Analysis
- max time kernel
122s - max time network
126s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system - submitted
27/01/2024, 10:45
Behavioral task
behavioral1
Sample
7a0723aff075673ef855b4e615207dfd.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
7a0723aff075673ef855b4e615207dfd.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
$TEMP/bibs_work/WMVCORE.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
$TEMP/bibs_work/WMVCORE.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target 7a0723aff075673ef855b4e615207dfd.exe
- Size 3.6MB
- Sample240127-mtn9rsccgl
- SHA256 3cc446d6a658ce7bdf67387d6df73888b2f5ea0a3955f2c11ebdeaec4d589517
- MD5 7a0723aff075673ef855b4e615207dfd
- SHA1 aa3c1654b4abefe9831f6b60866253b4b8436fe0
- SHA512 344444ca7d681f86f0707e5e788c7d20dadbcf8c69cc5afd8a5136e78848737003e5f8320356bd25d0773fb90e3ec0fe2c55d32e6923e43640b6ce204c4ade7c
- SSDEEP 98304:XTjwlh++gsHbQN/muXMxx2FKPv2QXMojZ5nYu3zSXYwREF0aQ:XTjKz7gF42kWQXMIjnYu+ow7J
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
bitrat
Version
-
1.38
C2
-
139.28.219.45:443
Attributes
-
communication_password
a76d949640a165da25ccfe9a8fd82c8a
-
tor_process
tor
Signatures
- Detect Blister loader x32 2 IoCs
resource yara_rule behavioral1/files/0x0008000000012281-1.dat family_blister_x32 behavioral1/memory/2484-3-0x000000002BD90000-0x000000002C26E000-memory.dmp family_blister_x32 - Loads dropped DLL 1 IoCs
pid Process 2484 7a0723aff075673ef855b4e615207dfd.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2772 WerFault.exe - Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 set thread context of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x0007000000015c9a-6.dat nsis_installer_1 behavioral1/files/0x0007000000015c9a-6.dat nsis_installer_2 - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2772 WerFault.exe Token: SeShutdownPrivilege 2772 WerFault.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29 PID 2484 wrote to memory of 2772 2484 7a0723aff075673ef855b4e615207dfd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a0723aff075673ef855b4e615207dfd.exe"C:\Users\Admin\AppData\Local\Temp\7a0723aff075673ef855b4e615207dfd.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\WerFault.exe"C:\Windows\System32\WerFault.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵PID:2392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Helps_Config\Helps_Config.exe
- Size 98KB
- SHA256 d3bd6d21538fc29c87bddddd5964a47eaab0d4792d8d7dc45391ce4c51ccc090
- MD5 20276b114ccaa585d544e73ad5589d32
- SHA1 1fade936ac52a5d41135926c572cbb19583e6233
- SHA512 24c51f3794ff1d0b76dae5495a3c45f875d490708bb6be098e1333076cebd3431e5ead867c2ebd054ae4e438c81b55b31ce35bcd21f95102d66d8442dad13972
- SSDEEP 1536:3HY0iClLsdSA5ppX0DkyecS9icaGbqGXSNG:XYrClLswbDkrcEaGbqGXiG
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\bibs_work\WMVCORE.DLL
- Size 4.9MB
- SHA256 8c981acb2673fa80fa39aa2ba9b1916cb9866b5e8f9ec1cc98bc7fed36b49c61
- MD5 88fba76c3a7eb0f785903de05fb0bd06
- SHA1 35f452a43a838cbad695d596b2cad144cc115074
- SHA512 f0bfb7e85de0834c3a3a8448ba4d218d28608b3634bed24590a30e91acb51632b01b09f3734547bca383c8d69a8e4c754337fa7d44a274c458fca04d21c29876
- SSDEEP 98304:LXIbjOdRTNhVNwb64wmsBtA8x2nKXp8SXUMjR7VOMRf2TYwTkZ0032:jI4T9N/esBO62KSSXU0FVOM8Uwz
- MD5 SHA1 SHA512 SSDEEP