Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2022, 16:24
Static task
static1
Behavioral task
behavioral1
Sample
P.O12537.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
P.O12537.exe
Resource
win10v2004-20220721-en
General
-
Target
P.O12537.exe
-
Size
1022KB
-
MD5
75dcd5e85ae9f8bcf9d95335efd83867
-
SHA1
8501172142aaa040e8effc06cf51a4beffd40683
-
SHA256
16f18d5c839c1c24cdceb8bbc9f3adb8300cd16d585678597d0f30beecbce942
-
SHA512
8a9958bdbb1cd42ad811146e024862ab42927285041400997e1aa59e77f91f4fbb0080a2992aa94ad4284f7e67d1fc8bcde91bc3caaf71ae1ee0a90c1169f448
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5330579892:AAHDIOXrD-d-pMU_JI4pPczBI962-9fokRs/sendMessage?chat_id=1494890429
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 792 set thread context of 5028 792 P.O12537.exe 93 PID 5028 set thread context of 1572 5028 P.O12537.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5028 P.O12537.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 792 wrote to memory of 5028 792 P.O12537.exe 93 PID 792 wrote to memory of 5028 792 P.O12537.exe 93 PID 792 wrote to memory of 5028 792 P.O12537.exe 93 PID 792 wrote to memory of 5028 792 P.O12537.exe 93 PID 792 wrote to memory of 5028 792 P.O12537.exe 93 PID 792 wrote to memory of 5028 792 P.O12537.exe 93 PID 792 wrote to memory of 5028 792 P.O12537.exe 93 PID 792 wrote to memory of 5028 792 P.O12537.exe 93 PID 5028 wrote to memory of 1572 5028 P.O12537.exe 94 PID 5028 wrote to memory of 1572 5028 P.O12537.exe 94 PID 5028 wrote to memory of 1572 5028 P.O12537.exe 94 PID 5028 wrote to memory of 1572 5028 P.O12537.exe 94 PID 5028 wrote to memory of 1572 5028 P.O12537.exe 94 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\P.O12537.exe"C:\Users\Admin\AppData\Local\Temp\P.O12537.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\P.O12537.exe"C:\Users\Admin\AppData\Local\Temp\P.O12537.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:1572
-
-