Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
30-04-2023 22:51
General
-
Target
e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998.exe
-
Size
1.6MB
-
MD5
170860057f4aad06ddbeea0ca2b3f1b6
-
SHA1
db04c735b769df458518f959ae7eca39cfa06213
-
SHA256
e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998
-
SHA512
f8bf57126bad026be2414121c798d5688119f06312404c35dea3f457deb717f6422291f5401178586fd23055577f893b4e6236e413c909e3b526c45d3b957766
-
SSDEEP
24576:uU7taDBzgNEfeEvFTMxdzYPh1ogay/zj1weNgcHFx5MpfTjU/c7jNXPohE:uU7PNBmMxdEvogdzxzHFx+pfTgE7VPI
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 37 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998.exe"C:\Users\Admin\AppData\Local\Temp\e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998.exe"C:\Users\Admin\AppData\Local\Temp\e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998.exe"C:\Users\Admin\AppData\Local\Temp\e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 9002⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5f3bb6bef80c04f2712e398512cf60d78
SHA18f145920bfe9c3dc6a4d3d76e9f501ee3777ab54
SHA256001dc896d0731b019fd937f2c3aca9fb179ec1480906d0781dec4e4a18104619
SHA512585492a7f25a4fdbe3edadd0d3269c0beb634677697518765383471c5710e5fcff8aa7301883976f2961abdd80698b9078549eb4e470dfc88a80a2f434372feb
-
Filesize
1.4MB
MD5bf84491ae294df0bf48a27a701799dfa
SHA111ca019823c40034a219d92b88d03bd8e0f6074c
SHA2569244b213bea74533a08146a344c8aa87ee33586d0ae2dec633e9263ad3474bff
SHA512c628e0f0733d451bdd0a40cc4043f2143ded877e5bc0d8132cdf69e82552062597f701b08bb588cfaa00814e23460ea7c2a8445c9aca8b5b4835a7fa1dc0f75f
-
Filesize
1.5MB
MD53a3e310fa636290fd68f3577330ef4de
SHA1d63cc8a7e8c1cde1ebd0e99152bdd135c907f592
SHA25664865128caf10c9b65dc167afde928630af11340f1c4f105a320bbe4805e747f
SHA512571bee3104d213fc35e67397995ee313504dc8b7d1546bd9fba650a6eb061cd7c0213e605c04b29648edb9b4abb81cd723e908572472924dfcbb65fad05518a2
-
Filesize
2.1MB
MD5a8956f7a864cdd5859bfdb74a7543ba2
SHA1f958ab932bd8f2da73cb2a86312f7f83b4dfb18c
SHA256732030c94b54dcfc198b033a0eea3ccae67abed66c5a31826fe62c6c8f14fae5
SHA51212577d5794d861599eb4100aa8fb821ce5dc99c63481d44fa545f82c0a95a5e5faa1fcef88096ca0ad046ca64fbb6fe27e4770498c2ac9f71314f94ef2368191
-
Filesize
1.2MB
MD513d63607f9043135b2232b792d35e823
SHA1bc436e29df483b3f3fecf32a1d74d865e6103322
SHA256301859dbb1bddcb8535bea596cce319dbde774d044f9ab7e0818a831f7e752b0
SHA512c01eddcfc314b42876553240c3e5826268a180f1a046d86fdd7adca9119e9a8986c55afe5f81ab5d5143148198964320bed2a1f8c4428c2d6ba1c96c666d2778
-
Filesize
1.7MB
MD5850ddefc9e528252d978c8f3f539b2ee
SHA1657112dd83312c087c12184326ea848c2f18853c
SHA2565a179adc30a1928f7780339f07e100031ff8876322fe664f5252e55a18f1de51
SHA51263dde54c5c7b24ab8f9ccd04cf3f43bd945e66137bfe084297d1a0dc51bccb24fad61ad61158f3d37f6fce1d0e5f2fc50f95ddb329dc50a0feceb6a2ad18c915
-
Filesize
1.3MB
MD5c645ba84328c91191dc4899fa91c1884
SHA14e6df1b5b636d26aeb6e3b5cc0cb167f2182ce04
SHA256c5cde7f38b21c4e86e94047b2836c661d5444804c06153c653cd570baa89bd24
SHA5124af3c5e5d4d00a0ccb32d8b812c9b23d0d79688675741d0bb704e9e5f423c4f587d232e1debdec69ff4172cc70dc8f27eaa07ceea418dbd520594c2b8f0a8e93
-
Filesize
1.2MB
MD55f50338dd547e2458aa3443907812cb5
SHA142a5038f2057d1b0c9d425d5f26fe092bbbce5c8
SHA256cc17cb24b23b989ed298ef2ceee8cadbad03441fc5eebc4b0170bb271afeec3b
SHA512b79b491d4f40fd15998bb560a53a7216e2acbf03746b08f17d2e4bc436730a00958b2e57a497b83da82e91231c5fa2a62501306db9eafa08ce123258559fb5c2
-
Filesize
1.2MB
MD56cd32d2e79814709eb53c62a08885fff
SHA131d6d24271dfc08c4010d4d1614673e4a67b8653
SHA2569be683730c7f151fe2d05f7d524f122265b52832c3ac644338b787129cc5ea5a
SHA51251ab5cfa810a62dd74642f7d4c3abaa4f5e302e883b2c90d4d368d810e6561683498bc2f201a6728c431cd0f2414219ced4ea5de97adc55209b40145db54799f
-
Filesize
1.6MB
MD5e7f0e1be7e2bc06b8403023612e22082
SHA18983eb3d02953eb62cece3f7ab711b0fb2b2ed24
SHA25688a9c027512d65767f669070a15b9ebe45b43a5389aa0230b0f448d9f7017726
SHA51205d5568723625354d4588eaf3b2b1503f95cec335b558c22799a4922504a629da0dce439cb2e05ab79964e0eb98776b53e4c53a864867c2440b7b7fd14f829f9
-
Filesize
1.6MB
MD5e7f0e1be7e2bc06b8403023612e22082
SHA18983eb3d02953eb62cece3f7ab711b0fb2b2ed24
SHA25688a9c027512d65767f669070a15b9ebe45b43a5389aa0230b0f448d9f7017726
SHA51205d5568723625354d4588eaf3b2b1503f95cec335b558c22799a4922504a629da0dce439cb2e05ab79964e0eb98776b53e4c53a864867c2440b7b7fd14f829f9
-
Filesize
1.3MB
MD595f111ae623631e73236ca50e009c1a5
SHA1a8839a336b6936fecd540f27beba1b753ce3e010
SHA256f65c249cee96779b3c4aacc435f3275f7ca2472b78ba89e5928d3ef3be9f1031
SHA512d4440d7436d3d8dfa374088fad45060aee7206920966eda19c59fc757ecd357034d220ff543380a2c525fa870406020926df5350ba5574b9e6e59e1af1ce0c11
-
Filesize
1.4MB
MD5e6b122304d3d425a163dcee00aace373
SHA17be1bdd02f77e71bed863f82a48936e452329920
SHA256dffb7fc7e7a98254c3aefe91cee7d3e4c062497d853f36e69dec0b5938bea2cb
SHA5127091360f4ec697d8c1ba043bac51d9ee2a181026e80d2fcd316242764cd974398cba50a1de9472db4db6d8625ef9a99a8a7ea65fca2db0bf7958342407fa7a0a
-
Filesize
1.8MB
MD5fb071f3a934c95665273d37cad3949a3
SHA1251f6bce8744acfb675250540b6da7af2230b1ab
SHA25683e4553207a54857a22a5540f0d0c185b4c701735483c41daaf8dad322159bf3
SHA512d21546564a2defeae9c43e8a1964a07c66f52e63dd38c6c718861cbb902a8a68474f3456aa192bea41e3d2ab411cf572bab1b8759fb6a3c3f3813ed8841cdac3
-
Filesize
1.4MB
MD505b02d8ba83d0cc0129d5c8771a66901
SHA1d361f794419b4df5ae5fb1aad0e6d60f665e7576
SHA256a919e2d28c7d609959a476737f106ebebc860feef43c442caa4f5348d96a6d6c
SHA512e78ad294f364663a0927c5bc5ebac37388d2813192e5ca7c845a3012150f96f694518e37955adae03578b57e814c3265c03a065da9b8b816c1498922b6f3630a
-
Filesize
1.5MB
MD56e9a2c6c8453b6c9851f810223baacfd
SHA12001ab98e0a28025783dd882a1a56e92c71bb663
SHA256b42e8585f520a2a2cca48f85aba1bb67ee4ac699b77b1761420105a8a189c997
SHA512b489762198b8ac22be747745c28cf7c678a401b781f54cc90d4b0de1e04c0ef0d7b7f647fd9100a6ca0d66b3b2a6586d108c168dbb232beb2156cc5df00e4ea5
-
Filesize
2.0MB
MD58aa90865a0332be88ea6973c10cbbbee
SHA182af051f712b88294b60ce9d30c7ebee07f71b49
SHA25679d363f4624ee9617dda55655fd5f7b825302114a5e9aede0ae2389c83777929
SHA512c55d183616352f2a3e11abe84953ed5af57d2c66df6196e5ba4f210374ce734728a097182ffe5b6122ea8886ee6c36540a7fe512a0c2a9a5a82ef4d5e53aa333
-
Filesize
1.3MB
MD5fa00dc6fb032a844f3b10227b88d864f
SHA1ce5ca0663f8d8e01c186428091a5fd73c524a8e6
SHA2569fcd871113624fa4f3e18759c4ba2c8cf6235b93a13b02703982cfe91490b18e
SHA5120ff330491fc795a8f6af50eb1943252c943f2012574f78a7097ec8003c6185fe83ce6ace5200573cfaba2664e02a69c2ef6e4efdd10f57c52ecb6a8565488e84
-
Filesize
1.4MB
MD57c99149d1d0e1e62030924f660435fc6
SHA10fae2d89f342fa42a96d7d1b04515baf54851019
SHA256d1556bc97b9be895ced1e3e5dc1132f4daffc0f7cd00f6339f3660a6ba70cf1a
SHA5126439053c79d3406c6927df9e1b0b4d823bdbc9e6cc2b335998a9832de68602e95c4ae326ad5016211a563c83fee22818f97f4a0d89acbc54ddadd2d1ac876f48
-
Filesize
1.2MB
MD507cecd56866294bdc6e04a161ec05aa3
SHA15965af729505e7184b8ad46787db58ef3543eaa9
SHA256c8e18b22ff4d76a0ce48454a5f98397ce88ebe812f552a63aa852de72e00a0f0
SHA51287f3f9ed6ab2c8e42384fe58179a8e12997f6b1b0fb3a33876ea869fdf03dbdd4d20e36af8a4ac7daccd5eefa1cb2ec5e67eaaf8bfd29e73a3f0d71bbeb3d241
-
Filesize
1.3MB
MD521ca4ac86c7e4965ca66f1701a2d7d0a
SHA16cbfe1e3b84a295cb289621742d03e9567622164
SHA256f87e4bf510aa34e32e88a84f3e1d1c2d3c70cb67b4ddf0c0ab2c46b9d43e9416
SHA512f82e371af3445ab30f59c3d33e84b47e556d5118dba84d2bea12c890b9a15554c091b09fc3c79d2b80c770935f0f12f846809826da73ac557530d3b44c29a634
-
Filesize
1.4MB
MD586e64896661f6379a1db1cee50abd706
SHA12c62783de54b5a9beff4dd059b68adc09bf64b4a
SHA256acc3e26b20dd1903b90e5d3133116b3a8089c6303761cc3ea3756b7970fe1f9d
SHA51207e73f8ea13abb8461f8a767b17d39056478100b2e14befd4c8a46143c5db302324991e302073f9e7496d3ebb938c1326e80e02ca77eeefa5fa371256e20f1c3
-
Filesize
2.1MB
MD570c6176f2074a15e2876026141d9c62e
SHA1d2a247870e822e3a964dc0d1974ef2eee4ba2fa4
SHA256be4670596082f2844a9ee1fe093400118824a40a4a359ec2f6cdfe67e47906ec
SHA512d3484e9ef07a3dafe009409b9cbb8c446fc5b48253a003fdaefdfe2308de326e6e8877b00e61e2fb6788f3b3ff57e2cde87186ffd10b8c5bbb91f35db2c8bd5c
-
Filesize
1.3MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
104KB
-
Filesize
132KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
104KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
1.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.3MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.9MB