Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
11-08-2023 09:01
Static task
static1
Behavioral task
behavioral1
Sample
hesaphareketi-01.pdf.bin.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
hesaphareketi-01.pdf.bin.exe
Resource
win10v2004-20230703-en
General
-
Target
hesaphareketi-01.pdf.bin.exe
-
Size
307KB
-
MD5
2c3fbb2cee9b79530534e53064ff68a2
-
SHA1
0f8a016173e7202ec2abe46ae038016fcd1b7742
-
SHA256
0107b32e98dba4ef3826e16bd3d5e03a8b277a5bfe9bd20c5ee110596cf00f07
-
SHA512
d605dcef74eba2509d171b7853b95595d2166f0001974d25716b52a790939e0b3b563efb14d336c6eefdf8adf52f3f4a56782eb037ec31f4d8c7515b0bfd78ec
-
SSDEEP
3072:CL36cR9EKJjjTeRVMHDAc2ik58O0uE9QoRsCm5ndL3qNP6q7DFfDnB7EsetTGK4E:D8JnTyKEuDvQoR/mrLqNSynyh+yWki
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5374342837:AAHF-c1HAIvNCdF89VuEdNggsL2YBlpgkSE/sendMessage?chat_id=2133303215
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/5072-148-0x0000000000C30000-0x0000000000C4A000-memory.dmp family_stormkitty -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3932 set thread context of 1076 3932 hesaphareketi-01.pdf.bin.exe 83 PID 1076 set thread context of 5072 1076 hesaphareketi-01.pdf.bin.exe 84 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5072 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1076 hesaphareketi-01.pdf.bin.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3932 wrote to memory of 1076 3932 hesaphareketi-01.pdf.bin.exe 83 PID 3932 wrote to memory of 1076 3932 hesaphareketi-01.pdf.bin.exe 83 PID 3932 wrote to memory of 1076 3932 hesaphareketi-01.pdf.bin.exe 83 PID 3932 wrote to memory of 1076 3932 hesaphareketi-01.pdf.bin.exe 83 PID 3932 wrote to memory of 1076 3932 hesaphareketi-01.pdf.bin.exe 83 PID 3932 wrote to memory of 1076 3932 hesaphareketi-01.pdf.bin.exe 83 PID 3932 wrote to memory of 1076 3932 hesaphareketi-01.pdf.bin.exe 83 PID 3932 wrote to memory of 1076 3932 hesaphareketi-01.pdf.bin.exe 83 PID 1076 wrote to memory of 5072 1076 hesaphareketi-01.pdf.bin.exe 84 PID 1076 wrote to memory of 5072 1076 hesaphareketi-01.pdf.bin.exe 84 PID 1076 wrote to memory of 5072 1076 hesaphareketi-01.pdf.bin.exe 84 PID 1076 wrote to memory of 5072 1076 hesaphareketi-01.pdf.bin.exe 84 PID 1076 wrote to memory of 5072 1076 hesaphareketi-01.pdf.bin.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.bin.exe"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.bin.exe"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.bin.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
-