blustealer | 9ee2d324d8076b2b924ebdfbc678165a46089b8e413b292da28f6e9724e657a2

General

Target

DEKONT_P.EXE.exe
Size

1.3MB
MD5

5afe8e13c85ca1b13566776bf95c8307
SHA1

0c4f45714b140392797f1d8aad65da71a0ef9aaf
SHA256

9ee2d324d8076b2b924ebdfbc678165a46089b8e413b292da28f6e9724e657a2
SHA512

01310091d805126b39a87871202e82703d0e1a5202e90bed3fcf1af93a04dd73e9752cf72a42b7697cd2d6f09192214994cfb74dc5390ebd2125914c235777ae
SSDEEP

24576:3QxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNussoiCZXqP:Ap6wgt6tM2QU2p2KwFdj

Score

10^/10

blustealer collection stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5310184325:AAFI3fSQ6VcGu_NSTmv7d-qK2WCVhYY_qfg/sendMessage?chat_id=1293496579

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1476 set thread context of 1764	1476	DEKONT_P.EXE.exe	31
PID 1764 set thread context of 1532	1764	DEKONT_P.EXE.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1476	DEKONT_P.EXE.exe
1476	DEKONT_P.EXE.exe
1784	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	DEKONT_P.EXE.exe
Token: SeDebugPrivilege	1784	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1764	DEKONT_P.EXE.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1784	1476	DEKONT_P.EXE.exe	27
PID 1476 wrote to memory of 1784	1476	DEKONT_P.EXE.exe	27
PID 1476 wrote to memory of 1784	1476	DEKONT_P.EXE.exe	27
PID 1476 wrote to memory of 1784	1476	DEKONT_P.EXE.exe	27
PID 1476 wrote to memory of 1748	1476	DEKONT_P.EXE.exe	29
PID 1476 wrote to memory of 1748	1476	DEKONT_P.EXE.exe	29
PID 1476 wrote to memory of 1748	1476	DEKONT_P.EXE.exe	29
PID 1476 wrote to memory of 1748	1476	DEKONT_P.EXE.exe	29
PID 1476 wrote to memory of 1764	1476	DEKONT_P.EXE.exe	31
PID 1476 wrote to memory of 1764	1476	DEKONT_P.EXE.exe	31
PID 1476 wrote to memory of 1764	1476	DEKONT_P.EXE.exe	31
PID 1476 wrote to memory of 1764	1476	DEKONT_P.EXE.exe	31
PID 1476 wrote to memory of 1764	1476	DEKONT_P.EXE.exe	31
PID 1476 wrote to memory of 1764	1476	DEKONT_P.EXE.exe	31
PID 1476 wrote to memory of 1764	1476	DEKONT_P.EXE.exe	31
PID 1476 wrote to memory of 1764	1476	DEKONT_P.EXE.exe	31
PID 1476 wrote to memory of 1764	1476	DEKONT_P.EXE.exe	31
PID 1764 wrote to memory of 1532	1764	DEKONT_P.EXE.exe	32
PID 1764 wrote to memory of 1532	1764	DEKONT_P.EXE.exe	32
PID 1764 wrote to memory of 1532	1764	DEKONT_P.EXE.exe	32
PID 1764 wrote to memory of 1532	1764	DEKONT_P.EXE.exe	32
PID 1764 wrote to memory of 1532	1764	DEKONT_P.EXE.exe	32
PID 1764 wrote to memory of 1532	1764	DEKONT_P.EXE.exe	32
PID 1764 wrote to memory of 1532	1764	DEKONT_P.EXE.exe	32
PID 1764 wrote to memory of 1532	1764	DEKONT_P.EXE.exe	32
PID 1764 wrote to memory of 1532	1764	DEKONT_P.EXE.exe	32

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\DEKONT_P.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\DEKONT_P.EXE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qjvRlQWpOmZ.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1784
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qjvRlQWpOmZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3515.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1748
- C:\Users\Admin\AppData\Local\Temp\DEKONT_P.EXE.exe
  "C:\Users\Admin\AppData\Local\Temp\DEKONT_P.EXE.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3515.tmp

Filesize
1KB

MD5
74833f56e3f0cf7fd41e0fd10752aae5

SHA1
c424438210947871ea004f901b016ee9359c7b64

SHA256
ff446e1744fdf8003a9d9cb7a5fd85048a7c7c2b34ebe23fffb0edfcb2f1c41a

SHA512
d37099283fc254dcc8dd4236570fdc90e3e7ebec33825eb559c079af824c0a2d3de391edb017edd7e349de4884df5961e6360c2ed8d13eb137ccfe4699d51bed

Download Submit
memory/1476-54-0x00000000008A0000-0x00000000009EC000-memory.dmp

Filesize
1.3MB

Download
memory/1476-56-0x0000000001F80000-0x0000000001F98000-memory.dmp

Filesize
96KB

Download
memory/1476-57-0x00000000005C0000-0x00000000005CC000-memory.dmp

Filesize
48KB

Download
memory/1476-58-0x0000000007D90000-0x0000000007E5A000-memory.dmp

Filesize
808KB

Download
memory/1476-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1476-63-0x000000000A550000-0x000000000A5C4000-memory.dmp

Filesize
464KB

Download
memory/1532-87-0x0000000000EB0000-0x0000000000F6C000-memory.dmp

Filesize
752KB

Download
memory/1532-78-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1532-85-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1532-83-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1532-80-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1764-72-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1764-76-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1764-69-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1764-67-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1764-65-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1764-64-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1764-89-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1784-77-0x0000000073EB0000-0x000000007445B000-memory.dmp

Filesize
5.7MB

Download
memory/1784-88-0x0000000073EB0000-0x000000007445B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads