Analysis

  • max time kernel
    63s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    30-11-2022 06:42

General

  • Target

    Order Request.exe

  • Size

    1.0MB

  • MD5

    0751cb9453ccc6d6576c8e6583e8e8df

  • SHA1

    c78f7efa2c57394097eca6c222f52dc6c5169515

  • SHA256

    6f6927018a479ebbb860f5010a88d14ddaa2c64756e06ba9f0326ca15462b4e4

  • SHA512

    ca93c74695ffc078236a868dfa8fdbaeec4af0cf3075377390aa6533c0fc4944aa0ac62fbe20cc7e2eaba1581cfbc48adcdac554ccefb4ce700dd4f803f7a35a

  • SSDEEP

    24576:vZqB/XCxqrTElFByv3DCYlWSGHsGoR4Dq:GX5nE+3DCYlWSGMJ4+

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Order Request.exe
    "C:\Users\Admin\AppData\Local\Temp\Order Request.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Users\Admin\AppData\Local\Temp\Order Request.exe
      "C:\Users\Admin\AppData\Local\Temp\Order Request.exe"
      2⤵
        PID:828
      • C:\Users\Admin\AppData\Local\Temp\Order Request.exe
        "C:\Users\Admin\AppData\Local\Temp\Order Request.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1344
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          3⤵
          • Accesses Microsoft Outlook profiles
          • outlook_office_path
          • outlook_win_path
          PID:1120

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1120-73-0x0000000000090000-0x00000000000F6000-memory.dmp

      Filesize

      408KB

    • memory/1120-82-0x0000000000EF0000-0x0000000000FAC000-memory.dmp

      Filesize

      752KB

    • memory/1120-80-0x0000000000090000-0x00000000000F6000-memory.dmp

      Filesize

      408KB

    • memory/1120-78-0x0000000000090000-0x00000000000F6000-memory.dmp

      Filesize

      408KB

    • memory/1120-75-0x0000000000090000-0x00000000000F6000-memory.dmp

      Filesize

      408KB

    • memory/1344-83-0x0000000000400000-0x000000000046E000-memory.dmp

      Filesize

      440KB

    • memory/1344-65-0x0000000000400000-0x000000000046E000-memory.dmp

      Filesize

      440KB

    • memory/1344-63-0x0000000000400000-0x000000000046E000-memory.dmp

      Filesize

      440KB

    • memory/1344-61-0x0000000000400000-0x000000000046E000-memory.dmp

      Filesize

      440KB

    • memory/1344-68-0x0000000000400000-0x000000000046E000-memory.dmp

      Filesize

      440KB

    • memory/1344-72-0x0000000000400000-0x000000000046E000-memory.dmp

      Filesize

      440KB

    • memory/1344-60-0x0000000000400000-0x000000000046E000-memory.dmp

      Filesize

      440KB

    • memory/1460-54-0x0000000000D00000-0x0000000000E0C000-memory.dmp

      Filesize

      1.0MB

    • memory/1460-58-0x0000000008190000-0x0000000008262000-memory.dmp

      Filesize

      840KB

    • memory/1460-57-0x0000000000570000-0x000000000057E000-memory.dmp

      Filesize

      56KB

    • memory/1460-56-0x0000000000320000-0x0000000000336000-memory.dmp

      Filesize

      88KB

    • memory/1460-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

      Filesize

      8KB

    • memory/1460-59-0x0000000005D70000-0x0000000005E0E000-memory.dmp

      Filesize

      632KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.