Analysis
-
max time kernel
176s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
01-05-2023 15:14
General
-
Target
6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
-
Size
1.5MB
-
MD5
13dc441ec2f9e3f9aa1f354a4b14d318
-
SHA1
05b62c596ca78745d73514cd5d43434929955863
-
SHA256
6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c
-
SHA512
30f4da77bf1ba35334fc1812a6792bb91396fdc8cc7b918f81c6395a48523079cccc89c7090b5c21c30ab62939fa8663cc695ad7d876f083773f7c85cffc5242
-
SSDEEP
24576:TwMryIYPOfPFxgvnRnc215nETdxUA6p7GDHDCf0uEywBk1EM8Xzd:Md5PsPfgvRv0gA6pYC52lD
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 16 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 19 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD54f587da58e49e85abf3afe7251e5e71f
SHA1776ea9c05657106f20a65a1c4914c15c0c8fd7ba
SHA2564317784332f2208224d03b4e37e93e4681b265bc12be52f9373ed352a771e6af
SHA512b61289d16ff5fddcc3f1e6ebbd2cea7ee81f170fbaf115871e9402740d7f959244b03f0f2769868008ca51d74c9138f3baebe8f0cd4bc9b6683c62d9defbc637
-
Filesize
1.4MB
MD52c39bf2c2a6dc653ddf868ba09788aca
SHA117c836b9e4bd26a05f881342e83eddea277bad33
SHA25626f4b071fa04a98b15d622b927f0a81c1e9ebf575586485d8fcb31573a2843fb
SHA5128a1cda99186223e0c8ebf5aed116324d5a58c8aac51a877de4580db429d4d0f84d0286ee9b7848e4c51eb0897d41a35c58fcbe959fdfbf8a42b58395c5fae78b
-
Filesize
1.5MB
MD5420d7e11765763e53527b190c6171d69
SHA1aef82e258607bb29fcd5df4e0a6c4b7111bbc9b5
SHA2563d0b82642ac33c5a4b6bbf314302064789e13d966071eea608c55416ba712578
SHA5123a550a0efa8fa2a54f4b849fdd2bfd6b34ff5df67692d8d59994b6cadf111ab1767b4aba8ac7e0b0a1874a614312308037a3b37b61afe34360d7d9550e73a786
-
Filesize
2.1MB
MD560410949490387fd67c128b1b314ee04
SHA1e5e00428e8c47261ff54ac5b448e50aa77b722e7
SHA256614cc7cca1924aac9ec32f151da7736713f8298e46182d1278dd0932a274a673
SHA5123d36300446b498e52571cf1d152cd5287101eeb8e0d9678de8be87204eadd56b8d7937fe46c0f7543418f9301f13efae78e901af0cfbbec3ee4fc6b67dc141d5
-
Filesize
1.2MB
MD5ae806e0769741fc41648315fda8ce5da
SHA141046482581c617ae4063138e7e30392386d2ba7
SHA256edecf29dcc279c3605850e12284b3324d03a821acfa924b1ff9e2e7c5729a482
SHA512ef63c4022ceda8d9c15cb7b88dd5de58413ed7d9a180432c48f1450cc2950b2df1e1914e6c61ec64577c33b0b9273f1ed9da0effa419b09279e4140b78b07361
-
Filesize
1.3MB
MD594c98f4908c9d15bfedd691bcc6ffaad
SHA11ac89625c7d83939e54e4e90c4d6ca88a5e7e67a
SHA2565be814989ba26b35f2407685c3730c2f18ad2fb9dd6a863dd564550eea28c73b
SHA512fcc56f06e82ceff8084f2882c044f8c2626681e268a8e99025ebcf8e442b747547034e3f029060aba75f94c024b1fa84af7dbe15d20791f2f9d74fde69daab48
-
Filesize
1.2MB
MD5c1e0260dcf1fa1eabfd37fa09ad26932
SHA13201ac4d7a100f9e405bc01f211138f5d6137237
SHA2568dfe046b77e4d997d27d3e4c8fdb35cd89e71c16295f504b81a5ff38e022a49f
SHA512dbe9cdcafe4f96a30261f04ff4f5652f19ae02a7bc24eebe119cb143dd9a9c3212809a2eb4257c72336c03fa59ce58410f95fa9399f5b45fe68c3cd2be658c81
-
Filesize
1.2MB
MD55bdf987257196d5be9f776af68a4b7ce
SHA1cd95591083ab3833a1ac887cb47944405903f398
SHA256ec6e2e0c61fb89a0c61abc7f04cedbc8c25a679e6691c8a60771a0acc09c2444
SHA51257f09863a1451195325bd6181b2c9eac0867fc84d85083cd02126202ee1c2227525fa2e9493260055d186123c2aaca48c6f6c33f3826b6cf5f444acd801b1cbb
-
Filesize
1.6MB
MD5fa0c71cd87d59994a27674c1a064821a
SHA1d69cd8dbbbfa91500fbf45aeb5ce5cee1ee01e1a
SHA2564fa8d092896ba2520b08c875603b504324ada7f2184f6a6cd84d8d35fd9db743
SHA512c084b4b9cebda9c3b4dfe33c1f53c6943d8b0985e37178166bfcb86e62f67eaa871a9b70e8f8133096c80e19a8f595d9dc95c4227f454156069bcd1d37b8285e
-
Filesize
1.6MB
MD5fa0c71cd87d59994a27674c1a064821a
SHA1d69cd8dbbbfa91500fbf45aeb5ce5cee1ee01e1a
SHA2564fa8d092896ba2520b08c875603b504324ada7f2184f6a6cd84d8d35fd9db743
SHA512c084b4b9cebda9c3b4dfe33c1f53c6943d8b0985e37178166bfcb86e62f67eaa871a9b70e8f8133096c80e19a8f595d9dc95c4227f454156069bcd1d37b8285e
-
Filesize
1.3MB
MD57ac9666e27fa8aab251a73a19c7b576e
SHA19e2d925081111e62ce5b5a5da5e859af100a7287
SHA256bbb39bbe82ecbad440cd427d78fe32c15aaaa5b36a8a572e17343d678106efaa
SHA5125608e967dae22f68b347dc4d71714eca22e6867ff42111c3763e2c766a8d097666fcd2ce91f29a02d76b34fa3f5efba8108ebfbe46ab235c223bb99a2bbb2220
-
Filesize
1.8MB
MD516a24f3f0dbbc3f3c3ba2d73b2598bbb
SHA17317cf4aa31f27aba0d12aafdaeba59edcfa0e0e
SHA2569d761e7ecc7a492d80a5f345c0853f092974ab7340c4dfee374210c8907b47b3
SHA51270738e100218848dd7a0c458272c9fe03000ce9faa58d46a3d7fc190f659fe24706e718bc35187abb837d91068e971633123d765dfaa64c31fab8224af353cdf
-
Filesize
1.4MB
MD52e93c697017b7c13e67ca8a654ca0c42
SHA13d9e4089edbedbf960791950da0d4d3335ed1f7b
SHA256409d3f6b0949cd5ef65b56caf233392fd56fb9373232fe90b85ecb3e0946a819
SHA512771fe517588dc915f0ef4a46246bc013b46c5995add4b7873eff92162ef8a0a6ecf19fcd35a8e852ac10e05992e9ec357c3b8c16c595716e2b81d1f605e4686e
-
Filesize
1.5MB
MD5e7c154dac750a527c1bd5c4cb49f1f22
SHA1712e72dbb41d3945b13317c65e61fba17c4ddca8
SHA2560bdd0f775d50cf8828b72443160c97399d5e038d73b7d5ff09dd5a210d4abd74
SHA512792c64c8c8f3ce6a1fcdf50aea7db5b5f78493ada63996a8872ee11d388196bed231d62839803e5190499dc6a126a049cc7c06898ba43168eee7d5c8fa6ba0c5
-
Filesize
1.3MB
MD59bb75136029908de1c0670080558b02f
SHA1dfcdbeac59b83f05d73b7cc7d7a78f646f40e002
SHA256307f564c705a89b9224bdd21b521402dce42feb3102b06f342bb8b728e68e05a
SHA5122b4d757e74b9c10f8aca9912800a1215a0e7051b02943bfb28b4a6b2d416d9fb3681e4505db3173e19120640ecb9295f4b92aebc79a5d759619154d8b4bbc287
-
Filesize
1.4MB
MD54fc7d7df453218a727b5b55e7827d258
SHA12612d33932f7a01d24e7ec65e5f53146ee35796c
SHA256326a1c1295a2b666d42e19037352d4bfb5edb48e8ac656cd3affe74526fbcee5
SHA512aa275d7dcad7416b43e0c7ae0adacdde8581724252928d52fefa06832f55a279a2a3baccde4a1c1e2ddc46fb33ab49bc974e8b73c537d53ae855f2278b2bcaba
-
Filesize
1.2MB
MD51d0c6acba38829e358dfee08d98d6f6e
SHA135f35a3c085a3b50b4b3cbc4c1c3e2ac10614560
SHA25691d69975bd9dd8d8dfdc4c2186b50b9000a012cd9959571aa8f9038578ecdff7
SHA5122db031fc12b177b16e569e7fcc1ef46320535412ee862e629313cd9f6865bfbce1dc13dc48a0d1c6833eb139d8e3bd05644372e1a3a9456a19595603e34a740a
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
1.5MB
-
Filesize
40KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.1MB