Analysis
-
max time kernel
147s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2022 20:18
Static task
static1
Behavioral task
behavioral1
Sample
order request.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
order request.exe
Resource
win10v2004-20220812-en
General
-
Target
order request.exe
-
Size
907KB
-
MD5
d684ffec7438d50b76869761acf3672a
-
SHA1
8f10196462c460575b7907198b0efccaa57fe184
-
SHA256
a99ad6c50cd5ec1409151d618216ea2616d10d8e3959f8f3067b257b172efa4b
-
SHA512
ff57b43d0e5b975264314ba4885ae0749f5c1438fba27865fbc27659ccda115905d58dad4e51934d423c0890f032b61907f34cc410212b75fa71fc219dbc1469
-
SSDEEP
24576:4/5UXyIiQEM+8+b8f1rQR+FjdTy9KUE6EEUXjZnbCkI:4/5myoo4f1rQIBdxUzUXjZnbCkI
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3496 set thread context of 4568 3496 order request.exe 92 PID 4568 set thread context of 4200 4568 order request.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 48 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3496 order request.exe 3496 order request.exe 3496 order request.exe 3496 order request.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3496 order request.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4568 order request.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3496 wrote to memory of 1256 3496 order request.exe 90 PID 3496 wrote to memory of 1256 3496 order request.exe 90 PID 3496 wrote to memory of 1256 3496 order request.exe 90 PID 3496 wrote to memory of 2024 3496 order request.exe 91 PID 3496 wrote to memory of 2024 3496 order request.exe 91 PID 3496 wrote to memory of 2024 3496 order request.exe 91 PID 3496 wrote to memory of 4568 3496 order request.exe 92 PID 3496 wrote to memory of 4568 3496 order request.exe 92 PID 3496 wrote to memory of 4568 3496 order request.exe 92 PID 3496 wrote to memory of 4568 3496 order request.exe 92 PID 3496 wrote to memory of 4568 3496 order request.exe 92 PID 3496 wrote to memory of 4568 3496 order request.exe 92 PID 3496 wrote to memory of 4568 3496 order request.exe 92 PID 3496 wrote to memory of 4568 3496 order request.exe 92 PID 4568 wrote to memory of 4200 4568 order request.exe 93 PID 4568 wrote to memory of 4200 4568 order request.exe 93 PID 4568 wrote to memory of 4200 4568 order request.exe 93 PID 4568 wrote to memory of 4200 4568 order request.exe 93 PID 4568 wrote to memory of 4200 4568 order request.exe 93 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\order request.exe"C:\Users\Admin\AppData\Local\Temp\order request.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\order request.exe"C:\Users\Admin\AppData\Local\Temp\order request.exe"2⤵PID:1256
-
-
C:\Users\Admin\AppData\Local\Temp\order request.exe"C:\Users\Admin\AppData\Local\Temp\order request.exe"2⤵PID:2024
-
-
C:\Users\Admin\AppData\Local\Temp\order request.exe"C:\Users\Admin\AppData\Local\Temp\order request.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:4200
-
-