Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-08-2023 09:01

General

  • Target

    hesaphareketi-01.pdf.bin.exe

  • Size

    307KB

  • MD5

    2c3fbb2cee9b79530534e53064ff68a2

  • SHA1

    0f8a016173e7202ec2abe46ae038016fcd1b7742

  • SHA256

    0107b32e98dba4ef3826e16bd3d5e03a8b277a5bfe9bd20c5ee110596cf00f07

  • SHA512

    d605dcef74eba2509d171b7853b95595d2166f0001974d25716b52a790939e0b3b563efb14d336c6eefdf8adf52f3f4a56782eb037ec31f4d8c7515b0bfd78ec

  • SSDEEP

    3072:CL36cR9EKJjjTeRVMHDAc2ik58O0uE9QoRsCm5ndL3qNP6q7DFfDnB7EsetTGK4E:D8JnTyKEuDvQoR/mrLqNSynyh+yWki

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5374342837:AAHF-c1HAIvNCdF89VuEdNggsL2YBlpgkSE/sendMessage?chat_id=2133303215

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.bin.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3932
    • C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.bin.exe
      "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.bin.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1076
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5072

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1076-141-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/1076-154-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/1076-144-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/3932-137-0x0000000004FF0000-0x0000000005000000-memory.dmp

    Filesize

    64KB

  • memory/3932-146-0x0000000074900000-0x00000000750B0000-memory.dmp

    Filesize

    7.7MB

  • memory/3932-138-0x0000000004F40000-0x0000000004FDC000-memory.dmp

    Filesize

    624KB

  • memory/3932-139-0x0000000005000000-0x0000000005076000-memory.dmp

    Filesize

    472KB

  • memory/3932-140-0x0000000004EC0000-0x0000000004EDE000-memory.dmp

    Filesize

    120KB

  • memory/3932-136-0x0000000004D90000-0x0000000004E22000-memory.dmp

    Filesize

    584KB

  • memory/3932-135-0x0000000005410000-0x00000000059B4000-memory.dmp

    Filesize

    5.6MB

  • memory/3932-133-0x0000000000330000-0x0000000000384000-memory.dmp

    Filesize

    336KB

  • memory/3932-134-0x0000000074900000-0x00000000750B0000-memory.dmp

    Filesize

    7.7MB

  • memory/5072-149-0x00000000050B0000-0x0000000005116000-memory.dmp

    Filesize

    408KB

  • memory/5072-150-0x0000000074270000-0x0000000074A20000-memory.dmp

    Filesize

    7.7MB

  • memory/5072-151-0x0000000005130000-0x0000000005140000-memory.dmp

    Filesize

    64KB

  • memory/5072-153-0x0000000074270000-0x0000000074A20000-memory.dmp

    Filesize

    7.7MB

  • memory/5072-148-0x0000000000C30000-0x0000000000C4A000-memory.dmp

    Filesize

    104KB