Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
23/10/2022, 08:06
General
- Target SecuriteInfo.com.MSIL.GenKryptik.FZUN.tr.23962.24121.exe
- Size 1.4MB
- Sample221023-jzd47shca3
- SHA256 23b5a7169d8ab03c941f751625eabe427cc22aa4e39253af3fb7e4fc8e35a207
Malware Config
Extracted
-
blustealer
-
https://api.telegram.org/bot5755930650:AAElY45_nxTVkERZWnAInWKh0Sygx_xge0E/sendMessage?chat_id=1293496579
Signatures
- BluStealer
A Modular information stealer written in Visual Basic.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.FZUN.tr.23962.24121.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.FZUN.tr.23962.24121.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\onVgEhgtvkJAns.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\onVgEhgtvkJAns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5FF2.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.FZUN.tr.23962.24121.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.FZUN.tr.23962.24121.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.FZUN.tr.23962.24121.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.FZUN.tr.23962.24121.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.FZUN.tr.23962.24121.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.FZUN.tr.23962.24121.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmp5FF2.tmp
memory/688-149-0x0000000000400000-0x000000000046E000-memory.dmp
memory/688-164-0x0000000000400000-0x000000000046E000-memory.dmp
memory/688-146-0x0000000000400000-0x000000000046E000-memory.dmp
memory/1380-166-0x0000000000E10000-0x0000000000E76000-memory.dmp
memory/2168-132-0x0000000000FA0000-0x0000000001108000-memory.dmp
memory/2168-137-0x000000000BDA0000-0x000000000BE06000-memory.dmp
memory/2168-136-0x00000000092D0000-0x000000000936C000-memory.dmp
memory/2168-135-0x0000000005AC0000-0x0000000005ACA000-memory.dmp
memory/2168-134-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2168-133-0x00000000060D0000-0x0000000006674000-memory.dmp
memory/4788-140-0x0000000005210000-0x0000000005246000-memory.dmp
memory/4788-150-0x0000000006100000-0x0000000006166000-memory.dmp
memory/4788-153-0x00000000067F0000-0x000000000680E000-memory.dmp
memory/4788-154-0x0000000006DB0000-0x0000000006DE2000-memory.dmp
memory/4788-155-0x0000000070600000-0x000000007064C000-memory.dmp
memory/4788-156-0x0000000006D90000-0x0000000006DAE000-memory.dmp
memory/4788-157-0x0000000008140000-0x00000000087BA000-memory.dmp
memory/4788-158-0x0000000007AF0000-0x0000000007B0A000-memory.dmp
memory/4788-159-0x0000000007B60000-0x0000000007B6A000-memory.dmp
memory/4788-160-0x0000000007D70000-0x0000000007E06000-memory.dmp
memory/4788-161-0x0000000007D20000-0x0000000007D2E000-memory.dmp
memory/4788-162-0x0000000007E30000-0x0000000007E4A000-memory.dmp
memory/4788-163-0x0000000007E10000-0x0000000007E18000-memory.dmp
memory/4788-148-0x0000000005830000-0x0000000005852000-memory.dmp
memory/4788-142-0x00000000058A0000-0x0000000005EC8000-memory.dmp