Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
11-10-2021 08:07
Static task
static1
Behavioral task
behavioral1
Sample
0a424c71b75fecfb42fb0e2b17f1c6bc.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
0a424c71b75fecfb42fb0e2b17f1c6bc.exe
Resource
win10-en-20210920
General
-
Target
0a424c71b75fecfb42fb0e2b17f1c6bc.exe
-
Size
1.3MB
-
MD5
0a424c71b75fecfb42fb0e2b17f1c6bc
-
SHA1
672ef8db0788b4dad4d4fe2853573140448447f6
-
SHA256
a7cce7b44e791b44a67edeec0489858b4ba9d1a82464d4148a6f691a4e86e93c
-
SHA512
b744c61ff97d08c2112b1ac752fabd057efe2e5b7a70f2c65ed5e2c83960b763cf444f99e3f5a285578b31a10ee33c016e95e2d2979fd2bc09c69e941a2615dc
Malware Config
Extracted
blustealer
Protocol: smtp- Host:
mail.dm-teh.com - Port:
587 - Username:
[email protected] - Password:
Vm@(O;CO.vEQ
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 1 IoCs
Processes:
AddInProcess32.exepid Process 1420 AddInProcess32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0a424c71b75fecfb42fb0e2b17f1c6bc.exedescription pid Process procid_target PID 3596 set thread context of 1420 3596 0a424c71b75fecfb42fb0e2b17f1c6bc.exe 70 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
0a424c71b75fecfb42fb0e2b17f1c6bc.exepid Process 3596 0a424c71b75fecfb42fb0e2b17f1c6bc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0a424c71b75fecfb42fb0e2b17f1c6bc.exedescription pid Process Token: SeDebugPrivilege 3596 0a424c71b75fecfb42fb0e2b17f1c6bc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AddInProcess32.exepid Process 1420 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0a424c71b75fecfb42fb0e2b17f1c6bc.exedescription pid Process procid_target PID 3596 wrote to memory of 1420 3596 0a424c71b75fecfb42fb0e2b17f1c6bc.exe 70 PID 3596 wrote to memory of 1420 3596 0a424c71b75fecfb42fb0e2b17f1c6bc.exe 70 PID 3596 wrote to memory of 1420 3596 0a424c71b75fecfb42fb0e2b17f1c6bc.exe 70 PID 3596 wrote to memory of 1420 3596 0a424c71b75fecfb42fb0e2b17f1c6bc.exe 70 PID 3596 wrote to memory of 1420 3596 0a424c71b75fecfb42fb0e2b17f1c6bc.exe 70 PID 3596 wrote to memory of 1420 3596 0a424c71b75fecfb42fb0e2b17f1c6bc.exe 70 PID 3596 wrote to memory of 1420 3596 0a424c71b75fecfb42fb0e2b17f1c6bc.exe 70 PID 3596 wrote to memory of 1420 3596 0a424c71b75fecfb42fb0e2b17f1c6bc.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a424c71b75fecfb42fb0e2b17f1c6bc.exe"C:\Users\Admin\AppData\Local\Temp\0a424c71b75fecfb42fb0e2b17f1c6bc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\\AddInProcess32.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1420
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39