Analysis
-
max time kernel
114s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-01-2023 07:28
Static task
static1
Behavioral task
behavioral1
Sample
TRANSFERIR COPIA_26-01-2023.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
TRANSFERIR COPIA_26-01-2023.exe
Resource
win10v2004-20221111-en
General
-
Target
TRANSFERIR COPIA_26-01-2023.exe
-
Size
124KB
-
MD5
6b6158281be7a4c6d27c26a19584a506
-
SHA1
642977b3de3a0d226859228dae11cb5d74ff0472
-
SHA256
d7cd5ce46ffb8abe6ee2cb0c2a9f6528d8121fb90bd4072e71cd901099885eb3
-
SHA512
ad9fda9a3a6f251f5bbfecf0a7b0aac322f9593e2ceca758aeaef42f651351ca0b77e346651f7b25cbfdb2d05b8fb1f7bb40e50bd7fbff78c4099c9905f8f506
-
SSDEEP
3072:hzVvRQ0DOtiT3VLK8LEN7m8lneeF1eujsqk7jx++eH6:hpJpOtQON7m8de6okkB++eH
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5627356603:AAG-Mx0TbSHRRW6IwndrpX3VLZdhd6C-Zac/sendMessage?chat_id=5472437377
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2024-69-0x0000000000090000-0x00000000000AA000-memory.dmp family_stormkitty behavioral1/memory/2024-70-0x00000000000A4F6E-mapping.dmp family_stormkitty behavioral1/memory/2024-72-0x0000000000090000-0x00000000000AA000-memory.dmp family_stormkitty behavioral1/memory/2024-74-0x0000000000090000-0x00000000000AA000-memory.dmp family_stormkitty -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
AppLaunch.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
TRANSFERIR COPIA_26-01-2023.exeCaspol.exedescription pid process target process PID 756 set thread context of 2040 756 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 2040 set thread context of 2024 2040 Caspol.exe AppLaunch.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AppLaunch.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2024 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Caspol.exepid process 2040 Caspol.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
TRANSFERIR COPIA_26-01-2023.exeCaspol.exedescription pid process target process PID 756 wrote to memory of 2040 756 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 756 wrote to memory of 2040 756 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 756 wrote to memory of 2040 756 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 756 wrote to memory of 2040 756 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 756 wrote to memory of 2040 756 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 756 wrote to memory of 2040 756 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 756 wrote to memory of 2040 756 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 756 wrote to memory of 2040 756 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 756 wrote to memory of 2040 756 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 2040 wrote to memory of 2024 2040 Caspol.exe AppLaunch.exe PID 2040 wrote to memory of 2024 2040 Caspol.exe AppLaunch.exe PID 2040 wrote to memory of 2024 2040 Caspol.exe AppLaunch.exe PID 2040 wrote to memory of 2024 2040 Caspol.exe AppLaunch.exe PID 2040 wrote to memory of 2024 2040 Caspol.exe AppLaunch.exe PID 2040 wrote to memory of 2024 2040 Caspol.exe AppLaunch.exe PID 2040 wrote to memory of 2024 2040 Caspol.exe AppLaunch.exe PID 2040 wrote to memory of 2024 2040 Caspol.exe AppLaunch.exe PID 2040 wrote to memory of 2024 2040 Caspol.exe AppLaunch.exe -
outlook_office_path 1 IoCs
Processes:
AppLaunch.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
Processes:
AppLaunch.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TRANSFERIR COPIA_26-01-2023.exe"C:\Users\Admin\AppData\Local\Temp\TRANSFERIR COPIA_26-01-2023.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/756-54-0x0000000000040000-0x0000000000068000-memory.dmpFilesize
160KB
-
memory/2024-67-0x0000000000090000-0x00000000000AA000-memory.dmpFilesize
104KB
-
memory/2024-74-0x0000000000090000-0x00000000000AA000-memory.dmpFilesize
104KB
-
memory/2024-72-0x0000000000090000-0x00000000000AA000-memory.dmpFilesize
104KB
-
memory/2024-70-0x00000000000A4F6E-mapping.dmp
-
memory/2024-69-0x0000000000090000-0x00000000000AA000-memory.dmpFilesize
104KB
-
memory/2040-58-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2040-66-0x0000000075ED1000-0x0000000075ED3000-memory.dmpFilesize
8KB
-
memory/2040-63-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2040-60-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2040-61-0x0000000000401B6C-mapping.dmp
-
memory/2040-56-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2040-55-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2040-76-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB