blihanstealer | a63a8b2cc66e20ceee31abc51cf4e4521c59a8b8e7f2b2b246741c0b69bae7a1

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2025, 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1 (197).exe
Size

54KB
MD5

4c4bd8320b656966d01874d3f8f89500
SHA1

6dcd7370f2d380f55b657bdd6ae5685a2c3bdb48
SHA256

a63a8b2cc66e20ceee31abc51cf4e4521c59a8b8e7f2b2b246741c0b69bae7a1
SHA512

cef0daa529ece6a062fd75004949e4c03de2690909033c5a1d09b11618c60f8cbe82595b1ec292c7853cf47a4b1a0e164d391dae17a90278948b4ea9be87fe69
SSDEEP

1536:e6q10k0EFjed6rqJ+6v8tvGE9UHrSdghj8bvHRIkhbUIchUh80mhDhNIhH+hjhUY:E1oEFlt6v8tvGE9UHrSdghj8bvHRIkhI

Score

10^/10

blihanstealer discovery persistence stealer trojan

Malware Config

Extracted

Family

blihanstealer

Mutex

pomdfghrt

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Signatures

BlihanStealer
Blihan is a stealer written in C++.
trojan stealer blihanstealer
Blihanstealer family
blihanstealer

Deletes itself 1 IoCs

pid	Process
3864	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
3864	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	1 (197).exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	1 (197).exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1 (197).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 3864	3232	1 (197).exe	88
PID 3232 wrote to memory of 3864	3232	1 (197).exe	88
PID 3232 wrote to memory of 3864	3232	1 (197).exe	88

C:\Users\Admin\AppData\Local\Temp\1 (197).exe
"C:\Users\Admin\AppData\Local\Temp\1 (197).exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
55KB

MD5
20401a50c5c69d6d2db514d63b11e021

SHA1
1a912ec9f9c9e23e63307aa02c6bc14d2fbb34bc

SHA256
e7e2178533d09657c41ae6fffc19491aff76a43bedc3ec0f988d7dad612457d2

SHA512
96404f5bc2be85dbec8228ea9a0e874085ba76382ea7015879acff1f3cd225ad75c70d8462cbcf1a536e40da45e7d41dcfdc94d3b66cc7079021379ef5828efd

Download Submit
memory/3232-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3232-5-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3864-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads