Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-01-2023 07:28
Static task
static1
Behavioral task
behavioral1
Sample
TRANSFERIR COPIA_26-01-2023.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
TRANSFERIR COPIA_26-01-2023.exe
Resource
win10v2004-20221111-en
General
-
Target
TRANSFERIR COPIA_26-01-2023.exe
-
Size
124KB
-
MD5
6b6158281be7a4c6d27c26a19584a506
-
SHA1
642977b3de3a0d226859228dae11cb5d74ff0472
-
SHA256
d7cd5ce46ffb8abe6ee2cb0c2a9f6528d8121fb90bd4072e71cd901099885eb3
-
SHA512
ad9fda9a3a6f251f5bbfecf0a7b0aac322f9593e2ceca758aeaef42f651351ca0b77e346651f7b25cbfdb2d05b8fb1f7bb40e50bd7fbff78c4099c9905f8f506
-
SSDEEP
3072:hzVvRQ0DOtiT3VLK8LEN7m8lneeF1eujsqk7jx++eH6:hpJpOtQON7m8de6okkB++eH
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5627356603:AAG-Mx0TbSHRRW6IwndrpX3VLZdhd6C-Zac/sendMessage?chat_id=5472437377
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3452-143-0x0000000000B00000-0x0000000000B1A000-memory.dmp family_stormkitty -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
AppLaunch.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
TRANSFERIR COPIA_26-01-2023.exeCaspol.exedescription pid process target process PID 1052 set thread context of 384 1052 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 384 set thread context of 3452 384 Caspol.exe AppLaunch.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AppLaunch.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
TRANSFERIR COPIA_26-01-2023.exepid process 1052 TRANSFERIR COPIA_26-01-2023.exe 1052 TRANSFERIR COPIA_26-01-2023.exe 1052 TRANSFERIR COPIA_26-01-2023.exe 1052 TRANSFERIR COPIA_26-01-2023.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TRANSFERIR COPIA_26-01-2023.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 1052 TRANSFERIR COPIA_26-01-2023.exe Token: SeDebugPrivilege 3452 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Caspol.exepid process 384 Caspol.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
TRANSFERIR COPIA_26-01-2023.exeCaspol.exedescription pid process target process PID 1052 wrote to memory of 3068 1052 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 1052 wrote to memory of 3068 1052 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 1052 wrote to memory of 3068 1052 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 1052 wrote to memory of 3556 1052 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 1052 wrote to memory of 3556 1052 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 1052 wrote to memory of 3556 1052 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 1052 wrote to memory of 384 1052 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 1052 wrote to memory of 384 1052 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 1052 wrote to memory of 384 1052 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 1052 wrote to memory of 384 1052 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 1052 wrote to memory of 384 1052 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 1052 wrote to memory of 384 1052 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 1052 wrote to memory of 384 1052 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 1052 wrote to memory of 384 1052 TRANSFERIR COPIA_26-01-2023.exe Caspol.exe PID 384 wrote to memory of 3452 384 Caspol.exe AppLaunch.exe PID 384 wrote to memory of 3452 384 Caspol.exe AppLaunch.exe PID 384 wrote to memory of 3452 384 Caspol.exe AppLaunch.exe PID 384 wrote to memory of 3452 384 Caspol.exe AppLaunch.exe PID 384 wrote to memory of 3452 384 Caspol.exe AppLaunch.exe -
outlook_office_path 1 IoCs
Processes:
AppLaunch.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
Processes:
AppLaunch.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TRANSFERIR COPIA_26-01-2023.exe"C:\Users\Admin\AppData\Local\Temp\TRANSFERIR COPIA_26-01-2023.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/384-135-0x0000000000000000-mapping.dmp
-
memory/384-136-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/384-138-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/384-141-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/384-146-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1052-132-0x00000000008E0000-0x0000000000908000-memory.dmpFilesize
160KB
-
memory/3068-133-0x0000000000000000-mapping.dmp
-
memory/3452-142-0x0000000000000000-mapping.dmp
-
memory/3452-143-0x0000000000B00000-0x0000000000B1A000-memory.dmpFilesize
104KB
-
memory/3452-144-0x0000000005000000-0x0000000005066000-memory.dmpFilesize
408KB
-
memory/3452-145-0x0000000005A10000-0x0000000005AAC000-memory.dmpFilesize
624KB
-
memory/3556-134-0x0000000000000000-mapping.dmp