blustealer | 0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c

Analysis

max time kernel
90s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
04/08/2022, 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe
Size

928KB
MD5

a661148c26dc8bd4992bbd23b350f062
SHA1

35af577d4c5c0d94585fc41b2f1834f463727c20
SHA256

0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c
SHA512

adb8d4c0a859acbb8c5cd7114d9a1f9233dce045be42e3224f62a08b4e000513788263a9ccd6c27919a0449437d843072f2c8d81e876ecc2220b695b5eebfafe

Score

10^/10

blustealer stealer

Malware Config

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 396 set thread context of 3732	396	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1804	powershell.exe
1804	powershell.exe
396	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe
396	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	396	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe
Token: SeDebugPrivilege	1804	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3732	InstallUtil.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 1804	396	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe	83
PID 396 wrote to memory of 1804	396	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe	83
PID 396 wrote to memory of 1804	396	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe	83
PID 396 wrote to memory of 3732	396	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe	89
PID 396 wrote to memory of 3732	396	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe	89
PID 396 wrote to memory of 3732	396	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe	89
PID 396 wrote to memory of 3732	396	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe	89
PID 396 wrote to memory of 3732	396	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe	89
PID 396 wrote to memory of 3732	396	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe	89
PID 396 wrote to memory of 3732	396	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe	89
PID 396 wrote to memory of 3732	396	0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe	89

C:\Users\Admin\AppData\Local\Temp\0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe
"C:\Users\Admin\AppData\Local\Temp\0e184b1b8ebe69d4e06a8a71c53054b3713ec9f2a0a9f8988ce235d130ac549c.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/396-130-0x00000000001E0000-0x00000000002CE000-memory.dmp

Filesize
952KB

Download
memory/396-131-0x0000000005270000-0x0000000005814000-memory.dmp

Filesize
5.6MB

Download
memory/396-132-0x0000000005220000-0x0000000005242000-memory.dmp

Filesize
136KB

Download
memory/1804-134-0x0000000002750000-0x0000000002786000-memory.dmp

Filesize
216KB

Download
memory/1804-135-0x0000000005220000-0x0000000005848000-memory.dmp

Filesize
6.2MB

Download
memory/1804-136-0x00000000058C0000-0x0000000005926000-memory.dmp

Filesize
408KB

Download
memory/1804-137-0x0000000005A20000-0x0000000005A86000-memory.dmp

Filesize
408KB

Download
memory/1804-138-0x0000000006080000-0x000000000609E000-memory.dmp

Filesize
120KB

Download
memory/1804-139-0x00000000078C0000-0x0000000007F3A000-memory.dmp

Filesize
6.5MB

Download
memory/1804-140-0x0000000006550000-0x000000000656A000-memory.dmp

Filesize
104KB

Download
memory/3732-142-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3732-144-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3732-147-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3732-148-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download