blustealer | c26bf76c00885577a5aeacd05387893d936bf122aaf3999dcb0dee3be14fcfcd

Analysis

max time kernel
143s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2023 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Purchase order_pdf.exe
Size

792KB
MD5

3b156e7eab24fbf17d682c7d889b85d6
SHA1

4385230e53f255d7db8b91844f2c67f1b16c1c96
SHA256

c26bf76c00885577a5aeacd05387893d936bf122aaf3999dcb0dee3be14fcfcd
SHA512

879a687179a41ece511e833f967a9d2ab6daa937c4339237fb07735fa53f09bfd6978bca4115af7e51b496e0b323df9bdd5f185029a637550c6b2901d4873bb1
SSDEEP

12288:XAOsOorAeJPzsJnxfBN9UpRQQ2FDTm3U+o1N68vlU0WhmtVSkYRUVmU:XAOcr5axfBYp6fDMkzRiQVSkYqm

Score

10^/10

blustealer collection stealer

Malware Config

Extracted

Family

blustealer

https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4156 set thread context of 2216	4156	Purchase order_pdf.exe	92
PID 2216 set thread context of 2748	2216	Purchase order_pdf.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	52	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2216	Purchase order_pdf.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 2216	4156	Purchase order_pdf.exe	92
PID 4156 wrote to memory of 2216	4156	Purchase order_pdf.exe	92
PID 4156 wrote to memory of 2216	4156	Purchase order_pdf.exe	92
PID 4156 wrote to memory of 2216	4156	Purchase order_pdf.exe	92
PID 4156 wrote to memory of 2216	4156	Purchase order_pdf.exe	92
PID 4156 wrote to memory of 2216	4156	Purchase order_pdf.exe	92
PID 4156 wrote to memory of 2216	4156	Purchase order_pdf.exe	92
PID 4156 wrote to memory of 2216	4156	Purchase order_pdf.exe	92
PID 2216 wrote to memory of 2748	2216	Purchase order_pdf.exe	93
PID 2216 wrote to memory of 2748	2216	Purchase order_pdf.exe	93
PID 2216 wrote to memory of 2748	2216	Purchase order_pdf.exe	93
PID 2216 wrote to memory of 2748	2216	Purchase order_pdf.exe	93
PID 2216 wrote to memory of 2748	2216	Purchase order_pdf.exe	93

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\Purchase order_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase order_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Users\Admin\AppData\Local\Temp\Purchase order_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase order_pdf.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:2748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-140-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2216-143-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2216-148-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2748-146-0x0000000000580000-0x00000000005E6000-memory.dmp

Filesize
408KB

Download
memory/4156-133-0x0000000000750000-0x000000000081C000-memory.dmp

Filesize
816KB

Download
memory/4156-134-0x00000000057F0000-0x0000000005D94000-memory.dmp

Filesize
5.6MB

Download
memory/4156-135-0x0000000005240000-0x00000000052D2000-memory.dmp

Filesize
584KB

Download
memory/4156-136-0x00000000051B0000-0x00000000051BA000-memory.dmp

Filesize
40KB

Download
memory/4156-137-0x00000000051C0000-0x00000000051D0000-memory.dmp

Filesize
64KB

Download
memory/4156-138-0x00000000051C0000-0x00000000051D0000-memory.dmp

Filesize
64KB

Download
memory/4156-139-0x0000000007FE0000-0x000000000807C000-memory.dmp

Filesize
624KB

Download