Analysis

  • max time kernel
    69s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    13-09-2022 16:15

General

  • Target

    70fc011e55904f455a12e19e82e3a25fa05a37993bb79f023a5655aabae4b057.exe

  • Size

    1.3MB

  • MD5

    20cf6b947841f6ed3546f82ed68c1b7f

  • SHA1

    d65463fd21602d678f23678565d1169b3a4a8333

  • SHA256

    70fc011e55904f455a12e19e82e3a25fa05a37993bb79f023a5655aabae4b057

  • SHA512

    e225529b0e191aa3e5ef6ecc362f6f44b3e81d084a6f0fc2240613af9d15f11fb4ca6291ae3b2815ca6c791a9fd25c5ab0bea835441db92bfe65c223eac6cec5

  • SSDEEP

    24576:USeAC7aqFZpthlSTLp6tRgF/3QTJq8vOGxgiNdaeEntTI2IOw:MARqFHthlQp6DIfQfvr5Nct

Malware Config

Extracted

Family

blustealer

Credentials

  • Protocol:
    smtp
  • Host:
    mail.jdaroil.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    JDAR-iraq#@

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\70fc011e55904f455a12e19e82e3a25fa05a37993bb79f023a5655aabae4b057.exe
    "C:\Users\Admin\AppData\Local\Temp\70fc011e55904f455a12e19e82e3a25fa05a37993bb79f023a5655aabae4b057.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Users\Admin\AppData\Local\Temp\70fc011e55904f455a12e19e82e3a25fa05a37993bb79f023a5655aabae4b057.exe
      "C:\Users\Admin\AppData\Local\Temp\70fc011e55904f455a12e19e82e3a25fa05a37993bb79f023a5655aabae4b057.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1380
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
        3⤵
          PID:1000

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Public\3037384246424646303030333036443242464246463030303330\SQLite3_StdCall.dll

      Filesize

      59KB

      MD5

      d77b227a28a78627c2323cac75948390

      SHA1

      e228c3951f2a9fd0febfe07390633ab4f35727f4

      SHA256

      527ec201dcd7695bd9830eb82ab35a3986121de9ea156193834aed9d79223b82

      SHA512

      5627fbc8bbb98f644e21f101a68f0e0b07b87c264d00ea227286bed8ab6dd4ebf5114f03b632604f775ff93666a409a1a179a81ebfc9246956ba8150ff5b0587

    • \Users\Public\3037384246424646303030333036443242464246463030303330\sqlite3.dll

      Filesize

      585KB

      MD5

      5405413fff79b8d9c747aa900f60f082

      SHA1

      71caf8907ddd9a3a25d71356bd2ce09bd293bd78

      SHA256

      3e5a28ffde07ac661c26b6ccf94e64c1c90b1f25b3b24c90605aa922b87642eb

      SHA512

      2f09a30fc4da5166bd665210fefa1d44ce344f0ec6a37f127d677aeb3ca4fc0d09b7c9c1540f57da1e3449b7f588a1c61115395e965fa153d4baa5033266ed66

    • memory/1000-73-0x0000000000090000-0x000000000009E000-memory.dmp

      Filesize

      56KB

    • memory/1000-84-0x0000000073A00000-0x0000000073FAB000-memory.dmp

      Filesize

      5.7MB

    • memory/1000-80-0x0000000000090000-0x000000000009E000-memory.dmp

      Filesize

      56KB

    • memory/1000-78-0x0000000000090000-0x000000000009E000-memory.dmp

      Filesize

      56KB

    • memory/1000-75-0x0000000000090000-0x000000000009E000-memory.dmp

      Filesize

      56KB

    • memory/1308-59-0x0000000004620000-0x00000000046C0000-memory.dmp

      Filesize

      640KB

    • memory/1308-54-0x0000000000E70000-0x0000000000FB6000-memory.dmp

      Filesize

      1.3MB

    • memory/1308-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

      Filesize

      8KB

    • memory/1308-56-0x0000000000650000-0x0000000000674000-memory.dmp

      Filesize

      144KB

    • memory/1308-57-0x0000000000970000-0x000000000097C000-memory.dmp

      Filesize

      48KB

    • memory/1308-58-0x00000000080B0000-0x000000000818A000-memory.dmp

      Filesize

      872KB

    • memory/1380-72-0x0000000000400000-0x0000000000491000-memory.dmp

      Filesize

      580KB

    • memory/1380-60-0x0000000000400000-0x0000000000491000-memory.dmp

      Filesize

      580KB

    • memory/1380-61-0x0000000000400000-0x0000000000491000-memory.dmp

      Filesize

      580KB

    • memory/1380-63-0x0000000000400000-0x0000000000491000-memory.dmp

      Filesize

      580KB

    • memory/1380-65-0x0000000000400000-0x0000000000491000-memory.dmp

      Filesize

      580KB

    • memory/1380-68-0x0000000000400000-0x0000000000491000-memory.dmp

      Filesize

      580KB

    • memory/1380-85-0x0000000000400000-0x0000000000491000-memory.dmp

      Filesize

      580KB