blihanstealer | 7ae7c76c807897f840279daf35457e0c4551aca80c2dcd973a00c7c019007e85

Analysis

max time kernel
119s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2025, 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ae7c76c807897f840279daf35457e0c4551aca80c2dcd973a00c7c019007e85.exe
Size

60KB
MD5

c89913ce3320718fcfff0e3648366abd
SHA1

71ee2e96b066be1eee81563e41a80d7696331703
SHA256

7ae7c76c807897f840279daf35457e0c4551aca80c2dcd973a00c7c019007e85
SHA512

2912bbdca86385e572ef85584123a27da2e6ec1ba9c84b72af11051c2a00d1ace4532d38ce29680f3c32a27022555664a794a154cbb99341d364143e0657fb70
SSDEEP

1536:e6q10k0EFjed6rqJ+6vghzwYu7vih9GueIh9j2IoHAjU+Eh6IbIKv8hDhIykh4ha:E1oEFlt6vghzwYu7vih9GueIh9j2IoHB

Score

10^/10

blihanstealer discovery persistence stealer trojan

Malware Config

Extracted

Family

blihanstealer

Mutex

pomdfghrt

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Signatures

BlihanStealer
Blihan is a stealer written in C++.
trojan stealer blihanstealer
Blihanstealer family
blihanstealer

Deletes itself 1 IoCs

pid	Process
2680	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2680	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	7ae7c76c807897f840279daf35457e0c4551aca80c2dcd973a00c7c019007e85.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	7ae7c76c807897f840279daf35457e0c4551aca80c2dcd973a00c7c019007e85.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ae7c76c807897f840279daf35457e0c4551aca80c2dcd973a00c7c019007e85.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 2680	3828	7ae7c76c807897f840279daf35457e0c4551aca80c2dcd973a00c7c019007e85.exe	86
PID 3828 wrote to memory of 2680	3828	7ae7c76c807897f840279daf35457e0c4551aca80c2dcd973a00c7c019007e85.exe	86
PID 3828 wrote to memory of 2680	3828	7ae7c76c807897f840279daf35457e0c4551aca80c2dcd973a00c7c019007e85.exe	86

C:\Users\Admin\AppData\Local\Temp\7ae7c76c807897f840279daf35457e0c4551aca80c2dcd973a00c7c019007e85.exe
"C:\Users\Admin\AppData\Local\Temp\7ae7c76c807897f840279daf35457e0c4551aca80c2dcd973a00c7c019007e85.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
60KB

MD5
fbc5e8a5c7c42a30fcce67b405bd8cf4

SHA1
6e98edbacc4de7ad0f3bd61e8298aa9375b53cb7

SHA256
a4a88895ede7dee457726f2cfc365f323b4a8885c6a921de1d9bc766d6359cc5

SHA512
76b172c5375af42b4a6d7275b3a3c40377cd2c30e2b9a8100a6a4e5fc6c96b03133c65a3f8ace9fd7bf207909ad67d89598ff691b4c8e8f45ae77795663bc7b3

Download Submit
memory/2680-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3828-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3828-5-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads