blustealer | c6bf68a560620fb785c27e00e1695406e86d25c656f6472b3a6886a710aeb238

General

Target

Quotation Required.exe
Size

501KB
MD5

c6479e3bcb864d87e5d93ff06ed15c60
SHA1

af08bbfe61178ee821e85b1f09be975b732387aa
SHA256

9842d23cef4dc305ab6b8cd1ade477e1186d94cfd18861e1c87a55aff4d04c40
SHA512

c5f4b4638b76b963fe8b731a08c43f67d5a8c512262755f78eca27feea5004e348e85a913926f8afe73accefa6a680bba37207adb37880100cd2f8ff6509b1b6
SSDEEP

12288:/YmibSNNCgbjT5hg1s5PiA8C58tpxxqVTEp1B:/YmQoz5hgSN8tpxAVEp1B

Score

10^/10

blustealer collection stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Executes dropped EXE 2 IoCs

pid	Process
4956	lhiecmmdg.exe
4592	lhiecmmdg.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4956 set thread context of 4592	4956	lhiecmmdg.exe	83
PID 4592 set thread context of 1400	4592	lhiecmmdg.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4956	lhiecmmdg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4592	lhiecmmdg.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 4956	1660	Quotation Required.exe	81
PID 1660 wrote to memory of 4956	1660	Quotation Required.exe	81
PID 1660 wrote to memory of 4956	1660	Quotation Required.exe	81
PID 4956 wrote to memory of 4592	4956	lhiecmmdg.exe	83
PID 4956 wrote to memory of 4592	4956	lhiecmmdg.exe	83
PID 4956 wrote to memory of 4592	4956	lhiecmmdg.exe	83
PID 4956 wrote to memory of 4592	4956	lhiecmmdg.exe	83
PID 4592 wrote to memory of 1400	4592	lhiecmmdg.exe	84
PID 4592 wrote to memory of 1400	4592	lhiecmmdg.exe	84
PID 4592 wrote to memory of 1400	4592	lhiecmmdg.exe	84
PID 4592 wrote to memory of 1400	4592	lhiecmmdg.exe	84
PID 4592 wrote to memory of 1400	4592	lhiecmmdg.exe	84

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\Quotation Required.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation Required.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\lhiecmmdg.exe
  "C:\Users\Admin\AppData\Local\Temp\lhiecmmdg.exe" C:\Users\Admin\AppData\Local\Temp\ovcnaiorxn.d
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\lhiecmmdg.exe
    "C:\Users\Admin\AppData\Local\Temp\lhiecmmdg.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      4⤵
      Accesses Microsoft Outlook profiles
      outlook_office_path
      outlook_win_path
      PID:1400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lhiecmmdg.exe

Filesize
54KB

MD5
208f168a8a01e2d071375e09c084dc5a

SHA1
e04b395d08bfad73c65997e24f4fb951a7837d61

SHA256
0ea519809172240457a3d0bdb4dce19d0456670355ff1ead6d9823a1e72e433b

SHA512
10f05cac53cc143ce0388e8cd3546e856ed245f3999aca51d2db1e2efeacfb7dc5a18192280ebcb4087208a9cd50e90612150712eeed2c68c5876741bfa940cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\lhiecmmdg.exe

Filesize
54KB

MD5
208f168a8a01e2d071375e09c084dc5a

SHA1
e04b395d08bfad73c65997e24f4fb951a7837d61

SHA256
0ea519809172240457a3d0bdb4dce19d0456670355ff1ead6d9823a1e72e433b

SHA512
10f05cac53cc143ce0388e8cd3546e856ed245f3999aca51d2db1e2efeacfb7dc5a18192280ebcb4087208a9cd50e90612150712eeed2c68c5876741bfa940cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\lhiecmmdg.exe

Filesize
54KB

MD5
208f168a8a01e2d071375e09c084dc5a

SHA1
e04b395d08bfad73c65997e24f4fb951a7837d61

SHA256
0ea519809172240457a3d0bdb4dce19d0456670355ff1ead6d9823a1e72e433b

SHA512
10f05cac53cc143ce0388e8cd3546e856ed245f3999aca51d2db1e2efeacfb7dc5a18192280ebcb4087208a9cd50e90612150712eeed2c68c5876741bfa940cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ovcnaiorxn.d

Filesize
5KB

MD5
162e0c2bbbccab38c10728759e5c96b7

SHA1
0f45df923464f98cc5f655af51f31f30646e164b

SHA256
8213a9356d16fc8d08625217bf8f5a95168bacf3dc1c0413820533f8a2aff10c

SHA512
0820e5ee0c3c2dacc596a8101a362ed53037c9560dc8b76d09db1798651cb1b09136e5438fb176cefb6fa81358bb3973a4ad05a2b61622453f5ed58beb17da20

Download Submit
C:\Users\Admin\AppData\Local\Temp\zeylacft.exz

Filesize
460KB

MD5
df3d012d61af20771fd15c9b906051fa

SHA1
2cd498b119af9cac981fd2a12e55224b8481f1ac

SHA256
a5c41dc9d73516047db56803ce3837afb830f990d01dd497494e24215a5597ac

SHA512
d27e5ad78d500d2300800a0b0d9302dd0dfeb367f2d1f983645c440950795fe883acab1c5056ddfc35e08d4ddf1f008ee3cc718e914a0e6b03d21fb475b09bc2

Download Submit
memory/1400-151-0x0000000000500000-0x0000000000566000-memory.dmp

Filesize
408KB

Download
memory/1400-152-0x0000000004D10000-0x0000000004DAC000-memory.dmp

Filesize
624KB

Download
memory/4592-166-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4592-174-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4592-145-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4592-142-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4592-154-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4592-177-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4592-167-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4592-168-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4592-169-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4592-170-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4592-171-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4592-172-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4592-173-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4592-149-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4592-175-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4592-176-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4956-141-0x0000000000460000-0x0000000000462000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing