Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
01-05-2023 15:17
General
-
Target
e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998.exe
-
Size
1.6MB
-
MD5
170860057f4aad06ddbeea0ca2b3f1b6
-
SHA1
db04c735b769df458518f959ae7eca39cfa06213
-
SHA256
e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998
-
SHA512
f8bf57126bad026be2414121c798d5688119f06312404c35dea3f457deb717f6422291f5401178586fd23055577f893b4e6236e413c909e3b526c45d3b957766
-
SSDEEP
24576:uU7taDBzgNEfeEvFTMxdzYPh1ogay/zj1weNgcHFx5MpfTjU/c7jNXPohE:uU7PNBmMxdEvogdzxzHFx+pfTgE7VPI
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 23 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 37 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998.exe"C:\Users\Admin\AppData\Local\Temp\e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998.exe"C:\Users\Admin\AppData\Local\Temp\e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998.exe"C:\Users\Admin\AppData\Local\Temp\e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5129ca431d5dbfc2490ba5d333959163c
SHA1dd47e5ccbb3dbebdd8c6d348b3f9d7a020dd5ead
SHA256a3a2f1088ef6d79c35e56c915e4f4775f6aebdc235159b40a9d4a71d84c2fbfd
SHA512c4341af7197f04c6c22490d8316c65e8b13a1fbd7819bc88115a64c0f211324407d769d7c1a279d05cd537f10a0f3832b63ffe2ac9a51198a07bc86d03ddace1
-
Filesize
1.4MB
MD57c2053911bfe64722a65e2b571627427
SHA1c40d7828bd313c681f9db02a8b9858470ade7e88
SHA256e8dc7cd4d8125e15d1e23766c0ecc11fea62e37f710aeb52fd230aac0807f6c6
SHA512e744571f0e433adf37f670339e4094697c5745efec0c3552f529474b597d20a456dfdb62f450cff9a798f8077fefed6f7ca19d27b18cf261d08f1083008ed370
-
Filesize
1.5MB
MD529002e01a8b6d904c54b5950fd174abd
SHA1ddbb9724e12a1329bd42de789ec3f3735a64ac36
SHA256960af897a17c63ec565b318c3c56db633a6c0e911c664efad44a9693c5c11a6d
SHA512765b193e41689cf397d8aac5a201951ac28d30058cd519c1d6276d82497207c806d2f907e34e486e4cd0e68b036f80a2252bc9a677606716a80bb7ca0672253b
-
Filesize
2.1MB
MD56c1a3be47820069b24b3755a91a2c36f
SHA1869258d867583ba1d1ab65861f4993a64008e702
SHA25698ce20b587430370e3f32d2356fb81b2c86ae285defea3e18b84a66b71eec505
SHA512d996f226c6ac5274c705c43c43b9e69d44def441c46781d699d054de5df62dadccdab1cdb74ed76568b476333ee46490c0da3a8fc6f17a4081b82560e7b53f2a
-
Filesize
1.2MB
MD55bb9ab7da62587e792c8c03fa8ec4f83
SHA15e8e810abd94f2100b2a265f78245dc5f5830776
SHA256347640df0a7f73fff0ae6f28ffb147407000d89f5b9074d4b84124ad2cae3340
SHA512876021ff8ce144030a0a6e8618f357e45481eaff9d65ec8db67081dbc2a515e057bcaaab5a3877cc688afa1a9d1b5a78c91cbd1059b44b1b89f8585454956133
-
Filesize
1.7MB
MD5753b3814e9a8d04665f0e354012cc7c1
SHA1de36e5b6fc6653a00f646ba45db61323cf616850
SHA2569e85837052d6ce55a7325c70ed20d30f05819699e2d41012e5380a9f6d019712
SHA512b1ee09af5d0921ffceb35b7618ba8b660ed42c387f297b1cfd0ba09a9655afecebe13b8133f4e5e715fb1834d664c3e1c757968d39d96ffadf13be9ffddb5dc4
-
Filesize
1.3MB
MD563c1f61300003eac8155af679de7f7e2
SHA17af98ea54ff476bcbc961649dfedbfca2a109aa1
SHA256d1682bf788483b1679aa1d0861200ab689c60d895664f5e4922a603cf2917c5b
SHA512f48df6df053049d4823a757a4cfe92aa91423322522e114c0784f8f5f252e6e165eed673480be450ee7c75d35d52b2d5e6f7990998114907431fd2912b3c4ba6
-
Filesize
1.2MB
MD59c15690925d8092d4d4a68d2a7a82f6b
SHA17a0c39d2d743aa23623345e7b96e595f9497a676
SHA2567ad7766c56d0af5ad61853d10b7c333eb9d14d20748c77aef76cc236e578aaa8
SHA51295ebaf4b3d5ffbab74a11c7b0b48a38397cac86dc54ba5898d19eaae1a499ccfb16a697a36ec59e359e5b2df3246c193bc290d9854619e397617052ca797e7b8
-
Filesize
1.2MB
MD54b3165365efac74e0dd3630748c93f92
SHA1516f1d7f6d9a14b836d31e396e6cc4498ccaa0ec
SHA256fc298c83a999fffe3c37d5f20cddcaf8012995361f322c9e0d284b53fb4750c1
SHA512dfe618f9ba2d3aa217f2a911e28ab035b632cd6612fcc730dd6378a57c25a6e047d29e87c054bad6e1b9532bc123ca30f2d4c10d1042ec211e5aa05a1a6a0f99
-
Filesize
1.6MB
MD5007ace20518c99a4b2225b7d81591377
SHA16272aaaaaa0ed82c93ef46cf8a3e05b161350aff
SHA256a5f03b7e4ac30f4799dc27df38d25cad043c8d5b9043b842b9762cbf92d90ba1
SHA512879d0059a2396f4610edc75ea0e7cff9c964767ea1ce638e713501891eb4b22fe67e8948b1627f9512ed453b29ca773681ebd459a9aa359007123da1c552188d
-
Filesize
1.6MB
MD5007ace20518c99a4b2225b7d81591377
SHA16272aaaaaa0ed82c93ef46cf8a3e05b161350aff
SHA256a5f03b7e4ac30f4799dc27df38d25cad043c8d5b9043b842b9762cbf92d90ba1
SHA512879d0059a2396f4610edc75ea0e7cff9c964767ea1ce638e713501891eb4b22fe67e8948b1627f9512ed453b29ca773681ebd459a9aa359007123da1c552188d
-
Filesize
1.3MB
MD5b6016a3e9c06138b6e57db40138f2aec
SHA1e99b59c90fd61f520f1eb58b20e8e95aaa16dd92
SHA256f772442b01b26c2132ab2c3574fe89685b3c71502d822ba187ebfc6e7c23afd3
SHA512be125189b16f7402c8a89a8e00c382b1e26de4e14958856e498189d2b055f94a16ad162d4ada805f8452a7169726eaa50b4d7fac0d45bcf34f32dbd1de010273
-
Filesize
1.4MB
MD5a9904cbab78a648bca77be83179e6b3a
SHA159bc3dbe37e0e6693411adfd3aa0875cfcc3669d
SHA256991bba37780cdcf3dc1538fd36181a5236867d0fac4e5c2353e8324c01aa5c4c
SHA5125cfde156afe9a7f337e881472f6d7abc1163a3f471b0014f096bdcf4b8037b5b20960022f581072d80ddcfdbfdaa26bf03c9b458de51bcb401f21355bb119ee1
-
Filesize
1.8MB
MD50b127c39716721bd01946abdf7117d83
SHA12460e6d48c868eef7c2ebd95e8f57268b0a41f3e
SHA256f69cf0f3d19d21b06133c820bf180f9b1b51e371904f0288f2a8d5415f8f922b
SHA512968d1ce3c0f11ad42480d4ab42aae2e75e54486abc146e0a6d755a087651b55e667d15b71ad0cb6d404906449589109bda11305ac8fb2b712f04ed0c571cc815
-
Filesize
1.4MB
MD54b2729b3ce27f1fa8180d1ba748604a1
SHA1412faadb637b2ec4c3b008a0dcb3d88197273f79
SHA2569221dbbbe78f2621d0fc3685b32eab973c0007fea95618b50d57978aded4a157
SHA51210e4a2b4298ec9510b353dc5af4319026fb05a5c78dd38e8d4dab62ffec93e65288d41bf6260891bd4a099e9a261c97657aeb9143f9e176c5ce5e1d6434272f1
-
Filesize
1.5MB
MD5f20e7ac79245c3d15aef05cc80c8b31e
SHA104fe23bad875d33a20032979fbe77ff8f181dfa8
SHA2560b51dd6dc873d5e6b9e0c974d03bca6d0c0e04d9a1613df78bd19ed31c5a5722
SHA5125e93de0f9ca8b35f215ebdc5b430d6be1a3326520c9ace55aeccea016982f3bc2da5fa881cc7850f7e7f5c6c11db6f0fb14f5ffe13fbdd264ce53e237f6d8646
-
Filesize
2.0MB
MD5a6ac5336ea4dd2d8d741a880e524a513
SHA198adb75942023a8288494fe84549899a3e0127c0
SHA256ffae6a96e6ca1ead53434e3809cd519ae53aa21e2e82757ed6ae357847fb9080
SHA512570d62fe494601a7bf4b5444b073a5681a53b5e4201cb16a8b3de4ce330277745f08729252fa0a66830b02d95b2918aa95da3bb0fb6aa7e5a787505152e362f1
-
Filesize
1.3MB
MD507b29b082e0f3155b51baa1a34ec9c99
SHA14ecf9c65a87f77033554929480216640196bd83c
SHA2564e03e38e7657f5ab0a29d75677122c9271ef848c9d3a500b9db16fb0d625aaf8
SHA5122e11b48b0e2372091a3c3fcd9b03aa7d7e43767e32495615005a331348e8807e44c83d66ab38e531208571606dd4a8ece2016377f33425b81a96d56c72b50acd
-
Filesize
1.4MB
MD503722ef73c00f6b852f578554faba429
SHA1680fcc600e6e644d312a3e23d9d01770df02b0c6
SHA256df9f411a87ec5e51f2a0eedb70c50c53a0638b478921e2d1f9c778680115592c
SHA51245ade8c608369fbd0ceb3b9aaab0b80acad7621674899bc0b40286ea71fd2347b461498c7504bc08340a8a509fb5df5107f508fcb9c252587ad83d82495b976b
-
Filesize
1.2MB
MD559e836f40c99c007068c8aff83539e73
SHA1a0c3bbd8c17e493a4ad6332c62d62582c0e5eaa3
SHA256b0a857ad48b4cc83b0a91c86cbc72bc164d1d2a8b1b48b1205542198be199754
SHA5121fceefb82e396d59b55d7bc9ffd998fb9aa3c3ec05b822031b9ee30c78fb5d1bad266203a30e7347473af9781c587a06a2e8f3c3356bb2e5bd1bb300bac1f579
-
Filesize
1.3MB
MD54a59d8ddb935974c513ffc36dd522a79
SHA1c6fd7e54d4710e70cca8ca1c1a9823a5665fdeb6
SHA25668934de05347a9dc508e0e42579dcbca244916fd71bf53aaa79fc0befe9e173d
SHA512f44a1bb34b5a392c8e7ca81cfdf1b36977c9bf194321ad27e3467d40684defec20bf708675f8356f0544de169575f49f0980a002257c6cfdea3632b8baa5bb33
-
Filesize
1.4MB
MD5ace345361efbd0aac3561b8f242ebeb2
SHA174a20a697412032f47c3883e97a8cd306fc6f5ff
SHA25692b0659c298b72c1e680c69d9772e32b169e72ae10299d2ddd54c014c14e5f02
SHA512a58daa7f446fc27f8ee599d04d2098c48e47b42cdae36c1a0ae375aed2d1a25c15a03689121b8e758f25d732935ec5742948f71f8cdde5e2d08a5ee8b0f15874
-
Filesize
2.1MB
MD5cfc297672bb60706f6b18d2c7726742e
SHA10d80fd307ee903468194b58a43fdc2d9ab537b33
SHA256bbe752d581e88795c7d862113c41aaf826b2b3edd7136400012454003a2b6ce7
SHA5121ddd7e15d4478d9fc8215bd4feac598a892a4b7b1fee9f81affec749b889dbc29f14f193984b225e7b82b99ca65cbf4166f20dacb5bf7a7a962b8d898d8e5c08
-
Filesize
2.2MB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
1.6MB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB