blustealer | 1cd904a688c0d0f13f06c5c113ad638649ab10c1ed756dc65933f34bbf22014b

Analysis

max time kernel
142s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-02-2023 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Order.exe
Size

499KB
MD5

ffa979499187908e3abd52a5eb23ba98
SHA1

313c4451e3e5473732c9b2cef7c943060a91f452
SHA256

1cd904a688c0d0f13f06c5c113ad638649ab10c1ed756dc65933f34bbf22014b
SHA512

1861e3b2593934611181c71c31d2237bb8df839d555f003e8b4110a9d1ab4612180fd59af97349be0cf416a2e7fc455f7f39e62f4785deb2c94bc503985ed31f
SSDEEP

12288:/Ysz65It6fQFY4LvtsnEdCBl5cll3rVLDHqFS:/YszDt6fQnGnGWilt5DHqFS

Score

10^/10

blustealer collection stealer

Malware Config

Extracted

Family

blustealer

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Executes dropped EXE 2 IoCs

pid	Process
840	mffvxezi.exe
1336	mffvxezi.exe

Loads dropped DLL 3 IoCs

pid	Process
1540	New Order.exe
1540	New Order.exe
840	mffvxezi.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 840 set thread context of 1336	840	mffvxezi.exe	30
PID 1336 set thread context of 764	1336	mffvxezi.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
840	mffvxezi.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1336	mffvxezi.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 840	1540	New Order.exe	28
PID 1540 wrote to memory of 840	1540	New Order.exe	28
PID 1540 wrote to memory of 840	1540	New Order.exe	28
PID 1540 wrote to memory of 840	1540	New Order.exe	28
PID 840 wrote to memory of 1336	840	mffvxezi.exe	30
PID 840 wrote to memory of 1336	840	mffvxezi.exe	30
PID 840 wrote to memory of 1336	840	mffvxezi.exe	30
PID 840 wrote to memory of 1336	840	mffvxezi.exe	30
PID 840 wrote to memory of 1336	840	mffvxezi.exe	30
PID 1336 wrote to memory of 764	1336	mffvxezi.exe	31
PID 1336 wrote to memory of 764	1336	mffvxezi.exe	31
PID 1336 wrote to memory of 764	1336	mffvxezi.exe	31
PID 1336 wrote to memory of 764	1336	mffvxezi.exe	31
PID 1336 wrote to memory of 764	1336	mffvxezi.exe	31
PID 1336 wrote to memory of 764	1336	mffvxezi.exe	31
PID 1336 wrote to memory of 764	1336	mffvxezi.exe	31
PID 1336 wrote to memory of 764	1336	mffvxezi.exe	31
PID 1336 wrote to memory of 764	1336	mffvxezi.exe	31

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\New Order.exe
"C:\Users\Admin\AppData\Local\Temp\New Order.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Users\Admin\AppData\Local\Temp\mffvxezi.exe
  "C:\Users\Admin\AppData\Local\Temp\mffvxezi.exe" C:\Users\Admin\AppData\Local\Temp\snifuco.iq
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Users\Admin\AppData\Local\Temp\mffvxezi.exe
    "C:\Users\Admin\AppData\Local\Temp\mffvxezi.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      4⤵
      Accesses Microsoft Outlook profiles
      outlook_office_path
      outlook_win_path
      PID:764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mffvxezi.exe

Filesize
51KB

MD5
2134ed2666a31230c9bd0585df9108c5

SHA1
e2d6f04a2f7a501156039d171811b4040fc61b88

SHA256
3cd705626487ded747739f6198aa83c194a88b39272ee0301cb8c2c1c51cc7c0

SHA512
a64453fedc9cc8ea6c0feb6e0bc1fa5a122fc7c134209a99e0b09f9b39427c12d7adf8e0027e5e77ed09d7e771c4011f47517c46781d7ce1f0c7da3835682eba

Download Submit
C:\Users\Admin\AppData\Local\Temp\mffvxezi.exe

Filesize
51KB

MD5
2134ed2666a31230c9bd0585df9108c5

SHA1
e2d6f04a2f7a501156039d171811b4040fc61b88

SHA256
3cd705626487ded747739f6198aa83c194a88b39272ee0301cb8c2c1c51cc7c0

SHA512
a64453fedc9cc8ea6c0feb6e0bc1fa5a122fc7c134209a99e0b09f9b39427c12d7adf8e0027e5e77ed09d7e771c4011f47517c46781d7ce1f0c7da3835682eba

Download Submit
C:\Users\Admin\AppData\Local\Temp\mffvxezi.exe

Filesize
51KB

MD5
2134ed2666a31230c9bd0585df9108c5

SHA1
e2d6f04a2f7a501156039d171811b4040fc61b88

SHA256
3cd705626487ded747739f6198aa83c194a88b39272ee0301cb8c2c1c51cc7c0

SHA512
a64453fedc9cc8ea6c0feb6e0bc1fa5a122fc7c134209a99e0b09f9b39427c12d7adf8e0027e5e77ed09d7e771c4011f47517c46781d7ce1f0c7da3835682eba

Download Submit
C:\Users\Admin\AppData\Local\Temp\mffvxezi.exe

Filesize
51KB

MD5
2134ed2666a31230c9bd0585df9108c5

SHA1
e2d6f04a2f7a501156039d171811b4040fc61b88

SHA256
3cd705626487ded747739f6198aa83c194a88b39272ee0301cb8c2c1c51cc7c0

SHA512
a64453fedc9cc8ea6c0feb6e0bc1fa5a122fc7c134209a99e0b09f9b39427c12d7adf8e0027e5e77ed09d7e771c4011f47517c46781d7ce1f0c7da3835682eba

Download Submit
C:\Users\Admin\AppData\Local\Temp\snifuco.iq

Filesize
5KB

MD5
b0ab93399d2027f55cdf6f38c81acc5a

SHA1
f7fccc5c607ab7d7f79c4cc218c25a2220875c23

SHA256
de91d22e23487e5adf49b443ef5bccad801e5d1e76dbb6cf3506dce6bb18f810

SHA512
8c443d4b5bd4c2909bea4a3c975d0fa7c528119ab7ee422d99f4a23c759c747d333dee46d594febcd503774d4c82984ba0ae164470e30e8cc62532dc9f8f96a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\zxylzlmbxk.wj

Filesize
460KB

MD5
665d5cd0268ed15a92a888ce3e9e72d3

SHA1
cdb279ae18f5514f568bdb9cd535285094cc0013

SHA256
666bd98e8a6a2fab060d810f0cb81e3e2bdaf1b0c2a8c5c950afa9018ebeaa82

SHA512
cb2d73efab3a14266cb4d7837ad31fbd06e94253546140c1ba92103c7aa7b7e006a6a8e47e80372ad34079f1da960166a760e0b1bd9a7328682aa930ed8a4d79

Download Submit
\Users\Admin\AppData\Local\Temp\mffvxezi.exe

Filesize
51KB

MD5
2134ed2666a31230c9bd0585df9108c5

SHA1
e2d6f04a2f7a501156039d171811b4040fc61b88

SHA256
3cd705626487ded747739f6198aa83c194a88b39272ee0301cb8c2c1c51cc7c0

SHA512
a64453fedc9cc8ea6c0feb6e0bc1fa5a122fc7c134209a99e0b09f9b39427c12d7adf8e0027e5e77ed09d7e771c4011f47517c46781d7ce1f0c7da3835682eba

Download Submit
\Users\Admin\AppData\Local\Temp\mffvxezi.exe

Filesize
51KB

MD5
2134ed2666a31230c9bd0585df9108c5

SHA1
e2d6f04a2f7a501156039d171811b4040fc61b88

SHA256
3cd705626487ded747739f6198aa83c194a88b39272ee0301cb8c2c1c51cc7c0

SHA512
a64453fedc9cc8ea6c0feb6e0bc1fa5a122fc7c134209a99e0b09f9b39427c12d7adf8e0027e5e77ed09d7e771c4011f47517c46781d7ce1f0c7da3835682eba

Download Submit
\Users\Admin\AppData\Local\Temp\mffvxezi.exe

Filesize
51KB

MD5
2134ed2666a31230c9bd0585df9108c5

SHA1
e2d6f04a2f7a501156039d171811b4040fc61b88

SHA256
3cd705626487ded747739f6198aa83c194a88b39272ee0301cb8c2c1c51cc7c0

SHA512
a64453fedc9cc8ea6c0feb6e0bc1fa5a122fc7c134209a99e0b09f9b39427c12d7adf8e0027e5e77ed09d7e771c4011f47517c46781d7ce1f0c7da3835682eba

Download Submit
memory/764-82-0x0000000000110000-0x0000000000176000-memory.dmp

Filesize
408KB

Download
memory/764-84-0x0000000004600000-0x0000000004640000-memory.dmp

Filesize
256KB

Download
memory/764-83-0x0000000004D50000-0x0000000004E0C000-memory.dmp

Filesize
752KB

Download
memory/764-76-0x0000000000110000-0x0000000000176000-memory.dmp

Filesize
408KB

Download
memory/764-77-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/764-78-0x0000000000110000-0x0000000000176000-memory.dmp

Filesize
408KB

Download
memory/764-80-0x0000000000110000-0x0000000000176000-memory.dmp

Filesize
408KB

Download
memory/1336-68-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-91-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-72-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-85-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-86-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-87-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-88-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-89-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-90-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-75-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-92-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-93-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-94-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-95-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-96-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-97-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-98-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1336-99-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download