Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
30-04-2023 21:14
General
-
Target
6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
-
Size
1.5MB
-
MD5
13dc441ec2f9e3f9aa1f354a4b14d318
-
SHA1
05b62c596ca78745d73514cd5d43434929955863
-
SHA256
6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c
-
SHA512
30f4da77bf1ba35334fc1812a6792bb91396fdc8cc7b918f81c6395a48523079cccc89c7090b5c21c30ab62939fa8663cc695ad7d876f083773f7c85cffc5242
-
SSDEEP
24576:TwMryIYPOfPFxgvnRnc215nETdxUA6p7GDHDCf0uEywBk1EM8Xzd:Md5PsPfgvRv0gA6pYC52lD
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 40 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 38 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5e75471655e880a22f8e5852289ffa398
SHA1d2794107c54d3cf5fbfc448a7f207d80d2923424
SHA2563de6f2e0dd2cc46c3051e17c1c4efd9054adb7373b0f27a4952e8ae226f1503d
SHA5122f042988b1e791cdc4a9e7846fc7b32d42086b946d2995fc63ec6b1f83dfecbf66b3f20628a02e00835cb651bbd9b621fb349ca187e6b4dc37df0512ffab710d
-
Filesize
1.4MB
MD5c60cae38ce580bcc535a515974e8ab12
SHA17b3d03a0a1261b095a15001d05913e0e3565aef2
SHA256b75b50b7ea9030589099d7e01b9b3be83b469947ecb250a42c38655dc69a8975
SHA512f47713093af8d2e940007d9684b89c67b682def74f78d35d4ef15aa75c6670845ccb45fc3bdeb4fdbc07f6374a9e1f2a4cd9d8962ae63d59e6095e19e368592c
-
Filesize
1.5MB
MD5d6ac8747b3d503a2d1edfea0fcee8f7a
SHA15430bbb1b5e6faf8fe551ef38fa376d5c063a4cb
SHA2560fad69295b138b3b46b3325b62bf5f13e985409e1c60a75e435936432c0d7b25
SHA5121f33a0de97960bc3c190e22b33dc2aead52456acb54bf90e5dcf667890c8609b76e16310ca553d3bdb9047d785bbc4f256318a4bdc9b0bfc679e18e7f681f28c
-
Filesize
2.1MB
MD57f2c1aaa6926091fd551e46a9f8ebf8f
SHA15315550f8ec57f412977e49ad728d238e5a0214f
SHA256e9775bd6dc34fe0c7a4f5ab26152bb67270c8292a2b5a28f390a89417eb84602
SHA512393f50f32c0f60b4743fbc1c2c608ddbe65929c6ea54fb8f3089f1b24e39d4c0d65a76fa5367a2a0a9a744055f3b51202067851333a9db8a67ff44342e344441
-
Filesize
1.2MB
MD5593675ff0331dc9eb81ff044e80d3f9e
SHA1e8a890ae1d5784f9d0b177992fce56696f1f18db
SHA256636bd90e16b67b8ff3d3f81b61d08c21894af579fbca9c5ae28f00bed88161c8
SHA5122e7ef2c2a0af2cfaa311094be000f08e6dbec1bbd6dfbebbd43783ceb35acc4ddac99b29098ec5bb341952dd18cf844b180d64bcf0ffc118a89972ae9c3be4d9
-
Filesize
1.7MB
MD50f28636cdad47e584afd5674774136fe
SHA12f5c07791f480c9817764b49541d0e5fa1cc10f9
SHA25644e7c5741fc88481dbc19bd3af04ad84b3a46aa861c3f55cbdfd679df76ed4ab
SHA512bd230bfb98d8700ff16dd0bf9fc2cd30ce3b89d1f3535e7fecc6db1d4cc8de6a31595a3481eeb4f37be3c9c9dd16c04c57608725cdb04dbf479b4e66764db515
-
Filesize
1.3MB
MD5aea69fc263d70fa60e351232d91ce497
SHA18c04dc4dd0a48c717c9c2dbffd4ee5070093490f
SHA2566f56a097b230c0615f1ceeb3e58321913251ba8513feafeea7c9586492b9f19e
SHA512ec4eb5e5697b313b74dc8ff4ad41b1b761a4fae57f0b642fa449a384b6b9b4fcae86e6adb8658537b55382144918cb0b268146cc5bfdcdcfb53729f28971b563
-
Filesize
1.2MB
MD54f067006e4f7ace1558b4f6251acc49f
SHA1e7a494dd3bdf1b86f78bcfd6ccf605f6c0e913f2
SHA256751aaf2c6f2b01e1fbb176cae0ae5a8615cc9894e47d7368a4ccc1ae4cf403fd
SHA512d96475cc64809e8bd2c0db71b18aa1915f05cd9d2ff522b7c954470cbf51980503ad02f0cffcf2a7c185fa4ccfe2adb458f47cbd441758acce959952e4a510b7
-
Filesize
1.2MB
MD5d267e2b42607a3d4a57bab8d041e76e5
SHA15c4274031f5c009ed1a32ce51f0d622a30e7f63b
SHA2562afa97a15a6f94da6e6994a6890871f6b7e65870099ea77cd823e1208a74b5aa
SHA512cc7fd6699ee3c5d725da8d33757278ee03bde27731157f340727e8cb38a8aa781f58bd116f51cfc7740831af002c213df7cd105bf799ff3bf63787756cf79d99
-
Filesize
1.6MB
MD599a48311d0c9828e6634a2f2cd1b1665
SHA1dc1f9742a2a212313c096d1072c28a7deeac814a
SHA256ac1ba4c9d7126ce7e1219d1faf1490368fd4c6332f5c6d2d1c2caa160aa974d2
SHA51272ff5a5b6b9b31e4add44735139bb13b8bfa153d61b11eb067128741e65d870db6c17c1ed3f03023d724c1bcbef203d02f5c2b25ebcc911d23d4fa24de38e13d
-
Filesize
1.6MB
MD599a48311d0c9828e6634a2f2cd1b1665
SHA1dc1f9742a2a212313c096d1072c28a7deeac814a
SHA256ac1ba4c9d7126ce7e1219d1faf1490368fd4c6332f5c6d2d1c2caa160aa974d2
SHA51272ff5a5b6b9b31e4add44735139bb13b8bfa153d61b11eb067128741e65d870db6c17c1ed3f03023d724c1bcbef203d02f5c2b25ebcc911d23d4fa24de38e13d
-
Filesize
1.3MB
MD52bc8c77a277b56b1ee227a3a1fbea880
SHA1010da74ab842ec7950f6afd45195c4b8d3f4858a
SHA2564cf86d73abc862f59d14f89adfb9e141b679d4d106fc561fdc4f105dd0d7ad9f
SHA51236001a9e5aac286f28a0f56214e46f47c4bfe3feb8a64cbc3feb8033d60b78d5001bb6b6641c74af92538f41b01a216211f802f0d6e4ad5718f3269cd701d8d5
-
Filesize
1.4MB
MD51395ee6b45e184bb6e0ad2356d315657
SHA1b1e1614e7d3cfd47781eb74cf9f09a168bc12716
SHA256d0bfd60bec96ceab1485b7841ae3c17ff5680b29ed3d42a06386a94bcb8699e6
SHA512cb6267505e0315d2c42fa9a822c02eba4388dde3713962041da4929b9188f96b8bb3a57ebfc2390c69b4fc532bf4c510f6d2b8aa00ef8418ca5ccc872ad57ce1
-
Filesize
1.8MB
MD53a69e7cd454cd22868ee8698bcfa06b1
SHA10f48b0e3bc95f368b293ee332373867947ce49cf
SHA256abbdd67ea152ebb90e606f7af7d83fa1589abd2049cbaaf55420e8f3bd10217c
SHA512317bf1068bdc250ae72bfae04b8cf65791a9529e990475f2a290de7522cb26158b704fd2db3349231888fc1d8f78ebeb0d065ef10f0489c6995fce3d877aea04
-
Filesize
1.4MB
MD527dfa08da49bab0e8d7ab272b6cb1d92
SHA1c6041d2d7360548f08f18f8127a3e5af452b99ea
SHA25654f502492c89bff1e93f27c3ed2c80b2e7b7c44d1e35930ac38c798d7e443512
SHA512810e9692994ba84838b56bae7efdefb0692197ee6897ef317d413897ea6d4791337ab3085000dd402a7be34e61a57c904f4c23b31bd45944015efcd6d988f47f
-
Filesize
1.5MB
MD50836175adce0301c537aae4d9625efb9
SHA10f7a3e6f49cc5ffd6ee1b5e2debe4ffd6bef4d55
SHA256c578e83e513f7865a79dc3757b52d07cec00306193b86b98cfc767fa1cb8a765
SHA512697d5b0528b22bb510ccdfc0454f38c8910c2e242c31c67db5ff076405976156c9ab6f0aac0b4f1fe554ef0cf97f835f7019d4d97123e4ae4d53d386ff8bb731
-
Filesize
2.0MB
MD53d9d79136fdc65cd72d422bfa568c881
SHA1915a1875684d1f7a2a3d679f912d59c3cb1626bf
SHA25635f9c3f4241546bab0be876615224a09327e888ed7494fb3476c27ee815d2ef0
SHA5126dfc7c5c5beb9cbf568b7ce2ddac32f759035df57282bad77c19e27a0ca6e6cd299b22afddd0922387bb6ac1d2cf929f2110bbb933ed69c055d141276ecb39a5
-
Filesize
1.3MB
MD52620916e1e2d107525dd2f159451aba8
SHA1975cea121cbe996076b300d298fe06bf86c44976
SHA2560536d71fe0b4989bd78b527cfcf76a6190ba891380dd68e2f44f4dc1d733f37b
SHA51244c195b85f4694b991b47f06b5fdfc64ce25d19903e8a98f375aad72f4cb73770028862f835407d01e89f90b87ecafe711c2b765724a76bbf77275ee42ff72fa
-
Filesize
1.4MB
MD55d644d55a7bdc8710e0dbce4797e7e3e
SHA124a86caffe45f7c9e984b8ae0595e652aad39136
SHA2562fbf36d9d6533b7b8defb915d96a9c026e995f42bc0f86ed13545cb73f2cd641
SHA512cecee7f29a7426d25fe4ed49d6f55871619c3039d2ae69053ea93e0c41dda116f7169fdaa8959b87fcf995fd35e7b2e6c18610f6b36086db8ffd667fa3f00a2a
-
Filesize
1.2MB
MD58fdf824c4a09a3033222e81c88eb6008
SHA19e747344bf5ce18f4a1fbf2e6d68611441e571de
SHA2569152074a56a2450d3ee174e3ec0440cb2a7c60dc869a300d17ba7589914ca092
SHA51285ebe9810fd144ddb7634a7e4095d2a84f212aee5b7a84816fe824a2f65c96841524f13268cf7e81d4aa203da0b0ced3c86747ac75db376b40fb7f382271d918
-
Filesize
1.3MB
MD536f89d23d6362444a5a833ff7120dd6d
SHA13c45246f689c550f907ccd430512054d841297d3
SHA25600109931372fa106f38c2cb647b988304601456ce91895f29cd4e52ee6d86851
SHA5120cdb610081adef3e2ff4e473dbaba6732679bf6f21563e6e57cd894cdab0f42928591ad40dc06e2cff27482a910697921dad04e7c6435cd94c3884a14f501476
-
Filesize
1.4MB
MD57d2d8961c79b2af5698d0770e94e3657
SHA1c2931b2f188998cd682f609c7bb8ccc4b5bbe5d7
SHA256bb724c7ac5990a18874568c8c13e13b6e00625e51a4e1d0ede078687b166402e
SHA51298ffd15d00f60fbe8e3dc45ea3e36c9524d0ec47f5415aae11925ded06b54bf9114ff00414c48d6db6c5e1662f8aeb092d1a6e802561498e1e370fea7ac421ee
-
Filesize
2.1MB
MD519b6bb15e4dff5ce41191469d87d6faa
SHA16c6b59223d23922ce4bebf53a17090a3792113b9
SHA25648cd6d90a4b4a16f8d215cb525827520ab44d7e1d66f6506fa7166dda82b3dfb
SHA5129c34ae6f91a8abc5f1efc74778160eed429497ef9e28bd92009d3e437b73836f3f5e4cf87756b8adf786ab599916fd7639fcf1d4c50841e6f93d061c34721019
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
1.5MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.9MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB