blustealer | cc50f62eea448e971a055d706b0ebb3dc63ac626e7fe1ef47e96463c15fb0d50

General

Target

00750097.EXE.exe
Size

1017KB
MD5

fc8dddeee9f2966b241a314a520ba97d
SHA1

a7290a06198b604608fd4beb6b03f7b022de115d
SHA256

cc50f62eea448e971a055d706b0ebb3dc63ac626e7fe1ef47e96463c15fb0d50
SHA512

c203a4b1606614c409cc4d3564f33554a6306ebb2485c04d2e6161e6a1fe8f0851b66d7100194bbe066c3aab5e595fd51ae5187ab148ecaf1f2d0da5495d8da5
SSDEEP

24576:BjwWZKSCkEyTwM/CjYu5DPH8R3io3F93/:BEbSCkESvwYQMSoV9P

Score

10^/10

blustealer collection spyware stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5521344267:AAGDBvY-lI_YdOdmLvEBBd-Hdagc9tnOF84/sendMessage?chat_id=5609126484

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1784 set thread context of 1904	1784	00750097.EXE.exe	32
PID 1904 set thread context of 1672	1904	00750097.EXE.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1496	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1496	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1904	00750097.EXE.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 1496	1784	00750097.EXE.exe	28
PID 1784 wrote to memory of 1496	1784	00750097.EXE.exe	28
PID 1784 wrote to memory of 1496	1784	00750097.EXE.exe	28
PID 1784 wrote to memory of 1496	1784	00750097.EXE.exe	28
PID 1784 wrote to memory of 1708	1784	00750097.EXE.exe	30
PID 1784 wrote to memory of 1708	1784	00750097.EXE.exe	30
PID 1784 wrote to memory of 1708	1784	00750097.EXE.exe	30
PID 1784 wrote to memory of 1708	1784	00750097.EXE.exe	30
PID 1784 wrote to memory of 1904	1784	00750097.EXE.exe	32
PID 1784 wrote to memory of 1904	1784	00750097.EXE.exe	32
PID 1784 wrote to memory of 1904	1784	00750097.EXE.exe	32
PID 1784 wrote to memory of 1904	1784	00750097.EXE.exe	32
PID 1784 wrote to memory of 1904	1784	00750097.EXE.exe	32
PID 1784 wrote to memory of 1904	1784	00750097.EXE.exe	32
PID 1784 wrote to memory of 1904	1784	00750097.EXE.exe	32
PID 1784 wrote to memory of 1904	1784	00750097.EXE.exe	32
PID 1784 wrote to memory of 1904	1784	00750097.EXE.exe	32
PID 1904 wrote to memory of 1672	1904	00750097.EXE.exe	33
PID 1904 wrote to memory of 1672	1904	00750097.EXE.exe	33
PID 1904 wrote to memory of 1672	1904	00750097.EXE.exe	33
PID 1904 wrote to memory of 1672	1904	00750097.EXE.exe	33
PID 1904 wrote to memory of 1672	1904	00750097.EXE.exe	33
PID 1904 wrote to memory of 1672	1904	00750097.EXE.exe	33
PID 1904 wrote to memory of 1672	1904	00750097.EXE.exe	33
PID 1904 wrote to memory of 1672	1904	00750097.EXE.exe	33
PID 1904 wrote to memory of 1672	1904	00750097.EXE.exe	33

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\00750097.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\00750097.EXE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\remAujBTnips.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1496
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\remAujBTnips" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAE5A.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1708
- C:\Users\Admin\AppData\Local\Temp\00750097.EXE.exe
  "C:\Users\Admin\AppData\Local\Temp\00750097.EXE.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAE5A.tmp

Filesize
1KB

MD5
95f0b2c9a368b2105a8e846b3e617d91

SHA1
5de96e9180e06b9a8e7743b000821bd3e84f4c16

SHA256
dc40afc93efcfc8a853b590f2084086c3a533c67d1ddd39f4230df498d00b4e0

SHA512
6796bfe8dca126257a815aa56bf18b04cabe53a14f6c15d05e44554717d9ec2817e1def35e732e56ec7d06b64b0b35dab4c0209ad2f05aaf238d431edd1655bc

Download Submit
memory/1496-77-0x0000000074DE0000-0x000000007538B000-memory.dmp

Filesize
5.7MB

Download
memory/1496-78-0x0000000074DE0000-0x000000007538B000-memory.dmp

Filesize
5.7MB

Download
memory/1672-88-0x0000000000F40000-0x0000000000FFC000-memory.dmp

Filesize
752KB

Download
memory/1672-86-0x00000000001F0000-0x0000000000256000-memory.dmp

Filesize
408KB

Download
memory/1672-84-0x00000000001F0000-0x0000000000256000-memory.dmp

Filesize
408KB

Download
memory/1672-81-0x00000000001F0000-0x0000000000256000-memory.dmp

Filesize
408KB

Download
memory/1672-79-0x00000000001F0000-0x0000000000256000-memory.dmp

Filesize
408KB

Download
memory/1784-63-0x0000000005BE0000-0x0000000005C5A000-memory.dmp

Filesize
488KB

Download
memory/1784-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/1784-56-0x00000000002D0000-0x00000000002E8000-memory.dmp

Filesize
96KB

Download
memory/1784-57-0x0000000000240000-0x000000000024C000-memory.dmp

Filesize
48KB

Download
memory/1784-58-0x0000000005D80000-0x0000000005E30000-memory.dmp

Filesize
704KB

Download
memory/1784-54-0x00000000008C0000-0x00000000009C4000-memory.dmp

Filesize
1.0MB

Download
memory/1904-72-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1904-64-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1904-67-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1904-76-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1904-65-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1904-69-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1904-89-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads