blustealer | 496f735b755cd59ebad7a163c57147e81adb648ae981032dd62647bd05ea7fd2

General

Target

PO 152421.exe
Size

501KB
MD5

460bdbbe5a6b8bd3f887c8b6fd4128a2
SHA1

891099bcbf82de10e1b197d2c42b2044dc0bed46
SHA256

58d5286e5694f883d2452a81e5f6e77413292ba388300a6e44dd0f91e217aff1
SHA512

b741e4bc33762adc9dee71f7a348ec9e7615bd4631bb73c39e4d69a01e8d469a3eb1aa303c691e2671aa939c223c6fc4a5bc05b2dea23b40f3e5422e2b4b3c6c
SSDEEP

12288:/YFfpyLOuydXBmm+vie9mUX1NqRBchWc6P0vMLxJRg0ExsOPn7jhPhl9iqo+/:/YFhyCuCoie9nFNqgL6P0vlLxVP7FT93

Score

10^/10

blustealer collection stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Executes dropped EXE 2 IoCs

pid	Process
4872	zabwn.exe
8	zabwn.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4872 set thread context of 8	4872	zabwn.exe	84
PID 8 set thread context of 3732	8	zabwn.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4872	zabwn.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
8	zabwn.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4872	4656	PO 152421.exe	82
PID 4656 wrote to memory of 4872	4656	PO 152421.exe	82
PID 4656 wrote to memory of 4872	4656	PO 152421.exe	82
PID 4872 wrote to memory of 8	4872	zabwn.exe	84
PID 4872 wrote to memory of 8	4872	zabwn.exe	84
PID 4872 wrote to memory of 8	4872	zabwn.exe	84
PID 4872 wrote to memory of 8	4872	zabwn.exe	84
PID 8 wrote to memory of 3732	8	zabwn.exe	85
PID 8 wrote to memory of 3732	8	zabwn.exe	85
PID 8 wrote to memory of 3732	8	zabwn.exe	85
PID 8 wrote to memory of 3732	8	zabwn.exe	85
PID 8 wrote to memory of 3732	8	zabwn.exe	85

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\PO 152421.exe
"C:\Users\Admin\AppData\Local\Temp\PO 152421.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\zabwn.exe
  "C:\Users\Admin\AppData\Local\Temp\zabwn.exe" C:\Users\Admin\AppData\Local\Temp\mcyherebmfy.ki
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Users\Admin\AppData\Local\Temp\zabwn.exe
    "C:\Users\Admin\AppData\Local\Temp\zabwn.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      4⤵
      Accesses Microsoft Outlook profiles
      outlook_office_path
      outlook_win_path
      PID:3732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dvdgluqjpl.lu

Filesize
460KB

MD5
8a6178215aecfc693a8c1ed6b603c9ed

SHA1
48c3dcdd96aaf16f6b23678730659ecffb608800

SHA256
79e70faf30babd56571cb125d18aeeb004cd672e7564f982cd266635921a8540

SHA512
4615144dd37bcb20e3668ac317d3ef49495fe3d83d237ff85297b638c7231c0021d75ed50bfc195406d886ebd4098efb5a2b4847eceaa8dc1370834657fcc36c

Download Submit
C:\Users\Admin\AppData\Local\Temp\mcyherebmfy.ki

Filesize
5KB

MD5
4f7e253adbf25df53a7a3f74981cf3c0

SHA1
a4ac4ee5bfa12232dc7e5eaae5bbbd3be42f9831

SHA256
e37eee65e86f850c12436f581065ae185612e30ed4fbe9ae4cf4e9c9d6e65fa0

SHA512
7a0839e7daff273466e7a3e411f2aebe2c57ecb80a10246ea091dacda2dc67e30b0c30c93571a6ea870a057f726de1c10845c2307ee121b2d23c9ecf3ae258c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zabwn.exe

Filesize
54KB

MD5
62b62b17b3e2090607d52c9fb1fd304a

SHA1
9b52577f421ed09935b71b8d4dee2b38276f6b64

SHA256
e331eecc8dd8dc9ef2352e5bf24948f7f763a5785f6f778d292b30ecf1fc695b

SHA512
a51c60a8d5ed4acf96c73000d971e6b8f00ff7021f5263b508dc89d089d71e1a7ab974f23228cb713ced638088021b878891f39cf094ce5f6438b2a416ba2ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zabwn.exe

Filesize
54KB

MD5
62b62b17b3e2090607d52c9fb1fd304a

SHA1
9b52577f421ed09935b71b8d4dee2b38276f6b64

SHA256
e331eecc8dd8dc9ef2352e5bf24948f7f763a5785f6f778d292b30ecf1fc695b

SHA512
a51c60a8d5ed4acf96c73000d971e6b8f00ff7021f5263b508dc89d089d71e1a7ab974f23228cb713ced638088021b878891f39cf094ce5f6438b2a416ba2ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zabwn.exe

Filesize
54KB

MD5
62b62b17b3e2090607d52c9fb1fd304a

SHA1
9b52577f421ed09935b71b8d4dee2b38276f6b64

SHA256
e331eecc8dd8dc9ef2352e5bf24948f7f763a5785f6f778d292b30ecf1fc695b

SHA512
a51c60a8d5ed4acf96c73000d971e6b8f00ff7021f5263b508dc89d089d71e1a7ab974f23228cb713ced638088021b878891f39cf094ce5f6438b2a416ba2ec0

Download Submit
memory/8-154-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-174-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-145-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-149-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-178-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-177-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-176-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-175-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-166-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-167-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-168-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-169-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-170-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-171-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-172-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-173-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/8-142-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3732-152-0x0000000005360000-0x00000000053FC000-memory.dmp

Filesize
624KB

Download
memory/3732-151-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/3732-150-0x0000000000B40000-0x0000000000BA6000-memory.dmp

Filesize
408KB

Download
memory/4872-140-0x00000000004A0000-0x00000000004A2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing