Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
28-04-2023 14:30
General
-
Target
tmpfkfb5hd_.exe
-
Size
1.4MB
-
MD5
348bfc0c42d7254bc63e482c4173fea8
-
SHA1
ef6a18df4c2d04c6c194c5cd959e714114a402ab
-
SHA256
66190693a0bc90c29db018f37585b54fe7a3d42bfb01dbfcdee7567f37e7f8c8
-
SHA512
ebabb70e503b8631210ce53d89c03275b190823e85fb1591216022c575b271cb981b2c93f63989b0179bfa6fbd807c11d1cafd43d335d2010d35b9ae9f21be43
-
SSDEEP
24576:+3y9ZjI1Uw2ojP1WQ4C8KJ/Ixl2KVpLNzwOKb3uR/kCrVKoNZXgUFqssP:B9Z0xWQTJ/uAWp53R/k+VdQW6
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD54677d794f52d2b301ce20bb3945d859d
SHA113c316cbc153b53014dc390c8fff450487e9de19
SHA25692a048196f6bec5dcfd3aeb403350565b162bc1f5bade3a256c7eac27a328c30
SHA5120bac3d98f7d637d27981b51c44f1dabf0e56f00108b02b0e088d4eac6478b2ac266f1e07c22b57ff1abd49256b6ca10b2f3faf72d09c6511a187a3b57d39ce5d
-
Filesize
1.4MB
MD5061ce407327661c2ac0a9e82debd8e72
SHA1335d78dcd16f9ad5df925a2f835e20286a32f8cd
SHA2565f462a5951d7183f0bed92f8e974d7408c8381d6d8164c947da704d4597a2aa0
SHA51280d36809d4de2eb3c587d5483babcf155bada4323d4ae50dd31aa8a3d26202543b525f5378597bd326f900dfc1268886c98d261b6b06a166061ee0eb398a995c
-
Filesize
1.5MB
MD500f74b8a917c81ebb6a38bbeb41da38b
SHA180d22d89b16933eb1af9b235672b614a64b2c61a
SHA2567adbcaf367e0157d085fe44e1406aae26225148c88b803f6ff64808907815d85
SHA512410124beb9e0c19ef3cdf4721f868f69e5dd489e343e8a9faad9c56d9b40f84fb1d3c9007083b826e111f3f9251a93acd871d297e39d92fe2a053f55f17f8d51
-
Filesize
2.1MB
MD5f6e5a3e7b2d824ecd2d97cd6945cb082
SHA1336cf4ecec4bfd030305e50347c9659faf24461e
SHA256a3bd2ac50bc6a82b6500420b5e79105ee58511fa9f521a2e8772647c134c4043
SHA512c65084d890974cf783b7b28da5bda60255cf495615631b225d08cc2a7181f9adbb2f70b2ff8eac216d14494be2656dbd37d1cb44621342e342e3761987e1bb3f
-
Filesize
1.2MB
MD5d24f647a6b3db146ec7d8d2828023f49
SHA12b0e718c8498d6876130410af84b144d6e0b5963
SHA256f2fa4a4cb45007855ff76808aa50a09156332ee118521c59b923ac679b0b99fa
SHA512fdf7328af7572c51d9f952fd9b3b9e2dbe89b20ee2e98b728acb276940020ba1c8cf1e9323bdef4a5530efa3ba99ddffdd234d8135991befccc04821a7c2c7d0
-
Filesize
1.7MB
MD5a0c03a2fb45f31f82e52026b06797581
SHA1143e2769f7af87174c76d7f265e0aecdffa72c3c
SHA25698c26aaab78b24acde24e35c898a6c4274fddf36f8d1a5b3f14fb1b64b96bdf3
SHA51251cb7183cc9b73524d0dba7425e8aee4507735043f6a61e8b74befe508c7ffe988c9c467f6b65f30b20b5b3825774d6b904e8b18b3dbb402ca9cf04c0a28ab5d
-
Filesize
1.3MB
MD5de4d51b9982aa93422b8b0279d07e03d
SHA1bd34be5a4744845869919da72a3a85b74fcb84b3
SHA2569c3fc144f044d7fffaf655c0ac7b68f3efff2ea4846734c411ad498b9d736c25
SHA512593ae4b5df1dc12c6dfcb7436df7234683eea742269d5649685551f2e57fe8622f5f340d749d267b145e8cfc09913dc2cc78c3feb109a2a7e777f93cf3f9748f
-
Filesize
1.2MB
MD5c9166e8898e8dccc28c7e6387a9959b1
SHA1472b699fd7b734285cc1bccfdfb4fcf545ef862c
SHA25643d0db2153a8c8b75a63c42fa94fed329528c00f681cef8e842364625dd90e95
SHA512a0a60facfa0580707da8b18911972e95e8c109e9e6fce57007dff1b080cc6ed0b5cde330c2837f1ad66c8bffdd86bb493dbe72796d7a93d0d0421d3501f2b8f3
-
Filesize
1.2MB
MD5e3b304aeabefec144e74803d8cc35f1b
SHA11d46dda381fe5c7e3932f56b0c9c45d96d2724ec
SHA2563d09f8071ebfc25f818feb7cf8e24e1f24fcd27e5f76a77ff0f8e3bb2a386965
SHA512d954ee44d3eb4e36702cf818d4ea498d4363586a149262c4bdd2c9680e0ed64ee6de49d18576d3890ecbc8c0e24092e0736a8e520031b6069ba97f99a291b2bd
-
Filesize
1.6MB
MD5cdee448a736ae57615357e556b0eb197
SHA148898d88ee7917d3c82212f8b2b71b3f4fbe7b48
SHA256523a931d0409d13ffd4d80ca4be51a4ab5d1ed6cd268c638917262a498627bed
SHA51250bc61326822f931b8654ab027c3b8c4ef8b4cf832f1ca1a2c5f2d9a2217a6a4b09ce8910242c2253786d383513d9252a9e3cba03972b019de248d4bc189af6e
-
Filesize
1.6MB
MD5cdee448a736ae57615357e556b0eb197
SHA148898d88ee7917d3c82212f8b2b71b3f4fbe7b48
SHA256523a931d0409d13ffd4d80ca4be51a4ab5d1ed6cd268c638917262a498627bed
SHA51250bc61326822f931b8654ab027c3b8c4ef8b4cf832f1ca1a2c5f2d9a2217a6a4b09ce8910242c2253786d383513d9252a9e3cba03972b019de248d4bc189af6e
-
Filesize
1.3MB
MD5b016a74ba87d442b59cd2cf10bf818aa
SHA192af747fab52654f6fecc7ce5d1710134205a136
SHA25668e781fec9ef94d3181772ef0607f326efd5bc111663aa0baea9b108fa5e9ea5
SHA51213f0225cd469710e50fe28974323e68b87d8a900356a00a8afda6eafbc8e1e8064781482ff3b88debbce1bc8636e8f59aac841d6b455c94db462f6b95b4519e7
-
Filesize
1.4MB
MD5efe4f3ea821e402e8ad341442afaef04
SHA1c8806c1abca2af96c35269f86f2972f256fcb1cc
SHA2561868b68bc384f1b57297a947a5a6f176764cfca686931a25c1bbe0baa04ada04
SHA5127be2cb3d6e75f3a2a331aa18fa98890c85e31961bec38bc77a3b72ce3a99b82b350333eeab17abd04d99aad4bb24987ade02751958a02f3e466bb68bfe351a66
-
Filesize
1.8MB
MD5ef0fd025211469f65eec34324a13596f
SHA1c5cc41594805a8ef24b4c86decc34243f17a8d46
SHA2566fa6e401afed5042fe9af45073fb822940a94e893582bc0694c44b38af4190b8
SHA5129d22a8b4e89229eaec9008d92668c388d368ba366f73be92844ad4de8a2235baffbe317526edf5c0ac64e4256e4dd644ec325e577d1a83d3bbd2b26e10f79871
-
Filesize
1.4MB
MD5fa03a3094e7a04863b7b89790dffa4c6
SHA103a72f97c22548932391461c34e67e9ac9cdb6e6
SHA256b7c474e968b26a12ceb42ef36d559b315e743058c3144254a884b5484fc8d3a9
SHA51254ebbdf44f5c97beee10c80ff16de2ce849fd0a7b8139634d7a8603bb6d5dbad98ef80871133ca26dadcd35c7de4eedb66a733bc496149b6abf9c3e6ca0127b0
-
Filesize
1.5MB
MD54dc592a85a63ac81493386bb7b95463e
SHA141dc61475a289262ea84f20b97bd50a2c6e070b9
SHA2566a00ae702cc2f46aa109ac884d7100ae88d1d35cd628cf4beda06a53c91eae0b
SHA512f494dc1be70812b3c7ed959f856143003ca726e968406d34b7bcc63b172511306515b3b9040bad561fa33d395660854547beb5b4744c856f635939cc08b6cca8
-
Filesize
2.0MB
MD5c8bbc7d9a020cd48a74281d72b3e97b3
SHA182f7f5ae42201081598cf1b26c9e9c5daeb1cc70
SHA256cad01cc27c2ec9cb758cba553c2f1bfd59c71271799c76a3f3659345c513d2ce
SHA512c8ae866174410ae18279669283ab73bb4b4261307d662b7c1c3ee0a01e4f267ff950470ad9eac3cbe2a27a361f70873774dd1cc94554a57d8456b59f507da794
-
Filesize
1.3MB
MD5fcb917c18dc8e52608f46ce7082ec505
SHA130a2ae16a01c7b017b19b441554fab7fb0001a4a
SHA256aaac2a403e0547ad34fe51e5f5cea6fb055d56153a7a2caae12b95ca574d0d08
SHA5120d35d0410f015776596f4d080fc0136c4cbe96ca6f0a0d4da15f5977ac5171d668c0df2543e71fcac47eb2c0a0c92cbf272c0760716b79257b13515feb9bdc5d
-
Filesize
1.4MB
MD5a495a132104c7c6934a8f305392b9653
SHA1729972c418e0c7d2f2468a665341d38ce5326dcf
SHA25626e787d052d0834ad903a42ef2baa9e9a34de23ef79a9a18086878bb5688c853
SHA512e99152f347736a33125425cb07a28956b423e80c29c3a50689acfc9e26c3e2ca3591d38d2a5b9e5a240770119e754c8e0acd712d3bb45a6cc093628f55274406
-
Filesize
1.2MB
MD5c052ca3410f3a234e44df248e57f12b1
SHA194b1294c95403bacbb5f5842e6e1e125e6a95329
SHA256df0ed51e807c8f7879f248a6ec19fbd193f493711f32fb58a00e78aca06017cd
SHA5127a5c776065227ff334efbd8e91925e1eaeaa0cc66c5a253c8f4515c25232747a37525bafeb79399297c49f218f6d76382961328fa931431494d0972f06ab818e
-
Filesize
1.3MB
MD5ae84fae952935a98b77094b75cb95afe
SHA105c3741aa2e44a070f5e163ff64ef5190ad64c86
SHA256518fd5e002183c0707c2682536a16f92e5bac74ae8952c2690feb04dccea5ab3
SHA512809bbded95f18a2b5afe8f726c005ff48f3870798d7299e895e0c08416968c7e089eaa04f84dbf69e43c0a6b24c9da52ce2a04aad734ee737077fc9ee663d5a9
-
Filesize
1.4MB
MD50f550a93d0aebcb77b613df8d8d998b5
SHA1685234bded7bc8e391b8e61135e3d4d8a6bfa5c8
SHA256b89bb38f2d280b2629683d5bf43770e866aafb8aaf95801fad80280c38ad13cb
SHA51213920c84af5c777a5acd77d14d4031f26274ec8112e21dbdcd3a72daab88a91212b75337c18c759fc2eddf3a4b5dba5aae0a164a5c9ec377df00ac51a1cc9505
-
Filesize
2.1MB
MD5d093024b04a9403865df2c675c820d5d
SHA10e5bbd1c6878d2de6b4fe246474d796bff08bd9b
SHA256aca7df02d95445ff87d1799f6bd14b79031938d1e9d0c4cf1b2b3d8d4e8400b9
SHA5126918b99ac4175f42e43d2cf1b91f42e82776014f14a7edbff1cd4c5b1cbf250801d60a0a63c5e3ee993e68b397a135e7fd186400cd3b58c0e37c5ed7afccfc23
-
Filesize
2.0MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
2.1MB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
624KB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.9MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.8MB
-
Filesize
1.9MB