Analysis
- max time kernel
64s - max time network
48s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
25/10/2022, 12:35
General
- Target Details & Invoices.exe
- Size 1.1MB
- Sample221025-psbndscgan
- SHA256 781a83f3ac8bb7d765db4ad32fcd1e07e585c533f300ddc847ea93d420c6d64c
Malware Config
Extracted
-
blustealer
-
https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474
Signatures
- BluStealer
A Modular information stealer written in Visual Basic.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Details & Invoices.exe"C:\Users\Admin\AppData\Local\Temp\Details & Invoices.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Details & Invoices.exe"C:\Users\Admin\AppData\Local\Temp\Details & Invoices.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Details & Invoices.exe"C:\Users\Admin\AppData\Local\Temp\Details & Invoices.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1276-73-0x00000000001E0000-0x0000000000246000-memory.dmp
memory/1276-82-0x00000000007C0000-0x000000000087C000-memory.dmp
memory/1276-80-0x00000000001E0000-0x0000000000246000-memory.dmp
memory/1276-78-0x00000000001E0000-0x0000000000246000-memory.dmp
memory/1276-75-0x00000000001E0000-0x0000000000246000-memory.dmp
memory/1500-83-0x0000000000400000-0x000000000046E000-memory.dmp
memory/1500-63-0x0000000000400000-0x000000000046E000-memory.dmp
memory/1500-65-0x0000000000400000-0x000000000046E000-memory.dmp
memory/1500-61-0x0000000000400000-0x000000000046E000-memory.dmp
memory/1500-68-0x0000000000400000-0x000000000046E000-memory.dmp
memory/1500-72-0x0000000000400000-0x000000000046E000-memory.dmp
memory/1500-60-0x0000000000400000-0x000000000046E000-memory.dmp
memory/1764-54-0x0000000000980000-0x0000000000A9E000-memory.dmp
memory/1764-58-0x000000000A660000-0x000000000A72A000-memory.dmp
memory/1764-57-0x0000000000510000-0x000000000051C000-memory.dmp
memory/1764-56-0x00000000004F0000-0x0000000000508000-memory.dmp
memory/1764-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp
memory/1764-59-0x0000000005B90000-0x0000000005C04000-memory.dmp