blihanstealer | df065fb55986e8f2e154f8975db403e32599c34fe9bf33d983a84a54386fa775

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24/03/2025, 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df065fb55986e8f2e154f8975db403e32599c34fe9bf33d983a84a54386fa775.exe
Size

70KB
MD5

0a7d747bc5946ceed8e2bf030be530f0
SHA1

432d55be1439b53ad962ad13769375207255a52a
SHA256

df065fb55986e8f2e154f8975db403e32599c34fe9bf33d983a84a54386fa775
SHA512

b46fd4a491148509289b03dbb0214101ce1ccbcab9c946b4b1225ad69b7ff2b13948d568c1bd54ca6574b28d811e07d9c3f73591658b42934817d9a03cfbee79
SSDEEP

1536:e6q10k0EFjed6rqJ+6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrhQ:E1oEFlt6vghzwYu7vih9GueIh9j2IoHP

Score

10^/10

blihanstealer discovery persistence stealer trojan

Malware Config

Extracted

Family

blihanstealer

Mutex

pomdfghrt

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Signatures

BlihanStealer
Blihan is a stealer written in C++.
trojan stealer blihanstealer
Blihanstealer family
blihanstealer

Deletes itself 1 IoCs

pid	Process
2876	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2876	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	df065fb55986e8f2e154f8975db403e32599c34fe9bf33d983a84a54386fa775.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	df065fb55986e8f2e154f8975db403e32599c34fe9bf33d983a84a54386fa775.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df065fb55986e8f2e154f8975db403e32599c34fe9bf33d983a84a54386fa775.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2876	2776	df065fb55986e8f2e154f8975db403e32599c34fe9bf33d983a84a54386fa775.exe	30
PID 2776 wrote to memory of 2876	2776	df065fb55986e8f2e154f8975db403e32599c34fe9bf33d983a84a54386fa775.exe	30
PID 2776 wrote to memory of 2876	2776	df065fb55986e8f2e154f8975db403e32599c34fe9bf33d983a84a54386fa775.exe	30
PID 2776 wrote to memory of 2876	2776	df065fb55986e8f2e154f8975db403e32599c34fe9bf33d983a84a54386fa775.exe	30

C:\Users\Admin\AppData\Local\Temp\df065fb55986e8f2e154f8975db403e32599c34fe9bf33d983a84a54386fa775.exe
"C:\Users\Admin\AppData\Local\Temp\df065fb55986e8f2e154f8975db403e32599c34fe9bf33d983a84a54386fa775.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
71KB

MD5
fede5fbcdd1cb21d9e868583f95e07c1

SHA1
e4d1574709a158c4036d681bdb440eae76155ce0

SHA256
c6c3629d40c9b61904197f83359cb400a31fa42cc659ea63f98081f24eec95d9

SHA512
7dde751abb1dffbda5ddb3d12ac4601d3a613090c1dcf02c3b0e0cb709c3c8d511e57defb22447eb77ed00a5d2f1f085201958756fb319a57f2a212b163f9072

Download Submit
memory/2776-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2776-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2876-9-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2876-11-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads