Analysis
- max time kernel
144s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
27/01/2024, 10:45
Behavioral task
behavioral1
Sample
7a0723aff075673ef855b4e615207dfd.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
7a0723aff075673ef855b4e615207dfd.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
$TEMP/bibs_work/WMVCORE.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
$TEMP/bibs_work/WMVCORE.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target 7a0723aff075673ef855b4e615207dfd.exe
- Size 3.6MB
- Sample240127-mtn9rsccgl
- SHA256 3cc446d6a658ce7bdf67387d6df73888b2f5ea0a3955f2c11ebdeaec4d589517
- MD5 7a0723aff075673ef855b4e615207dfd
- SHA1 aa3c1654b4abefe9831f6b60866253b4b8436fe0
- SHA512 344444ca7d681f86f0707e5e788c7d20dadbcf8c69cc5afd8a5136e78848737003e5f8320356bd25d0773fb90e3ec0fe2c55d32e6923e43640b6ce204c4ade7c
- SSDEEP 98304:XTjwlh++gsHbQN/muXMxx2FKPv2QXMojZ5nYu3zSXYwREF0aQ:XTjKz7gF42kWQXMIjnYu+ow7J
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
bitrat
Version
-
1.38
C2
-
139.28.219.45:443
Attributes
-
communication_password
a76d949640a165da25ccfe9a8fd82c8a
-
tor_process
tor
Signatures
- Detect Blister loader x32 2 IoCs
resource yara_rule behavioral2/files/0x0006000000023228-1.dat family_blister_x32 behavioral2/memory/516-3-0x000000002BD90000-0x000000002C26E000-memory.dmp family_blister_x32 - Loads dropped DLL 1 IoCs
pid Process 516 7a0723aff075673ef855b4e615207dfd.exe - Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 set thread context of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x0009000000023136-6.dat nsis_installer_1 behavioral2/files/0x0009000000023136-6.dat nsis_installer_2 - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93 PID 516 wrote to memory of 2416 516 7a0723aff075673ef855b4e615207dfd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a0723aff075673ef855b4e615207dfd.exe"C:\Users\Admin\AppData\Local\Temp\7a0723aff075673ef855b4e615207dfd.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\SysWOW64\WerFault.exe"C:\Windows\System32\WerFault.exe"2⤵PID:2416
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵PID:4228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Helps_Config\Helps_Config.exe
- Size 465KB
- SHA256 adf148ebb5a4df7a218ca8f9177cf925af9b8c6e755023f28f76bf8c2b12dfcf
- MD5 f74e01041b9006a352a8a83e375c545a
- SHA1 1d4beff07f9dc403f0b28cfaed422a3bfbe76383
- SHA512 42f9ccf33c6a869c4eb5b146f0385ed85144cfc7d516b81d9c5bb2c299b40f2e9508336ffff42d264810a0164d9ad4fb1d77710df61fbbaa79f862c1623d6ddd
- SSDEEP 12288:Lk7i1nLwpSUYVJsm95Yt4K8K60NlioCNqiv1:wkESZVJsm9it4k60Nl5D+1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\bibs_work\WMVCORE.DLL
- Size 4.3MB
- SHA256 cb9d9f3dd26aea924de01b16dfe26377f16b09d178d85fbc32a7fcb40d221448
- MD5 2410eaa785604474e1035fa4840e2808
- SHA1 d554eaf5c91dfe3a5b072f3a7ffa57ed55ec60b1
- SHA512 d791de877c448376a346aa42363abbeb91258247269c1310553756257963df9e0ee111c738bb149c407e5587a44cc6544bebd558488feb6d99c5afef90a805b1
- SSDEEP 98304:LXIbjOdRTNhVNwb64wmsBtA8x2nKXp8SXUMjR7VOMRf20:jI4T9N/esBO62KSSXU0FVOM80
- MD5 SHA1 SHA512 SSDEEP