blustealer | 4c1286920e0fbb0e4269f4b64ec6ca052076414a24af72f2e1a82f516a21bf52

General

Target
4c1286920e0fbb0e4269f4b64ec6ca052076414a24af72f2e1a82f516a21bf52.exe
Size 567KB
Sample221211-amnnfagd52
SHA256 4c1286920e0fbb0e4269f4b64ec6ca052076414a24af72f2e1a82f516a21bf52
MD5 671f6fa2476117ebabadfbbabe5a4009
SHA1 92269b2ad71e7cac4eff7dc810f2989b93ac74b0
SHA512 0c0d8177803158ccceca3526405f40e4e29af5ed049dda12818d97357b3cee63f8bd804cdf2df346c1022069c6960b7b596ed2f55e23264dfd790bdc3d75eac0
SSDEEP 12288:VYIFRHhMwBPAsS6l6y1HcjhgEbXFRcEHvhI52:VzFRBosSSFNaXFRc0hQ2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blustealer collection stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Executes dropped EXE 2 IoCs

pid	Process
4364	qwrabc.exe
5112	qwrabc.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4364 set thread context of 5112	4364	qwrabc.exe	81
PID 5112 set thread context of 5084	5112	qwrabc.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4364	qwrabc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5112	qwrabc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 4364	2248	4c1286920e0fbb0e4269f4b64ec6ca052076414a24af72f2e1a82f516a21bf52.exe	80
PID 2248 wrote to memory of 4364	2248	4c1286920e0fbb0e4269f4b64ec6ca052076414a24af72f2e1a82f516a21bf52.exe	80
PID 2248 wrote to memory of 4364	2248	4c1286920e0fbb0e4269f4b64ec6ca052076414a24af72f2e1a82f516a21bf52.exe	80
PID 4364 wrote to memory of 5112	4364	qwrabc.exe	81
PID 4364 wrote to memory of 5112	4364	qwrabc.exe	81
PID 4364 wrote to memory of 5112	4364	qwrabc.exe	81
PID 4364 wrote to memory of 5112	4364	qwrabc.exe	81
PID 5112 wrote to memory of 5084	5112	qwrabc.exe	82
PID 5112 wrote to memory of 5084	5112	qwrabc.exe	82
PID 5112 wrote to memory of 5084	5112	qwrabc.exe	82
PID 5112 wrote to memory of 5084	5112	qwrabc.exe	82
PID 5112 wrote to memory of 5084	5112	qwrabc.exe	82

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\4c1286920e0fbb0e4269f4b64ec6ca052076414a24af72f2e1a82f516a21bf52.exe
"C:\Users\Admin\AppData\Local\Temp\4c1286920e0fbb0e4269f4b64ec6ca052076414a24af72f2e1a82f516a21bf52.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\qwrabc.exe
  "C:\Users\Admin\AppData\Local\Temp\qwrabc.exe" C:\Users\Admin\AppData\Local\Temp\yjsfxmkgy.x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Users\Admin\AppData\Local\Temp\qwrabc.exe
    "C:\Users\Admin\AppData\Local\Temp\qwrabc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      4⤵
      Accesses Microsoft Outlook profiles
      outlook_office_path
      outlook_win_path
      PID:5084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dkvzaniak.f

Path C:\Users\Admin\AppData\Local\Temp\dkvzaniak.f
Size 440KB
SHA256 e4b031a3721695239d64dc1b1e72862e1b9bc9ad1f0a4182928613b508a35d3f
MD5 0c5c58df08bf4a4516deceafb61ca2ed
SHA1 10b18a4bb2316d18fae0fdd4bc4960c88bbedc93
SHA512 20c232eb76e2e64b1d1d77b33f4ecdc6e6d3fc617e4294a5bda03379f25518324dcd2f1a84bbb630a5329236413da378eb8442506489161d482c14b8b62365cb
SSDEEP 12288:gbjLKisTfv9Ygl07lpW0pav9+Vr9NsbKqNshen4:yLKjTfv9YgKcvQVrM/864
MD5 SHA1 SHA512 SSDEEP

Submit Download

qwrabc.exe

Path C:\Users\Admin\AppData\Local\Temp\qwrabc.exe
Size 287KB
SHA256 d55ae8288242d1f5b21ce9b4d5e0f09b19ee790839c867fa72b08fb04b73ef06
MD5 2ac8d8ce8356af1211b2868ef515c5a0
SHA1 e61ffdd49107d2308fcfe171b0dee35a73d90749
SHA512 814e81d4bf1ea2f62b0311bbf255850a149f2055286811adb9a06a2a3b0e897b8e61ad07fe39027de562010136a73cb3a90cd1629aa1aa47ffc3aff70fb754c2
SSDEEP 6144:72gX5JlejemhieRCqfJC8ZCuyUyZZ5qC:72gX5Jiemhi2zNQuyUY
MD5 SHA1 SHA512 SSDEEP

Submit Download

qwrabc.exe

Path C:\Users\Admin\AppData\Local\Temp\qwrabc.exe
Size 287KB
SHA256 d55ae8288242d1f5b21ce9b4d5e0f09b19ee790839c867fa72b08fb04b73ef06
MD5 2ac8d8ce8356af1211b2868ef515c5a0
SHA1 e61ffdd49107d2308fcfe171b0dee35a73d90749
SHA512 814e81d4bf1ea2f62b0311bbf255850a149f2055286811adb9a06a2a3b0e897b8e61ad07fe39027de562010136a73cb3a90cd1629aa1aa47ffc3aff70fb754c2
SSDEEP 6144:72gX5JlejemhieRCqfJC8ZCuyUyZZ5qC:72gX5Jiemhi2zNQuyUY
MD5 SHA1 SHA512 SSDEEP

Submit Download

qwrabc.exe

Path C:\Users\Admin\AppData\Local\Temp\qwrabc.exe
Size 287KB
SHA256 d55ae8288242d1f5b21ce9b4d5e0f09b19ee790839c867fa72b08fb04b73ef06
MD5 2ac8d8ce8356af1211b2868ef515c5a0
SHA1 e61ffdd49107d2308fcfe171b0dee35a73d90749
SHA512 814e81d4bf1ea2f62b0311bbf255850a149f2055286811adb9a06a2a3b0e897b8e61ad07fe39027de562010136a73cb3a90cd1629aa1aa47ffc3aff70fb754c2
SSDEEP 6144:72gX5JlejemhieRCqfJC8ZCuyUyZZ5qC:72gX5Jiemhi2zNQuyUY
MD5 SHA1 SHA512 SSDEEP

Submit Download

yjsfxmkgy.x

Path C:\Users\Admin\AppData\Local\Temp\yjsfxmkgy.x
Size 5KB
SHA256 8fb3e9eb0e628e52f2a3796bb38b3f3474f9e63eda29c90954320e2db3d6cca7
MD5 66c8b481dfdab8ccb000ca62c7c48e03
SHA1 84331fb4da47575060b7e447eca3b0d0169cbd72
SHA512 02fd802781f23d20597edabf569091fe65570b0d65f87451bbac07f9a0d57886b14b409834fc9891f503773a771497be22a6886dbd3aa8217ce382be1e037bbd
SSDEEP 96:zIOiHLqZXBjsGBA8LwQztJC3L6iKgCp5269BkrLbf4991PTjJhnL/aISi7:zLuqFBjDAGztM3L6i05ZIo99xT3yI97
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5084-143-0x0000000000D50000-0x0000000000DB6000-memory.dmp

Download

memory/5084-144-0x0000000005510000-0x00000000055AC000-memory.dmp

Download

memory/5112-141-0x0000000000400000-0x000000000046E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads