Analysis
-
max time kernel
175s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 06:42
Static task
static1
Behavioral task
behavioral1
Sample
Order Request.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Order Request.exe
Resource
win10v2004-20220812-en
General
-
Target
Order Request.exe
-
Size
1.0MB
-
MD5
0751cb9453ccc6d6576c8e6583e8e8df
-
SHA1
c78f7efa2c57394097eca6c222f52dc6c5169515
-
SHA256
6f6927018a479ebbb860f5010a88d14ddaa2c64756e06ba9f0326ca15462b4e4
-
SHA512
ca93c74695ffc078236a868dfa8fdbaeec4af0cf3075377390aa6533c0fc4944aa0ac62fbe20cc7e2eaba1581cfbc48adcdac554ccefb4ce700dd4f803f7a35a
-
SSDEEP
24576:vZqB/XCxqrTElFByv3DCYlWSGHsGoR4Dq:GX5nE+3DCYlWSGMJ4+
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1288 set thread context of 3628 1288 Order Request.exe 83 PID 3628 set thread context of 4624 3628 Order Request.exe 84 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1288 Order Request.exe 1288 Order Request.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1288 Order Request.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3628 Order Request.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1288 wrote to memory of 3728 1288 Order Request.exe 82 PID 1288 wrote to memory of 3728 1288 Order Request.exe 82 PID 1288 wrote to memory of 3728 1288 Order Request.exe 82 PID 1288 wrote to memory of 3628 1288 Order Request.exe 83 PID 1288 wrote to memory of 3628 1288 Order Request.exe 83 PID 1288 wrote to memory of 3628 1288 Order Request.exe 83 PID 1288 wrote to memory of 3628 1288 Order Request.exe 83 PID 1288 wrote to memory of 3628 1288 Order Request.exe 83 PID 1288 wrote to memory of 3628 1288 Order Request.exe 83 PID 1288 wrote to memory of 3628 1288 Order Request.exe 83 PID 1288 wrote to memory of 3628 1288 Order Request.exe 83 PID 3628 wrote to memory of 4624 3628 Order Request.exe 84 PID 3628 wrote to memory of 4624 3628 Order Request.exe 84 PID 3628 wrote to memory of 4624 3628 Order Request.exe 84 PID 3628 wrote to memory of 4624 3628 Order Request.exe 84 PID 3628 wrote to memory of 4624 3628 Order Request.exe 84 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order Request.exe"C:\Users\Admin\AppData\Local\Temp\Order Request.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\Order Request.exe"C:\Users\Admin\AppData\Local\Temp\Order Request.exe"2⤵PID:3728
-
-
C:\Users\Admin\AppData\Local\Temp\Order Request.exe"C:\Users\Admin\AppData\Local\Temp\Order Request.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:4624
-
-