blustealer | cc50f62eea448e971a055d706b0ebb3dc63ac626e7fe1ef47e96463c15fb0d50

General

Target

00750097.EXE.exe
Size

1017KB
MD5

fc8dddeee9f2966b241a314a520ba97d
SHA1

a7290a06198b604608fd4beb6b03f7b022de115d
SHA256

cc50f62eea448e971a055d706b0ebb3dc63ac626e7fe1ef47e96463c15fb0d50
SHA512

c203a4b1606614c409cc4d3564f33554a6306ebb2485c04d2e6161e6a1fe8f0851b66d7100194bbe066c3aab5e595fd51ae5187ab148ecaf1f2d0da5495d8da5
SSDEEP

24576:BjwWZKSCkEyTwM/CjYu5DPH8R3io3F93/:BEbSCkESvwYQMSoV9P

Score

10^/10

blustealer collection spyware stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5521344267:AAGDBvY-lI_YdOdmLvEBBd-Hdagc9tnOF84/sendMessage?chat_id=5609126484

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	00750097.EXE.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2440 set thread context of 4940	2440	00750097.EXE.exe	92
PID 4940 set thread context of 3088	4940	00750097.EXE.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3496	schtasks.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	45	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
964	powershell.exe
964	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	964	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4940	00750097.EXE.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 964	2440	00750097.EXE.exe	88
PID 2440 wrote to memory of 964	2440	00750097.EXE.exe	88
PID 2440 wrote to memory of 964	2440	00750097.EXE.exe	88
PID 2440 wrote to memory of 3496	2440	00750097.EXE.exe	90
PID 2440 wrote to memory of 3496	2440	00750097.EXE.exe	90
PID 2440 wrote to memory of 3496	2440	00750097.EXE.exe	90
PID 2440 wrote to memory of 4940	2440	00750097.EXE.exe	92
PID 2440 wrote to memory of 4940	2440	00750097.EXE.exe	92
PID 2440 wrote to memory of 4940	2440	00750097.EXE.exe	92
PID 2440 wrote to memory of 4940	2440	00750097.EXE.exe	92
PID 2440 wrote to memory of 4940	2440	00750097.EXE.exe	92
PID 2440 wrote to memory of 4940	2440	00750097.EXE.exe	92
PID 2440 wrote to memory of 4940	2440	00750097.EXE.exe	92
PID 2440 wrote to memory of 4940	2440	00750097.EXE.exe	92
PID 4940 wrote to memory of 3088	4940	00750097.EXE.exe	93
PID 4940 wrote to memory of 3088	4940	00750097.EXE.exe	93
PID 4940 wrote to memory of 3088	4940	00750097.EXE.exe	93
PID 4940 wrote to memory of 3088	4940	00750097.EXE.exe	93
PID 4940 wrote to memory of 3088	4940	00750097.EXE.exe	93

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\00750097.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\00750097.EXE.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\remAujBTnips.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:964
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\remAujBTnips" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB3BF.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3496
- C:\Users\Admin\AppData\Local\Temp\00750097.EXE.exe
  "C:\Users\Admin\AppData\Local\Temp\00750097.EXE.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:3088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB3BF.tmp

Filesize
1KB

MD5
c951479c00f3f08a04201145fb440177

SHA1
2a6b45339a641a1d2b3150f5171dd6ab440e4cfe

SHA256
d6c19a5207055db9f6d8da97641a4bb8530585caf64473265cbe502a4a98f113

SHA512
c49560e8488415f24162b56c73c75a5c262c1c3924938f6d8a4f65bf978b71c1f1d0816d75d74aee8274959ff04e9f0d983d6fd6260f8f55f5608537d070d9c1

Download Submit
memory/964-149-0x0000000005680000-0x00000000056E6000-memory.dmp

Filesize
408KB

Download
memory/964-150-0x0000000005DF0000-0x0000000005E56000-memory.dmp

Filesize
408KB

Download
memory/964-161-0x0000000007990000-0x0000000007998000-memory.dmp

Filesize
32KB

Download
memory/964-151-0x0000000006360000-0x000000000637E000-memory.dmp

Filesize
120KB

Download
memory/964-160-0x00000000079B0000-0x00000000079CA000-memory.dmp

Filesize
104KB

Download
memory/964-139-0x0000000002A50000-0x0000000002A86000-memory.dmp

Filesize
216KB

Download
memory/964-159-0x00000000078A0000-0x00000000078AE000-memory.dmp

Filesize
56KB

Download
memory/964-141-0x00000000057C0000-0x0000000005DE8000-memory.dmp

Filesize
6.2MB

Download
memory/964-158-0x00000000078F0000-0x0000000007986000-memory.dmp

Filesize
600KB

Download
memory/964-157-0x00000000076E0000-0x00000000076EA000-memory.dmp

Filesize
40KB

Download
memory/964-152-0x0000000007510000-0x0000000007542000-memory.dmp

Filesize
200KB

Download
memory/964-147-0x00000000055B0000-0x00000000055D2000-memory.dmp

Filesize
136KB

Download
memory/964-156-0x0000000007670000-0x000000000768A000-memory.dmp

Filesize
104KB

Download
memory/964-155-0x0000000007CB0000-0x000000000832A000-memory.dmp

Filesize
6.5MB

Download
memory/964-154-0x0000000006910000-0x000000000692E000-memory.dmp

Filesize
120KB

Download
memory/964-153-0x0000000071040000-0x000000007108C000-memory.dmp

Filesize
304KB

Download
memory/2440-134-0x0000000004DF0000-0x0000000004E82000-memory.dmp

Filesize
584KB

Download
memory/2440-135-0x0000000004EA0000-0x0000000004EAA000-memory.dmp

Filesize
40KB

Download
memory/2440-132-0x0000000000360000-0x0000000000464000-memory.dmp

Filesize
1.0MB

Download
memory/2440-133-0x0000000005300000-0x00000000058A4000-memory.dmp

Filesize
5.6MB

Download
memory/2440-136-0x0000000008B50000-0x0000000008BEC000-memory.dmp

Filesize
624KB

Download
memory/3088-164-0x0000000000570000-0x00000000005D6000-memory.dmp

Filesize
408KB

Download
memory/4940-145-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4940-143-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4940-162-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads