428-141-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1428-146-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing