Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
30-04-2023 01:00
General
-
Target
6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
-
Size
1.5MB
-
MD5
13dc441ec2f9e3f9aa1f354a4b14d318
-
SHA1
05b62c596ca78745d73514cd5d43434929955863
-
SHA256
6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c
-
SHA512
30f4da77bf1ba35334fc1812a6792bb91396fdc8cc7b918f81c6395a48523079cccc89c7090b5c21c30ab62939fa8663cc695ad7d876f083773f7c85cffc5242
-
SSDEEP
24576:TwMryIYPOfPFxgvnRnc215nETdxUA6p7GDHDCf0uEywBk1EM8Xzd:Md5PsPfgvRv0gA6pYC52lD
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 41 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 9002⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD576b1a7794dcbd77afbb1821535841366
SHA15f160ae13a418d88048e86aedd54729605cdf04f
SHA256a8c1c5a4030538991d2f196308cb2a826d35353c76ae4f606730230f0fa9005b
SHA5127c85546917336533071fb78f018d422885eeaf132bbe347df57f031e54656ec23043849e5dad5afec4ff1bdc6b3007a6b3515d9e6d43e51fc0a720d663b0a077
-
Filesize
1.4MB
MD5d88b62d5b8a97dae3c39262b8739b2dc
SHA126d4590feadcc3ab9c8104fd96ca2f9034e305c6
SHA2569458c428cf32e433ddfd56ae5f61388b74e886208baed06242c1e5417b87f68a
SHA512d9db54fadc661a90d8b7322a03a16865c7bc05e5dc88d22e9416e5b0ff882c8622b9e082454d84075f73d48f78f3e4d1cfb4fefd456ab5052248a28794b3ec18
-
Filesize
1.5MB
MD51418aee92f62a20a67a0d7d7b170fc98
SHA151af29226f1e69ba4c454501b8e070dd1a5c1de0
SHA2562e341e2329966ac3f259d55ecca2f55d9722c85a61bbfd1aa74750f7e6b5211a
SHA51257e6f09406b6e54bd427d591bd3a07787e372dbe44f791873d240a52f24ffd47474eae5ad3b03b868e5183ddf4aec11b3eeaad4eae278fa7f998b7f4184f969e
-
Filesize
2.1MB
MD56f315421a65a66f55e26ac9f11d00a46
SHA1bb9a948cc5c9fb85e847d9197fc3cf60ecb14a2b
SHA2560e5be178b245cd75fc49e94aca15870c81049eb6676fae99636eda186094f18a
SHA512e4bde756d1edfc28a6706bb7aee774051758327dca7f8892edf6df1efddbb86233ce4cfeeeba0ec49465bc25271f6c5b75f3249fe51c0cc46f6dad37ba4014ce
-
Filesize
1.2MB
MD5f1d1d72c644ad4b99fd4db1f5aa9ee8a
SHA1c8714802a3efadfbb383405e6651162cec5a1049
SHA256bf72d82394856e4a3deded7a51f2880980760b1eed290a8d28dc1e9804ced45a
SHA51278edcb6077363f09c3ecdf7da97e5d824c635e9e8311db76b903f63d6899e2727fc0dc3c8114e758810bda812df5674b0a3d122a2744506e9cf9cda776ac8e2e
-
Filesize
1.7MB
MD5c1b17bd6b6261310b13947a530b1b3f2
SHA14d18774174ae8bc1731f3344cc4e34bcdf59676f
SHA2569c9d5bb8ee330daaef8ad04ff36c9e3d0f253ba49fa2b1b19ac84a3b068c124d
SHA512f798317651eae57c99e5d8f7016dba921dcef75ff034c679d1178063c061d981c2855538561ab9e5889f3b977049672e24c35674a5ba079eababa73beb58f2ec
-
Filesize
1.3MB
MD580f1c62465c9c917953cfd3684c14117
SHA1a396d2dc9a03ec8c4dfc1ad6299e91c4bd7bfca3
SHA25678b517a01e2dd1ed903c10e77db73adafd92fdc2c38ff47c178595e012d6590d
SHA51233152614f98e613e40af9635a043855597d4f48a96e58fd8c6f1e21931c3fa14b3b421959639eab6c77bedc2076414beec9e62a11351516d591adfd64e3fc5fa
-
Filesize
1.2MB
MD5c603f65524de4a546a68464dc8aedd50
SHA1e845cb96501f817bcfc567a320fd412d8ba071e1
SHA2562be535d26570ce3a57fd56720a852a730440443c9427f6636e70a250d9d8ca9e
SHA5122f93c39af272328ef3a44f662a7d4da8c324b5b31e0ea7b59400113338d56820dc1073f66746e130b846ff99261d61f88dbdb13dd2def127c1fed4e53cd32571
-
Filesize
1.2MB
MD5294506b3b930e315f4b92d7dbd9830eb
SHA1607b6d3a9e8031a613504d5549a424e048a94328
SHA25625c51fc04ea3e4ca12b43c206d0af20960d687d8b1ff8e21c0c9c5d8b54241d3
SHA512a8b451437c9c15567efa44be16056c1da7d3504ef6f006737efbec8b0fb8591702b846cab7008bd4a20e077e6d29e6f577ce457550eecaebb0e6e126c6514384
-
Filesize
1.6MB
MD584bf45719605b126ed43ad950078c31b
SHA10006ed3fe3b7c84cf32f20e6fa5ac4ebd80fea0c
SHA25634865e7e398a7cdd789a1ec10c0d942dac1e455c5f89d7128cc43c104ff2d0a2
SHA51291ef30c12184e98e4b30b6f35d42c323c4ff2fb715211e9a6fd4156e93f3a2b31378d534ac45fc199fbc7803a12825a9a2d17d23193c41a14177bc363b96a753
-
Filesize
1.6MB
MD584bf45719605b126ed43ad950078c31b
SHA10006ed3fe3b7c84cf32f20e6fa5ac4ebd80fea0c
SHA25634865e7e398a7cdd789a1ec10c0d942dac1e455c5f89d7128cc43c104ff2d0a2
SHA51291ef30c12184e98e4b30b6f35d42c323c4ff2fb715211e9a6fd4156e93f3a2b31378d534ac45fc199fbc7803a12825a9a2d17d23193c41a14177bc363b96a753
-
Filesize
1.3MB
MD5888f2b3bb6bee8ba4597144e2d99681e
SHA18d2b884713954d7f9f53a256e8aad21d79b3d609
SHA2565d1b41f9db7fb4050966774f21018f3f8f81e02290726658d128984a3ee66b3f
SHA5128ed6f120b0758c39bb781f8b7c78b177b896f58de1b3a575bb3f8915a425454e5d2763de020faf6b909ef0f64942c82cf7058adc6383469a567b2c466176398a
-
Filesize
1.4MB
MD5d0c5aa1162f4419a1bccbd9d9b08cd7d
SHA1816dc06c98e8565fe74eb108e6fa89cff0cad2f0
SHA25687dbb3f02ad3b88a6743356bd2a3434bf39efff959d62e262e5c9a3b9fc83dbe
SHA5128620011e788b26a258286ffff25ebf22916575258db3511f1e4d29beecd513364f9ce630fa97b10c8dda3f0f6b61a27db085a387c7856a0cb81cbabb61a7ee45
-
Filesize
1.8MB
MD566edc8c6740c5ebed0e8d7f397cf1fc3
SHA1a00f2b451121064cbb57d4b5a9a2aa1f712b4b0c
SHA256238528170fbfb1abad4c2bc72d62529cbc67d13d20449705f780ca0121ccff39
SHA512b6690c45391aed56ec7de5e79230c5829235b0573a69ceab8fcd7849771549750838865f3303d7de8bf636c9d20ae5691cf5ea237c9d8fbf2c285e764e6afbc3
-
Filesize
1.4MB
MD5ad1177795467c65ff544ac9bed79fad7
SHA17e338fe5c23b332bec78a69f1a1695982ca67352
SHA256d366d0935fbc2d3fc4bd59585c66b0eb16b6895b935c8f09e8aa4a3b08b7d4f3
SHA5121fb063df447b4c86ae57e4fe64771168ca8228a24592f91d67825672d1f71e1efc59050ccb4297c6dd2a1ad408146c4dc8386e40ac361368e2919d318686a3d1
-
Filesize
1.5MB
MD57e6496d071c7c1cd335dcbaddf4082a6
SHA1169f939b6fc7c3ccce156e5baf073c0be5a3e4b5
SHA2567a72c6870bd7660975ef198510cd126ed80372171a72b92be5ed0e29512991eb
SHA51207661eb7493384d8eddaf5b7644fe4943d06319d06002b7c95f4335c9449a661e960b402033b0632be2dbaedc9527ac104b8214035c3cc4a7c9f5a6bbeb2e62a
-
Filesize
2.0MB
MD5324593adbc7766496980af1a0c742a07
SHA1ad9431af31672708bee96110910c1937667a3637
SHA25690527847284940b40566509f76f83f3809b2b6dff1b5f916810b37ef8e6039ad
SHA512a62c649eb8fe502d82447dd8cc789804ade8d05441cadd342c3f875315f43bf79f1da72d76d0dbb655656f78cba547c2ff3f32f112173edaae5b761d86ed4dcf
-
Filesize
1.3MB
MD54323fcb07eb62a6722482b5c0c688fa2
SHA189db28ae256704c2375bc3bb6589d20e684c31bd
SHA2560098b6181a251e6e610b2696fc29e927cc64941928c1eb1e593d130852dc5cd8
SHA5124032e1c96f8ab6af279ad77789af249fa9a885c6f40e158ee5d49c22442067b413faaa11ffb2017e3628d7c2445d7025621e3f66b45844ac26498ed7762ce8c9
-
Filesize
1.4MB
MD511dd37e588f0f36397d1bd95b1a55060
SHA173710aa79350b432ee6f5227806c01d88115eaf2
SHA25637de43b0bbb92c8bf0cfc609417a9b71378885fbf9bf89e50e88265de9e387ac
SHA5127beca84ae79bfe8463c43e9d60fee948c03f542a06ee1a29356fe4596956163eed1826eb6b4e0c85dfe6ef0d7b62849c5931c92fa2273cdd6696f2d86afebf1c
-
Filesize
1.2MB
MD5f4e62e80e8a4b95cac7a5a7e800284e6
SHA14d6cb969c174c40516a2ec117b30354601fd316e
SHA2568f98381fdd4af70a3568b3a414f3192a028d155c4517069b52e95d35bfa5084b
SHA5122406b778d4de70c8624742b1bc5b2c1689213debc25410297c6bc85582ef002a3f9c18413b3cefe421d3b8530f1b87d6d622f6a250b456dd34e7a846bb41dfea
-
Filesize
1.3MB
MD5d37916d40ccf8c4f6da39906b8c00d5e
SHA12f3d8528d99e195e8675b0e86ce2405839541a61
SHA256af3780ce41af3ff3f8369de5c4d95cef8621082e0d1bd11c80159f2e84afb1ae
SHA5122f5b248194985b04d53b2cde53b717c3cb157354f89db411cce5801b212e5a4f73208a0e3ab8d7ffb256f194a0927c5a79d4d88e9ad65127157f19c5d793cda0
-
Filesize
1.4MB
MD5f33942afa5cb64e1e6481f05aff8df1c
SHA1ab630aee1d341a78992e4d1caab48c9cb7bea33d
SHA2569135321434eed16dc77b8267499a15183ebf4e4471c41e33259784e7684803a2
SHA512ab898888507cdf3f046ef7e93c3411334c62e5e6395a7ee5be22bb87c7d9df8f0f95c7e2f10e4a93c0a900dbc8b0428f0f2332d6cf5e06aa1d8da1c93e58ab2b
-
Filesize
2.1MB
MD52ed8eca07520dd1f1fb37a83bdce84df
SHA100de5d735329ed0970fa1d05e14a484dba2f3f6a
SHA25699bd9eb2a8493b6edb911ee84c0f51210bb84af6928b223d4a237c953f7b27af
SHA5124ef0ecf2558ce0278df6b01fa0bfdb8fb95ea558563c850aecc09eef27a60c30f562c2a8d3f225b167db9e908cc5bb5c32fe1df1faccb8821b7bd467eedf009d
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
160KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
624KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
408KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
2.0MB