Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
17-04-2023 18:46
General
-
Target
8673653b4e2feb2342836fa526e90d2412ff6f61d77e693efb0172827f45c135.exe
-
Size
1.5MB
-
MD5
76a953005611843cca8ba94dc2ffbfcf
-
SHA1
af634f838961dbeb328c9fb09ab23cb1aca2affe
-
SHA256
8673653b4e2feb2342836fa526e90d2412ff6f61d77e693efb0172827f45c135
-
SHA512
06095412d5fe83e4741ab31a4fe890283c0b8b659ea7fc2289dc52e1ed2c07cd8619e8fdbc9368a4980c6e8b43161472d55d96552df2b57759e84c9a85a16a3b
-
SSDEEP
24576:8r1voTP6JZs4KoxhV2EiP0Av/1IZwA7dTej7Tz5IDuvkuwV7GkeoAu2j7NiznXBy:8r1voTP67sJoxTiP00/OH1eHVSJXT281
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8673653b4e2feb2342836fa526e90d2412ff6f61d77e693efb0172827f45c135.exe"C:\Users\Admin\AppData\Local\Temp\8673653b4e2feb2342836fa526e90d2412ff6f61d77e693efb0172827f45c135.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8673653b4e2feb2342836fa526e90d2412ff6f61d77e693efb0172827f45c135.exe"C:\Users\Admin\AppData\Local\Temp\8673653b4e2feb2342836fa526e90d2412ff6f61d77e693efb0172827f45c135.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5e8c1300ec73e78ce79b936ee888c5664
SHA15384b98e83b9bf273414cdfc9856eb8b1b4b87b5
SHA256275f4445ab8d6b70dc5ec338211a66342aae491e0d928816364cb7acdb9a5abf
SHA512a212ec5b799fd8bc65a604e972fe667e1d779f4bd8b99803c8fd83f1254d598f9c7a1b37c5f0bb4dda028fd06a404bb01eea4b78b3a9c96da9d9e2718037b730
-
Filesize
1.4MB
MD50a571e042459a8fe7b7474c9e06cae62
SHA1a36b44cf14be09a23b775578da6873d29291db7e
SHA256d5c9f794a78bdbaf9c9d67f2b4114670867b9d8d43931b44a9aeb2ce32b8ab06
SHA5121da78fd9b9ac986b61a847c9adcab628cc4d20a738e5ad636a662ecb3d28f4a0620c7b517b839fa9acdd8e02cd4c9b15a4e240e8f60369e3b5cef7e8409deebb
-
Filesize
1.5MB
MD5db69b98483b3110323c68579cdb8ec01
SHA1faa6f8e71a5dc2a570d4c74ab9f28e44f3cc8f8b
SHA256d4b75f131dc62d4cd7b42012d96273edaf859ee399ab71ffa13427ed4bc02016
SHA512deb0d72f5a4999b46abad308acf6e81b8df900a799801468d5ced5b8d7bdb048378b24c914660852b23f6dcadc9067877e17ff399e978b79bc529c1da6161ac5
-
Filesize
2.1MB
MD5da605dc35bfb3175fb3c000b24efb43a
SHA1ae5a06a2333c53e8bbbbc32f4e645ae6da8415a8
SHA25650eb837d540d5407674d5c2ee3cf64dc688a7df4c56ceedc9870e95f3779b8d2
SHA5127cbfbfcc11a42e5ee67e10ba644f91ddb3721c3fcd054c66f732c82bb1cd3b1ed3860a31b3b20f96b80b4f8daaace73a5de98e58962271031d7248eb8a64fe99
-
Filesize
1.2MB
MD53d8280a98c7d69a2f971732aad14b71a
SHA1bcf3cacfd2134e3788d5beed9b5873c6b3d781d5
SHA256141ab37df66735d786705a5bdd1510fc3ea1fd3aed1acc6ec6085263fefdb346
SHA51282b88063112beb7acc18ab7ddfa85c3841b0c7d38829f481874d38d7218266a2cc2b7f99f5e759da2648065262ae05b36a142c4ad1ef7e1469547e9b736a82f5
-
Filesize
1.7MB
MD574c6ce611e351fc375e8be6fa7ae4364
SHA1505f88466026a35c9d73febf96f8f35900b6799b
SHA256cd277f0585d7615f83549246e850877caa33edab04ef46d3df185338a96694a6
SHA512e6e0d19b6e3f494d6728b827b96bed05fbf0a99df0e04757b3785e4b44c3264d9d642f2c0c5b162a7c423267d12d869838659f035ddd2e0cb23a6c6b6bd1fd6b
-
Filesize
1.3MB
MD5814b6447e565478376718c12093354a8
SHA18aba9c0ab0f23d52999993e1578a14cc03f7758a
SHA2567524cf33a809c7b2cda395453e9f18f80094b0d369814cc39b20a613c3a0ee8f
SHA5125b6b6b71de38cf0466985d1dd0aa478b5aead7096cd234253affa84966daa57e0087825b7f256f1ae08307c1cd35776af46ba91b6ca4578fd112ff2d4ce98a97
-
Filesize
1.2MB
MD581f4ee2bb59e819f2aa065713e97af29
SHA1519717eff62efc316e3c4df457afd5f776a02bcf
SHA2568b262a3d28a7c60b35decbdf5dd2dc594241ecbb04a7000fb18cb1fd11ed6326
SHA5122f7abbec0503d1a342a737a836950ed9a5737f44ea6319b915cf8a0be9bb7a3848d75cdbe568778de38fd8778067fd9958c97f1b1e95423cff2fb691fab10919
-
Filesize
1.2MB
MD57ccb34a72e5ad5711786769cfd6182fc
SHA1b47e7495e28ea155cd9361457774ca94311f782c
SHA256170a07cd61d75ae2559f0658fc2b6a95c4deaa5272d36904a177de71dec67d7b
SHA512f52e2be67ea56a357163d2851afa3bf66d105c560637ef810578beba8c8ff18540b6fa7521f99cd51e4d5c5afc7ad8c789ed970027e1ab974528006ff8e0a2ca
-
Filesize
1.6MB
MD5aabd1c4521f2099cfe355970007a9b9c
SHA1bb1609de3c512f550ae034f611d6af2477ce8873
SHA256eec85c5e54740c540b0ee4fd6282cebf59c94d22d0e3275f1e7c93bce5495965
SHA512bf3b001e98ff593e1a66c1b24762016bbe90812535d108acfcac01b366a6a9b7372831f435393f9d3f76e8c3a1676a751af97d0fefab0209da3f20d103e613c3
-
Filesize
1.6MB
MD5aabd1c4521f2099cfe355970007a9b9c
SHA1bb1609de3c512f550ae034f611d6af2477ce8873
SHA256eec85c5e54740c540b0ee4fd6282cebf59c94d22d0e3275f1e7c93bce5495965
SHA512bf3b001e98ff593e1a66c1b24762016bbe90812535d108acfcac01b366a6a9b7372831f435393f9d3f76e8c3a1676a751af97d0fefab0209da3f20d103e613c3
-
Filesize
1.3MB
MD57a101ab728e1fbaff4042698aaa574df
SHA1e5335b9908a178a42444f7949bec54676bb2dea0
SHA2561cb7e5b1d54d6507015b6aab8805db9d49dcf4ca62014af643bbb5d8bf9f9172
SHA512a40f53aa7d6acc23095c2b72ce048ef09e5f52f627642a4e95ba110cfc8c58d473eb99354de4bdd081f8f7a33e35e4ec83cab9572421aec1b89cf92e8425506e
-
Filesize
1.4MB
MD5bc0b4a6b9d451a68dd52ccf0fba346dc
SHA11245c3dc77dd71a7168d047c9f192078a04478d6
SHA256f12f8ac6769285bbbc096bb6200edceea7ad237cea0549e2bb5d6db5994a8d94
SHA512892273197745dfe715d953c31f8b0c2365eea64438134b1ef776f32eab635c87ba8808113aac2d072c9b711a045dca5d53ee2b677fe01778c9cd173dd8f608ec
-
Filesize
1.8MB
MD5f96244340a87593bf440ad9705caa146
SHA17c74a3c69e75e7e86bf1f66557f791c6c69081ab
SHA2560318fe1d6704ffc7e9898cac1e95ac799ab92e1ffa011c7c341af67e56775c5f
SHA51204f4869654eb8a78f34aaf41c30e35c55943298fdf9d7f0b20200c7cb2d296ee4642e3470e829e8018e32ed6753f4fdbb26e4e3e3f02e58d4f705d35a4fdf805
-
Filesize
1.4MB
MD54334de465f530c75fd33ca4a87d13031
SHA131d6f9f07eca3b5957b7e6a43569eb14ce93a29a
SHA2561c45f1d55c78213a456f94e14738ce02e0d11f815e30767052d2910037388ebb
SHA5127002d5e3e6d82000f1c8c1c2aa6a38994223a552b28b7647ee26335493ea6f8a8e981dea24f9df9826b7c56986c3dbafdd8b7a49efea864591f963fa3b95c302
-
Filesize
1.5MB
MD5529982efb549e88815f4f57ea0bfa9e1
SHA1e18477848b0ec1a1c6b55091e6decf71c96e9944
SHA25689e3afc9667530bfbb5bdfd2febd9cb5dcdb1fd1696c58668925e24f8cd28d86
SHA512ddd56fe8a42be4fae4f9a87c8b4ac551288da0198c41a4bde51d00727b61fbf1f8c59d18fc2e6a71bbf2ebad20041470583299c6493647fa00e2cf09c0890161
-
Filesize
2.0MB
MD58752fd60fedf4c99a7aec044802bfc0e
SHA1e27d5ab9dcfde8c61e27d038a5def91887056618
SHA256c450541cd903f4ff0dd7699dc99e3885e4b877e71e1f82422def692b9c38c54c
SHA5126ebd10698eba03adb1785595ede95a07ec229699a647a9aa640d6ef06ac28712e10f5a521441037acf35f2869c0f2549b260d4f13e3ff54cabc07203952dc2eb
-
Filesize
1.3MB
MD568ccdb31edbb5a595bfaa3c93ac29b82
SHA1e81100d0e4a46679ba5b6b335750868f48c69625
SHA2565d621d4623a1e806272b50ee68ad93a91795387272efccd477680d7785caaaa8
SHA512908195ba4f29fa79360a904f34bd4f2d5a49a81e3281c798dc2c786e8fc16746ff33e5fada76160fdc42e0a2ad8510682b2075aef3195651a2a014cdddf9482d
-
Filesize
1.4MB
MD59dddf69ed6a4fdafe5db3dde22d4ff16
SHA11840bd2eee64efaec165531e35dae0ab5473a21a
SHA256983585cca035be9d4f04ac092dc8e2d298a2f1a9fbfa50aa340b922b9e3a1134
SHA512ecdef086d5dcfac27c98bec5a9d3a3797d410fa58592f2a4d5b3d3f6f8bdc08ce2c5c2f4649f73d900cd8ee7683a475bab80d0ca92dcfb0c4b3f6ec9ce4794bb
-
Filesize
1.2MB
MD5565678de22fb0e6ceccae4a4b124a96d
SHA1924a215ef70504fdca8f919c5fa37f2eca97143e
SHA25652fbeb55f19cd13a8602a465c4e65fc0821c91ba5b622d2c3f70c568cd310ffc
SHA512a23f5b60a5d04c5848986a7fcfc7f07183b853cf671b0406b6687b81d71e1afcc3fe04ee0e37fcae30b48c46f58ac56accba0a666da1dd67a9fba62d8667d702
-
Filesize
1.3MB
MD57a2750ac48a89b74f76084749017f64b
SHA16512bf32fb424c54d5460057844243709753f2af
SHA256740998a870fe453fe9fa460f2370bc8cbd77ff3c4cd23815123de35a6d7ce546
SHA5124f06af3e40187188e0d604d3660b2aa188ed826ff109897d76bf4a99510453be051073faabf2e6c28d9067f346282a08699ac23f6404a5bc757b3f29c05ad920
-
Filesize
1.4MB
MD5d94470aee7250ce61d6539b83b24af0e
SHA1c5e58b3d847845d1a7e089a4b88fba1617a766f8
SHA256f6acbc6707ff2709d8b691cd9d496a8f0ee21dde32245f891aa46bab06c8e7de
SHA512ee270f5c9233ba64e48fe65a896a0ed1ea0e25cfa4799957071e85f39ddd3209a5aa4ff77cc7558fafc083fc86f3bf09c676368dfb5c671d06e9ca0136645afb
-
Filesize
2.1MB
MD5c6e677383571a9d83a9102d8e6702df2
SHA15435f9a7b0502fdb4242403da7555a395156bec7
SHA256fba618bc6dc8877030677da95e200142f890201717312ee418e6017dfc2cdf3b
SHA5121ed2ff4ed4e042b7a25496ea9cfc9eecbddab305ac785943be9aa89886b7855742b2dcc8b0b9eb9875316286c5e0c13e5ad5adf44283d044c383b494f1838d05
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
1.5MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
1.8MB