Analysis
-
max time kernel
160s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
01-05-2023 20:14
General
-
Target
TT_copy.exe
-
Size
1.6MB
-
MD5
3acff0b9068df07116870bf461f4f7c1
-
SHA1
fb7c0e6fcee327e8ed755e8f1c5199f35a3c4723
-
SHA256
f266e9833cf991a972db594ad7afad2332dfccdd2b7454e49455b759f406bcd2
-
SHA512
0bf707bc83a739e6ed63a56b76323db9c59fd6a3bfb05c760adc77cf918efddf1d9d4769bc14fc5846e0c1d836e3cefc8169778d8c0182e20a0a368e80c6494d
-
SSDEEP
49152:zxy+4OponS7iO7PYPhR/vNv1YWsWXLbZG8T0Zh591z:MKpoq57+/tztXLbZJGT
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5b953ef003ec22ea1cfd5ffde11e94afb
SHA1962c5c3f630ee03e2277ad168ce9a3efad26f0e3
SHA2565957648b05cbfe0c7f932e0c4d0ae7b37d8e8f7b7c085b1964309b0211e19c61
SHA5120cb5612cfdb6c90cbeb4bdde041f043d148a179c182fc5f3250985c192ce03264cee7a03fd081109820ac073676d60d7be74cb86611e794b1bb2f4b01fac65f6
-
Filesize
1.4MB
MD56f78135fa79c8cfff401f443581c89fc
SHA159cd9a544114e047887e41fa2fe923099783116e
SHA25622fd3e0bffe892f3f971d9f347205bfb846df33a02b7a8d3fab0db3354abf505
SHA5129f7b974020a16a34855466d6ae51f96b941f1592bffb5dd70a01ca01954a287e34b9c324748e967ee7ab6c659bed3526d1764c0f878db87654b7affacfc7dec6
-
Filesize
1.5MB
MD57feeb68b033fd768af17362878dfd4a9
SHA1cad536b46748205de91d95770cf36008a2bdbb43
SHA256a392eb2fd9452aaec70eb3a4ce1373e20e6054220300f9785a41bbe2877ee83d
SHA5122d8b3a1446ee228295d44ca10f6893c1b9612d54094ba3f425f89b5296e7c0b8bb03ceb999e6e7f7fc2deeff0138e02ef73f775aaf946e003d067f19c3ac3e1b
-
Filesize
2.1MB
MD5bc3250227cac239bb0c3c4bf057cda08
SHA1a0ed873877ca19b27f573fbc3f3a13ce5298769b
SHA25632e0eb75c166de6e0b694b0517c668fd870e87a2183abd723148d195d2ff980e
SHA5129e85393b065bcfe6de9c5aa96f7f083f35a654fe227a117f065ec2a644e80d8086940266dd187716dd4a8406757ab0ab694c2a680e86860d077dff697610ef1e
-
Filesize
1.2MB
MD582a08c66646f061143e0054c7737f1bb
SHA17d1fcfa11f993c34d0db91e01c3ef5e616dc46d3
SHA2569cd9b4d5ddbbe46088251e41d3dadd5845670af9bf8e17d0de49e700089f4e0d
SHA5125c79c5f82de60c14542e71b69dc434b532c2c67c27b135eb512acc96a0a3caee357907e40952fda0fc18600973f92dc759d9dcbc4ca17ea5282cc30371718d68
-
Filesize
1.7MB
MD5efeea8bbf9b7e1ccf7245cd60a4ecd64
SHA1c58c627e80ad16f3411cc8498a9cb13a4174c08d
SHA256e91d795853158b8a8962ee3f03d247ebac292ffc8cac02f96898aa01f946bd4a
SHA5127f5a04d40e5c45386aa1c7efa19077c6e4d1306d5f84be503df5a0c0c4035328974a55dfc7138d4da2353133e10509bcdcd26d307c5d9984750a0a1f2641aac3
-
Filesize
1.3MB
MD52b6785b2a1481512f603643cef277ef8
SHA1a390dcc98607745883ae4fb692350f1d3edfc3bc
SHA256d60b00fcc99adcce5815eea36a268a875834e187c8bb978f09f28500666cdc8a
SHA51290c0431007de2011fde94473fededee9a9fa2cf640b81a6f3de6dc4702e3dd96a483d8d88977b6158878a7c2be9aa7ed8b8e24aff24a5d23cc10769bbbecfbfb
-
Filesize
1.2MB
MD5b8cff0cd570661ee67e77b780a1a782a
SHA141cd169ff406780ee43a4b172f0f22c42750d344
SHA256a4b16abbfec0d077b0045d3c8bd6bd0af4dcb51fbe34afc8dad229d41ccc1a31
SHA512c23cbe653a78d8f439905c75ed38632b067b78a146260d84700920cf08f2f1f6a000955b02e906d58f83e386357f32ae3dbfa4d9658f5270a0828e8611b11f39
-
Filesize
1.2MB
MD5d18f3dab16d5cbf282196e36ee9d6b1e
SHA18641e397584e9f431140c3c6a44877d7b8a3b28f
SHA25655fafc86baa88ea746bf40255c3a25923e454ab808a82dfad6a5ae1b894f1cfd
SHA5121f2e4bb74e4ba43a9a4181ee178faa9ebc6b9e75221b24bb5b6a48e7f67528a79f62265d03831c5f08e3f1c47cc737ff5b5c7721d05761040d7492bc6a81cd97
-
Filesize
1.6MB
MD541c1f938cacddeec12610298aa7cc1e0
SHA13bb9190836d9421a3486763d3bde1a0d280598b5
SHA256beab4594b3dce20da5124f5855bb8eaacd48da21c2a35c03fdc08887b99bf242
SHA5121cfec62a68a3a87edf5388193dfde03acad39e8ec9aacd3fc9619c717b62f3fa957f9d4f7fbe52854aa6eaa071d8593c468f89d6275b3ae23515cea073af25d0
-
Filesize
1.6MB
MD541c1f938cacddeec12610298aa7cc1e0
SHA13bb9190836d9421a3486763d3bde1a0d280598b5
SHA256beab4594b3dce20da5124f5855bb8eaacd48da21c2a35c03fdc08887b99bf242
SHA5121cfec62a68a3a87edf5388193dfde03acad39e8ec9aacd3fc9619c717b62f3fa957f9d4f7fbe52854aa6eaa071d8593c468f89d6275b3ae23515cea073af25d0
-
Filesize
1.3MB
MD590023a2842153cac0c83fd9cc5adce79
SHA1a8d7fab7af6b13994075cff25670f2eb7a63dc15
SHA25628fff1b1e892382626563c1be0f058f8d8a3b2c8f5d9e9efec6796d27dca258b
SHA5122da72b0d7c33131a1a1389b2817936e2c610e9764bc46411fb7c094578a97b0c29749468feb2ff4543399e882e77e1f07c1cea86f71bfffe8fa6e2cd934890ca
-
Filesize
1.4MB
MD5c185c3a09ad85ff2597b22e82350a87c
SHA128eb402e0177962640ad75e7cf50d771d89dc2ea
SHA256c3c44abb26a61ef09864ee0ed29630c3f0c8eaf25c9862f6b0628fb61688c1dc
SHA512a3ced4a5d2aee604be0ea5c6aa069ad27d76cb5384148e57d6cc3bed8b4581bbc3e83bc656dfaed462f04955f257bccf1f711abfcecf819da3620522d3eb9b3f
-
Filesize
1.8MB
MD54497dd1499e538b660d84a5faf172869
SHA15ddba3b4d2524c860c61103bd49e9e930044bf6f
SHA2569c88b27fa853789f2778e3aebf753c33128bc74d911ba26ca45e3398b1eb6cfc
SHA512b58f46dbe4f1ce8d21871ff38050c07b18337ab4aa0a1743d6e1b9f0747c7b271df3ae8ceb4e9fe0398c7e4bba4ed97279ef9cf242a314488ea4de8d182b4d19
-
Filesize
1.4MB
MD5af8bfe6e3311859e7243ae2dee829809
SHA14f0223cbd4bf13cdefdf4480dc56daa19d274f3f
SHA256805137ef510e9ad1319a40cde9977614432529e09f0135ba8b0f3fd87b820cef
SHA512e9da07008e9710b4cd5d938185f57d9b93bc6895215cd6a65ae7be37f8cb05787c25a569a44bf863de2bf8315a7c5df8a2273e2c00dd2cfd38d75528ff59181a
-
Filesize
1.5MB
MD585a0b99302e7b2259b832ca99f8d4a8f
SHA1c69d8cb8b2ce5e4c65494a316a123ef1bdd13542
SHA256daf172787031a5626a6274f3e6ff906bb36c27cc72b68808a3cb7a7626d2861c
SHA512e2a65cf026d3b88fe801da8f2b77979abc08e7f76b8d4bc67ffb9cfd545f8d4b6deedfaddeb38a817f2f7ad92ea0da22dd25e4c4d72f1ae57df9374ae0bfef60
-
Filesize
2.0MB
MD5ef5dcab966d0716d79c22bc69abfb1fb
SHA190a1eb42afbd75e2bd9ea0d789727f50d176a3da
SHA256912d723991d4efd5f913ea70f2e05d86583e49480569f16c23bfed3f2b831559
SHA5123a58a63e8ba5ed3c60c494ce50c2b6415fdb2e5a9bcd1b6f3bc347a36ac539e21db875df64ae52d1d49c2c480b0d785810f9d0284d63dcbb3aa2566c113dcd5c
-
Filesize
1.3MB
MD5e2a5fd25ecaccc8ebce3da23a5e9f227
SHA10df3ad478723580b9bf93071be1e72d957ed7255
SHA2565ce7be3d2f97b0cdeed4cf07886f7fbce077ac34d6d6cdf4e84375a19d69268a
SHA512dc752d7ac7909ef6920d1e16500fae09cbd9f7a58e4e61a108e5559ea47dc0af6b8724dcc69d276828591f273f4a33ab2df7c235c45a32cca8a3b7b89f3300a7
-
Filesize
1.4MB
MD5a6c39b696859397e7c9079c23e5afa80
SHA19bb8e811ca1eacaa80e7607a80d71b62bb0ae345
SHA2561331657eec09765d589b52284fbfde5b741ec0acd6a294dad11df37529610fd2
SHA512f8b0203a395b5833ec932b62f93815420eba68bf40e4e2dfee5fdf72a0492cc946572f4c77dbb0bf5b709c10051f9d78d309a49af70378036b946d080da8f2ee
-
Filesize
1.2MB
MD50dde5b450d5fb7afcf85b5d20e13d0f7
SHA1cc4c057d0f859e14b1ae48551d215075a04e1a90
SHA256b97df4197c62caad8de642cf46bb5f1ae66a8e75a60ddf0e2ae1681a09ff2330
SHA5121bbeb480abe5bda0b964d6d645ccbfcecfe8dbf454e28fcc90ab4d469f66e0bb62912af3dcfd6badcbd499b28b196ef8281f09f01f84fe3eda904e7db0d611ec
-
Filesize
1.3MB
MD5b0291a90d9c87f71e960214b9c9e39c7
SHA125b7bc8ce47f8fc4bf41e41e45d5f432172c951b
SHA256694283820a28e050e540351779c328f67008de6eb0b401c7238858f099b451cd
SHA512b41f5861e9875b04bdfb71933156f049b85b8654d35151974c878a517bd99586b57b93da269dca736a6d0fb132029ba3dd40047982aa2a4c093308769862d414
-
Filesize
1.4MB
MD57fc138a2b6251f384d0229d56fd1075c
SHA12adccb0c2921528501246801a653ef3088d54fb3
SHA256e9da682fb3dcf29eac62dbb44c3499f305cb994f1a90ca018fa1cfae27180db7
SHA512ea3e6b157ce59c38bc19d0a2c70ab1b674992331e6bd483606ad6da8a861811cf69ed5bc92ce4f5158649b2f7e3dcb149f464471a21ced940ade324bd01fb4aa
-
Filesize
2.1MB
MD5233a120ec3e74087e2814f36079a2d09
SHA1dbb31b12274d17017acaafc2745fa23dc9e3dd6e
SHA256ac8178082fcd5a1c19cf4e34afc083e7e738ea22dcd8aca16d8e74571f31f2f2
SHA51277a86fd6dcbbbf85541385aa5c067ed87cce8e12a873966a9aeb3b271f2956aaa7b1082150d1fbcec2b1eba078aa121d0bb676021c35ae810fa82505e1afde0c
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
624KB
-
Filesize
40KB
-
Filesize
1.7MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.3MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
408KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB