blihanstealer | e6bf88f91ff47501402f14c8de4ce45b8a3af61a66f69dee451f4d43c9c3704e

Analysis

max time kernel
120s
max time network
20s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24/03/2025, 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6bf88f91ff47501402f14c8de4ce45b8a3af61a66f69dee451f4d43c9c3704eN.exe
Size

60KB
MD5

a64a202f3ff2f7f50577e36751697540
SHA1

57ce839f3677088df359303924dee4c5fa2195c1
SHA256

e6bf88f91ff47501402f14c8de4ce45b8a3af61a66f69dee451f4d43c9c3704e
SHA512

07da542b0d039efb633712182ac1c143f9c575c74c3c82004bd2bbcfb03498ed3f7b74a01c318a81cef7d5612ce4a9579a5da1a89d9baa37d3e76dee98cb3841
SSDEEP

1536:e6q10k0EFjed6rqJ+6vghzwYu7vih9GueIh9j2IoHAjU+Eh6IbIKv8hDhIykh4h3:E1oEFlt6vghzwYu7vih9GueIh9j2IoHM

Score

10^/10

blihanstealer discovery persistence stealer trojan

Malware Config

Extracted

Family

blihanstealer

Mutex

pomdfghrt

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Signatures

BlihanStealer
Blihan is a stealer written in C++.
trojan stealer blihanstealer
Blihanstealer family
blihanstealer

Deletes itself 1 IoCs

pid	Process
1820	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
1820	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	e6bf88f91ff47501402f14c8de4ce45b8a3af61a66f69dee451f4d43c9c3704eN.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	e6bf88f91ff47501402f14c8de4ce45b8a3af61a66f69dee451f4d43c9c3704eN.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e6bf88f91ff47501402f14c8de4ce45b8a3af61a66f69dee451f4d43c9c3704eN.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1820	2132	e6bf88f91ff47501402f14c8de4ce45b8a3af61a66f69dee451f4d43c9c3704eN.exe	30
PID 2132 wrote to memory of 1820	2132	e6bf88f91ff47501402f14c8de4ce45b8a3af61a66f69dee451f4d43c9c3704eN.exe	30
PID 2132 wrote to memory of 1820	2132	e6bf88f91ff47501402f14c8de4ce45b8a3af61a66f69dee451f4d43c9c3704eN.exe	30
PID 2132 wrote to memory of 1820	2132	e6bf88f91ff47501402f14c8de4ce45b8a3af61a66f69dee451f4d43c9c3704eN.exe	30

C:\Users\Admin\AppData\Local\Temp\e6bf88f91ff47501402f14c8de4ce45b8a3af61a66f69dee451f4d43c9c3704eN.exe
"C:\Users\Admin\AppData\Local\Temp\e6bf88f91ff47501402f14c8de4ce45b8a3af61a66f69dee451f4d43c9c3704eN.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
60KB

MD5
be1f7252f75bca9cc77b54bb1aed1c99

SHA1
1875d8347b66eb73e9a8ff62739a902d508d27e8

SHA256
ce353f78a26f9f2a1f2b8c7298334dee3fa8f1f717ba3ef6aaffe34f32925feb

SHA512
0501433ef433b09c2293e22fabf6fd6319a8bbb2bc7775ca6ae813437cfa8bef1f621bedc3344a0beedb13737ea7dda611a6059970096f15ecc8d018c676608c

Download Submit
memory/1820-10-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2132-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2132-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads