Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
30-04-2023 22:48
General
-
Target
6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
-
Size
1.5MB
-
MD5
13dc441ec2f9e3f9aa1f354a4b14d318
-
SHA1
05b62c596ca78745d73514cd5d43434929955863
-
SHA256
6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c
-
SHA512
30f4da77bf1ba35334fc1812a6792bb91396fdc8cc7b918f81c6395a48523079cccc89c7090b5c21c30ab62939fa8663cc695ad7d876f083773f7c85cffc5242
-
SSDEEP
24576:TwMryIYPOfPFxgvnRnc215nETdxUA6p7GDHDCf0uEywBk1EM8Xzd:Md5PsPfgvRv0gA6pYC52lD
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 9002⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5330ca0e2c81ee3f7b8e089587eecdb66
SHA10a1f18093709c6fff628dc6299e1eb1c320d058f
SHA25641f7156582e2d7bd18b1d96835c7109eceb06f6b3df6036dc533f5103abcecd3
SHA5126f31f8fb98efcd26e909aab19d6b6a4a343ce30bcc161ee2f99dd034cddf68a5bc34b417ed5a7ecc0c2a3a6f04671a99cf95ed346fafb521da361a428a91892f
-
Filesize
1.4MB
MD5554ba6036d2740bcdf1695afeb94f62e
SHA1192805086fda89672c982c1d72862a21161e9aaa
SHA2567ac631d2e93f8c8d9d31344141fd16fb99e5cb984054f744488cc10a0e3caf88
SHA512d9684faf700c29aaaceeb932f86b489a45d39ddadcdb99d238b0c3807bc22213fb27a8df938b988f8a062683e0193f80e1361f53f80f507e66461a4674fa788d
-
Filesize
1.5MB
MD57321be1b5c0f4f57cef22b90a108eee3
SHA1871a25b0a0bc1e01219617e4489da02a6468e70c
SHA256f9d6fa2ed02228c820224a8fa96eebc07d4b020094d39f01ad54c01cfd7c63bc
SHA51260fad0ba42c07d3975ffd51afbb4ea26218d46b9eb5a0832c311c9425194123598e15afb2c3199d4dbc561121dfa2053319a5aa42f940dcafca9da41dcd61db5
-
Filesize
2.1MB
MD5d2bfea666eee1418778946c4228f0ddd
SHA16b3a855efca34fd611404e356a95afb035d13ec9
SHA2569c58b8927b7172f3548dfbe4e3482261eb4c97808bcefeb0e88b0d7db59615d8
SHA512dc7c0130e1df2a1ba9fe08190ae1d6c1da008fa03a1b0db6eb3e5b0b0f34fc8e0159498be1dff2b31d460edb8e60c05cd6fd7bf35ddf86867641a49703b0cd49
-
Filesize
1.2MB
MD5d5f63b3aa08d8982d24c2358e958ac88
SHA1e7f3c785ce4d439caad8fb8c1a241a9c5a34f07d
SHA2564d272366924db30d0bb919170cf8a7cf34fa257542e34a9aff098d661e0e10ca
SHA512e85b58116e0afcc4ba86d4c253221fa33e4780c7ac398770f78649eca126988d85e144da78e0249bc6b49a7375e9a4c9a2a31e40161bc44b9b3253f4eb659704
-
Filesize
1.7MB
MD5d32dbb253baeaebec17a5ac36f80af83
SHA155036717a1fb2c0162490504c71c8f9fa62b3d1c
SHA25606c079f7ad6068b2368d681e852c82e6edbd53e27aa492de68b27cc68253129e
SHA512c1230d8974def34d2a125682ea941a7e879f220af308016ccf241ee310fb8082dc2daebd024b1129263ce22f6d8a8d47ab2564a9f0bf820c8549815d05387f53
-
Filesize
1.3MB
MD50438bb0f53f793925f9966757f9dda19
SHA1143de9b48d68e4ead0ff9b80d64ec90f37bdab66
SHA2563c12b14d70e83d1bb282bcfcc55ad23ae2373df7885447f8aa4e7392e612e2f9
SHA51287bdfd3f48932811469165c36cd330297ae5e2ee53c1ec654c68051f31695b8fdb46db14ffbc03f777dbe8ac13e2a346422b43e02bdb4466760f31f323048298
-
Filesize
1.2MB
MD53f216a5b8b4ce4ccab33a49680ec88ba
SHA11ac7698bea8672f7b23e958d71360b39200ff79b
SHA256640d04020025f892eea247d36fa04981baae4a7f9f17d432da4b5509088d259a
SHA512cef789c03f8885639268945c6e4c7b760ffe85475f07661b5761857dd2bef255603a7a1dedbf7dca8fd68f1b42c874bc56e859706017b67b014915950151182c
-
Filesize
1.2MB
MD5dfd36e37f7ea76f6d1634eaf911db82e
SHA1930d15f4853446dcdaaa45774c21ac80857b4b66
SHA256879843b21774ed77af903cdd3f5c5bd992c540db2d41d73dd40d8f2e14b2fef6
SHA5124910708a9c9fb9db2ab943dec64813478409fe4ee8d8ea033653d74af0c26aba054f9d921fe677ab878856e1e2c126cebe81b777027e3639c69e8c26da834f58
-
Filesize
1.6MB
MD536e303321ff2ab94f3dff94ed52892a1
SHA1993c1a47ca6f202108d739ae572afb150e36bf64
SHA256dd08eab087934ea5ed1c62ffbdfde75a0ac480b5e1eb37f0bab961de10eac81b
SHA512509331256e40ba99f16c912a4f9edc915cccfe1fd5d005e41d8b04e6873b6abdbb806a4b87aa069e5b5515bffd48fdbb5e6463a1f155a89a8fe15aec4e42dcec
-
Filesize
1.6MB
MD536e303321ff2ab94f3dff94ed52892a1
SHA1993c1a47ca6f202108d739ae572afb150e36bf64
SHA256dd08eab087934ea5ed1c62ffbdfde75a0ac480b5e1eb37f0bab961de10eac81b
SHA512509331256e40ba99f16c912a4f9edc915cccfe1fd5d005e41d8b04e6873b6abdbb806a4b87aa069e5b5515bffd48fdbb5e6463a1f155a89a8fe15aec4e42dcec
-
Filesize
1.3MB
MD5980ccc5055a4fd35e55a1844103515f6
SHA1a5b7fe74d02b89e6b42e86f3127f1161f7664002
SHA25687cfa395cb0e32e76e7545edfe3f472de523f190b857b7265376f1b9de6313fd
SHA512f7d1260078e972cec8ad88ae3347219527d06870d70305558989b7ba5d609da5d8be09d6f85ff49e617409b88c62a1fdad2da665140279d188f7dd9edd232d72
-
Filesize
1.4MB
MD58cd32c2ff3fcdbacd4201abeb7f69541
SHA1cf74e5a82af23aad88cf8c88d5434643d5597a21
SHA256a09b5eae0b2d4f5b9612a63e24c019d0f9d4c805229780c16d3441bee4d55906
SHA512c753e359b70e6c7a0bdab36c794f25558bada44c9b6690f78c41be4eb63c605bb6fdf423f97f7a0a3ef22cd4e580a4967483fcbe9f42598ba688d5814251ae63
-
Filesize
1.8MB
MD53dd4809a195b94fb895cc8e2c77180b7
SHA135099567aed979f1ce54372dcd5bad08d559c57f
SHA2569d565b6b023a5ac2aac883e260a8c4903d715c756970bcd89b864dece498304b
SHA5127af47603c90a6da5566e922507da9ee9be568322137fc59e452ec8fcf07da8410b99de0a48502197db997155ef451fd28bc72ffd11fe3b351a8c45b2ab6cc151
-
Filesize
1.4MB
MD5cf4b1012acd491d4e24aa5952648a48f
SHA145b5d2349fcd521d046016775111295f55c376f0
SHA25692374e0ada37debea9e7585a3941c8aa94ecfbcd48cd4818a99a8cc8bd871346
SHA51225b30866d893f6957f837287e92875c35ae38991576d7777803fa85dfb8b5d124996fe8e41b26fa7c22ee38e7401f85ae747eb0296ee6f8ed1ba3f0406a4bf95
-
Filesize
1.5MB
MD51074e20d6c4b51323feba282013faa74
SHA1f7f604c7c3808deeba867dc08f768fa2b63230f9
SHA2566f9d6c3055932a84efa8ccb3cd4feac98aa248373565e432e405f81fdc1d2925
SHA512b28899539f8e8d2f3a9ba9e6ff09efa076603d29fa3969d7521713a729e5081733e0fb25f9b18210b3f8fe093f62288f50160bb10b5ef64417cf1843eaa32819
-
Filesize
2.0MB
MD555557e859ab5fbdbcb20d5a09c846fe4
SHA1449adcf29df172569b9f43ea2fe48cab9bc3184d
SHA25614cdb15e4b930fd8d2359caf20185bd536b8c4fde8977624c280ad95fe456d4e
SHA512416afee3f52c6c86690e77137c4db1468de38fb080681652c1bdd796a4b079a17e51a4f8f59effafdaa1ad1c18c8f2cd3db7cf80243a06d0fb6ac584c19a946c
-
Filesize
1.3MB
MD51dfe40adc40f9272fccd69ac1f380aa1
SHA1df022cc632bab75ea9d40233f47bd83dee704b84
SHA256fc06a0a143ca6f03ffe11198d4223a9ed93f9b604a7333e09b562cb1cb18e593
SHA5120d829b48002c6b4732d36460b54e6800b61a9a86ce0266c4afd9bf66e4f883cd8c00cf94ad9c5efac2d0a4b1b157ea6f84dc06acc14adf6153f8b9035007f112
-
Filesize
1.4MB
MD54058a6e3c026e025768a0da2e16791ca
SHA12df078bcb3db0bded503ca1895846a53b5b6fec7
SHA256f2fe6ae9c6097af59ce6a8c51398e95999ad3a6a82ade69cd7bf58ccead149dc
SHA5126377340747044a45649067e984723d3b345a7fc95c8dfd914a93b05be27e5ce1a3a56c6e4b09fec6259750981b9fec78199016cdc01b3eed0c9a5005647a8d31
-
Filesize
1.2MB
MD5cf82c339ace52683d7ad9ca60ecc9bb6
SHA1db4adf1701d532153148fb9a1d7e97164364f5a5
SHA256d650687e906f5d2764881a5183bb58a86d50b7b2661b5d4b465e69948cf93ca4
SHA512fb51afdadd1b1e7bc786d3a2050edd5509f45a0876ecd79c2fb32de5f15febc47ea71e5f91de56a862884444edb3573ad893b0c3fb4276863cc1afd633882432
-
Filesize
1.3MB
MD5b97ba4d6ea85858e6fc581bf58f3590d
SHA10b6f8691cea62a2dda874130504e892e34c249d3
SHA256b845503d235e384e7dfebd3dacffa10dacfe5ab1408c4a8ff827d159acbcce32
SHA5121b630502433e9a199ea2d9f7f630ee9f799248e5166f5c53ed4eb62ccfb66e70824ad268dfe12aa34341fdb34a8f9f3c942e73ba265a32525869091f268d97ec
-
Filesize
1.4MB
MD5013d4376d98fb085e5bd6df287b836f0
SHA1ff41c41efb1bb7d7ba914c34401f848ad4680a87
SHA2561ae58662dcd4b11c8e0d4c26dedddf59e20ee67c4035cefc6fc54a5551c1c3a5
SHA512a89648f3d52146a30fd9ea7bc1fca05a73329c327cd15d276aac21b3b2fc7170c74ca764fad806ca965cf89e6cc02f0b4bb27bdf79091fb7d3382fddea5414bb
-
Filesize
2.1MB
MD5326853fae9f3c1be9e2554833869f856
SHA17d5f7929a8196744d84623f14e9289fdd212b99f
SHA2563703bf7e439971fbf38090885bb4e499693f888fd8069a657333c1d440c8ad6b
SHA512e4d6f14dee35178c53e24c8a5d5051c4d1b42d7e4dbaa641e3ca6bc656a776aac8584912e819bb49c05f976cd5dae7e7a0d16ccc5167af262d0998ea0904051e
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
1.5MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
1.8MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
1.8MB
-
Filesize
1.8MB