Analysis
-
max time kernel
143s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-10-2022 08:06
General
-
Target
SecuriteInfo.com.MSIL.GenKryptik.FZUN.tr.23962.exe
-
Size
1.4MB
-
MD5
8d654f7f3951c4493f602eaeec06a66d
-
SHA1
b2dbbc4d06d197325efa9c780a881e5dc5055c8e
-
SHA256
23b5a7169d8ab03c941f751625eabe427cc22aa4e39253af3fb7e4fc8e35a207
-
SHA512
73a16f93ca5e6e521e6863df0eb361e37b2701a9178908235c6088c63f662384e315f0c31727552feb10f6739056cce9aa20d13cb6f68655a4404b0e78da785e
-
SSDEEP
24576:NkU0xyXgeNY7E12oi4cWAlGmEFr0ulZlh6alRsn/ju1LNajXYo3aOtY:fXgeNYM3NVAAb0slh/sUBajD3
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5755930650:AAElY45_nxTVkERZWnAInWKh0Sygx_xge0E/sendMessage?chat_id=1293496579
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 19 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.FZUN.tr.23962.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.FZUN.tr.23962.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\onVgEhgtvkJAns.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\onVgEhgtvkJAns" /XML "C:\Users\Admin\AppData\Local\Temp\tmp26B2.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.FZUN.tr.23962.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.FZUN.tr.23962.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d94283d1e40882ac3d207378c507a898
SHA1de7d8f0cbf072398fdfa21d5447625ca34164a7f
SHA256277355973ed550bbd686fa6a837e1baedcdf160e92657705d465aa18170a6081
SHA512a6f1d3fe1492817ac553b7842a4ae4978da4050600d3541075ed2e52055b36886010cac933f6dd1c51d7ce106a65434129b8c8b89569c96ec1309547d5a97380
-
Filesize
408KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
408KB
-
Filesize
1.4MB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
56KB
-
Filesize
216KB
-
Filesize
408KB
-
Filesize
600KB
-
Filesize
120KB
-
Filesize
200KB
-
Filesize
304KB
-
Filesize
6.2MB
-
Filesize
40KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB