blustealer | 5e26cb68b7cd24df50916757dd43c5357bcee359d05d8d8649749fdce26d540c

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
27-07-2022 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.W32.AIDetectNet.01.22897.exe
Size

825KB
MD5

f10789db721c1dfdf2e74554508f23e7
SHA1

12a2fb70d4e7358fc53e5f19ddfc91ae0f2ea018
SHA256

5e26cb68b7cd24df50916757dd43c5357bcee359d05d8d8649749fdce26d540c
SHA512

72a4cf5ca2d2fe08ee4b1b667e215801d750d1d8580d1fad90e06f0caf579b23969cda58a3534c1777a9617470aac784ba13ce4587ea3e856e7d2858480b7e49

Score

10^/10

blustealer persistence spyware stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
[email protected]
Password:
*LQ.2{zR5.5z4aXnk*

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Loads dropped DLL 2 IoCs

pid	Process
1100	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe
1100	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uarexqz = "\"C:\\Users\\Admin\\AppData\\Roaming\\Lwsbz\\Uarexqz.exe\""	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1988 set thread context of 1100	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	32
PID 1100 set thread context of 1872	1100	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1552	powershell.exe
1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe
1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe
1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe
1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe
1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1100	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1552	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	28
PID 1988 wrote to memory of 1552	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	28
PID 1988 wrote to memory of 1552	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	28
PID 1988 wrote to memory of 1552	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	28
PID 1988 wrote to memory of 1368	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	30
PID 1988 wrote to memory of 1368	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	30
PID 1988 wrote to memory of 1368	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	30
PID 1988 wrote to memory of 1368	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	30
PID 1988 wrote to memory of 908	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	31
PID 1988 wrote to memory of 908	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	31
PID 1988 wrote to memory of 908	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	31
PID 1988 wrote to memory of 908	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	31
PID 1988 wrote to memory of 1100	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	32
PID 1988 wrote to memory of 1100	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	32
PID 1988 wrote to memory of 1100	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	32
PID 1988 wrote to memory of 1100	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	32
PID 1988 wrote to memory of 1100	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	32
PID 1988 wrote to memory of 1100	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	32
PID 1988 wrote to memory of 1100	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	32
PID 1988 wrote to memory of 1100	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	32
PID 1988 wrote to memory of 1100	1988	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	32
PID 1100 wrote to memory of 1872	1100	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	34
PID 1100 wrote to memory of 1872	1100	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	34
PID 1100 wrote to memory of 1872	1100	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	34
PID 1100 wrote to memory of 1872	1100	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	34
PID 1100 wrote to memory of 1872	1100	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	34
PID 1100 wrote to memory of 1872	1100	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	34
PID 1100 wrote to memory of 1872	1100	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	34
PID 1100 wrote to memory of 1872	1100	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	34
PID 1100 wrote to memory of 1872	1100	SecuriteInfo.com.W32.AIDetectNet.01.22897.exe	34

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.22897.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.22897.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1552
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.22897.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.22897.exe
  2⤵
  PID:1368
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.22897.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.22897.exe
  2⤵
  PID:908
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.22897.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.22897.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
    3⤵
    PID:1872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Public\3037384246424646303030333036443242464246463030303330\SQLite3_StdCall.dll

Filesize
59KB

MD5
d77b227a28a78627c2323cac75948390

SHA1
e228c3951f2a9fd0febfe07390633ab4f35727f4

SHA256
527ec201dcd7695bd9830eb82ab35a3986121de9ea156193834aed9d79223b82

SHA512
5627fbc8bbb98f644e21f101a68f0e0b07b87c264d00ea227286bed8ab6dd4ebf5114f03b632604f775ff93666a409a1a179a81ebfc9246956ba8150ff5b0587

Download Submit
\Users\Public\3037384246424646303030333036443242464246463030303330\sqlite3.dll

Filesize
585KB

MD5
5405413fff79b8d9c747aa900f60f082

SHA1
71caf8907ddd9a3a25d71356bd2ce09bd293bd78

SHA256
3e5a28ffde07ac661c26b6ccf94e64c1c90b1f25b3b24c90605aa922b87642eb

SHA512
2f09a30fc4da5166bd665210fefa1d44ce344f0ec6a37f127d677aeb3ca4fc0d09b7c9c1540f57da1e3449b7f588a1c61115395e965fa153d4baa5033266ed66

Download Submit
memory/1100-67-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1100-87-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1100-74-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1100-70-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1100-62-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1100-63-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1100-65-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1552-60-0x000000006F520000-0x000000006FACB000-memory.dmp

Filesize
5.7MB

Download
memory/1552-61-0x000000006F520000-0x000000006FACB000-memory.dmp

Filesize
5.7MB

Download
memory/1872-75-0x0000000000090000-0x000000000009E000-memory.dmp

Filesize
56KB

Download
memory/1872-77-0x0000000000090000-0x000000000009E000-memory.dmp

Filesize
56KB

Download
memory/1872-80-0x0000000000090000-0x000000000009E000-memory.dmp

Filesize
56KB

Download
memory/1872-82-0x0000000000090000-0x000000000009E000-memory.dmp

Filesize
56KB

Download
memory/1872-86-0x0000000073C30000-0x00000000741DB000-memory.dmp

Filesize
5.7MB

Download
memory/1988-54-0x0000000000140000-0x0000000000214000-memory.dmp

Filesize
848KB

Download
memory/1988-57-0x0000000075731000-0x0000000075733000-memory.dmp

Filesize
8KB

Download
memory/1988-56-0x00000000048E0000-0x0000000004972000-memory.dmp

Filesize
584KB

Download
memory/1988-55-0x0000000000670000-0x0000000000732000-memory.dmp

Filesize
776KB

Download