Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
01-05-2023 20:13
General
-
Target
tmpj_mcuumo.exe
-
Size
1.5MB
-
MD5
39810b7912907fc879004874df0e9e9e
-
SHA1
f2e51d5e9f644058a8ff4d64458e2914ddf2a364
-
SHA256
bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61
-
SHA512
abd49e8623428a399f665e2157522b6d285cb6c1f77c043eb22038df2ebbfbb21f3823c08dd781be5df043f1ab9b514990ab890bc80086cf33860aa6f4e75b5d
-
SSDEEP
24576:molqfbt8n/WmtqmZfq/ppZge1+qWMZukXfRtgyCrWw:sxgWm8m+Zj+qbZuq
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 58 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 16 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 39 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe"C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe"C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe"C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe"C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5f4caae509912422d4cb91879db09cd05
SHA1fd31a047707d0a6345c4d3a1751e195ea9b1ce05
SHA2564ff5eabf88f74281e2379bca67f5dd602dc1472440e81b875ac3ff23929a4f7f
SHA5124fcd1b6c807f6493aff98392be17557431504113eb07624d55a59c5fb10ff8911c71d8b1bba99165f5e1917af4605cb03f94dbae2b0f3dbc0f6b1366a05e626a
-
Filesize
1.4MB
MD5b3e03b8a5af37518f2c66e603803ec31
SHA1ab524bd8d1a6913774bafd68b15e2ac5f83b5dec
SHA256ea719bdefcb8ca7324eb97609dc2518d91cd804c4adda8073592405fa02654f2
SHA512c2e19aee184438172737f9077d8a5a34578388e5d3e59815cdbd6ae196e53538048161e33e1473bb38d1062dc9cf052968b874e57f3ffad8b3a3b23417921869
-
Filesize
1.5MB
MD5facb91f0f70e4abe0eba10141f3a660c
SHA1cdc3d71995130e04568637efc43a468afebc3039
SHA256fba0dd03085352473f9c2a8e1477b33b7ec3c0876705f65b868874999cfedcc3
SHA5126045dbc71eab785cc686b8ca58bc330cdc1e495ecd9d28a8362354686ab02f990da758dc7f37f9308a04cb7a370f6001f593c23578a9f1d07d66b7db4a0fb819
-
Filesize
2.1MB
MD57189a154227085726317b0f57e137b8b
SHA13aa52aba342a5308069da774354b137bbab73bff
SHA256b8232f6072bedb34c584ff4eb52c9fed47676a618487a588c1a9238f67b72834
SHA51201020bc69b9dc9c7a632c9c94f96c8575e1f535532fea799346cb312f43f445c4edfeffa6818c9ffdfd3fd47cef2fc9c180d74a29f6f4adcac3d9456fd3c3d6b
-
Filesize
1.2MB
MD5c9e8a9c5fc0e4e6362aa7105c0d65984
SHA1e3d449235bcfc1d21b1d83a9b84300717eff7553
SHA2561d797698b8ce5b4209f8578fe83fa90428f9dd5d7fc64bb11c05710d5cbc7696
SHA512bdfb10540a8497e5abf3d11e42ebd8b47a0c97734d0489fde596624e1c4a2283ea7b2771f7f4094a14cf5f7dc96b5f25718f88c93a2c81328f8e40c2a6ec2718
-
Filesize
1.7MB
MD582dd9c82b007f9d70d4d64863e08d11f
SHA1a46e1dc2ec392d92fbe6a7e6692e2e27ca2afe52
SHA2566dbd039dd1f5e87449a1b131c662d91cce26ddfb803dc004cadbcfe48117307f
SHA512a9a62d21920b52369d74e75eb7580d3cdf78280476c245348dfc0b24434ea6a9f78eeafcf64ed96fa731ea1e31b727fc3addca9c83b4f7c0583f848e651e7879
-
Filesize
1.3MB
MD5dba50e62eede89edf1a907d81e392121
SHA11a080128957104b3d7e4cda7327e895b0adad6cb
SHA256f5cd22617d67bc37860f17a59d7b5c3729a54b8a2b9e9ad3526fab634759b598
SHA51200635cf8c6eca3a213c3e6064356944517276048d0515cd5fd86bcae036d2153a5afa97a678e9b6379b311ebdaf71c7ef5aa8dfa1986d1088470280ad5452efb
-
Filesize
1.2MB
MD527212f8585d68d010553a55f71400877
SHA17cb3b7727cde4c96cb05a69fd0cd9a4b433af93b
SHA256d5de7053dd6cc01da3459c307a1be132565c5747d046857c76719fca37e5a348
SHA512d492c7f88bb5d113b7f4450fccd53a8ab767ca4482a61f3b5968ebcc91bce0d733d6e18bc5e1b0c33ef1857dea6243f8fa2ac1308992e4735ff8cab9d31bfa3d
-
Filesize
1.2MB
MD51d7cf56d11ee01f08b21cf0f84cc4804
SHA1dc2274f9ce1f4f6df343c0f9034fd602fc5b8dc8
SHA256ce7dce6e9270b0a87d2bc169bb1a4544970bd7a4d9eccff438aa2146d991464a
SHA512dd31ad0bb3e6cab8d8e7a2aa19162ce4f90eb4f38e43a1c31ddfdd4c600becebef9f292100fdc38fcef641467f1e009feeb3ee762c94f15d81361b609c10390c
-
Filesize
1.6MB
MD51254c25da7921c58cfc0f34ba3cc3fc9
SHA172cd9b476b44c57287d2c3dec58f3fdc18e04c6f
SHA2566fbef5c6b5b38049991c589f66b06a3eec13a5eae88557e368ee4c548d5b86dc
SHA512cd2b0c84b697eb84c9e32d15b90a5463b9f010d21476fbefd3b2d5e1253d1be0b36ac286da07656a877525079e801e996535b9f393a44fbf6bf46705a9045a75
-
Filesize
1.6MB
MD51254c25da7921c58cfc0f34ba3cc3fc9
SHA172cd9b476b44c57287d2c3dec58f3fdc18e04c6f
SHA2566fbef5c6b5b38049991c589f66b06a3eec13a5eae88557e368ee4c548d5b86dc
SHA512cd2b0c84b697eb84c9e32d15b90a5463b9f010d21476fbefd3b2d5e1253d1be0b36ac286da07656a877525079e801e996535b9f393a44fbf6bf46705a9045a75
-
Filesize
1.3MB
MD59b0dccdfedc24f5b09aa39b38211af07
SHA1e45bd03973c253607604e5d6f83797aa4d030f11
SHA25654f319fd51c33736263bd307d353899ae0f2d1fb76c14721133089aea0201c6f
SHA512b4605353b3160e7da97f125a08281c4c47a87ed57b81d5e0bddf6568d90950ed577c54f91977c0326a0ca925c1e17db37c24fd82b89dfc05347fe7e0010def7e
-
Filesize
1.4MB
MD5919a0002200a7df28321b6545baf092d
SHA11d4d13c624bd53ec1a937c6389663930dbd9734e
SHA2562adfc2251838f93308c5a18ebb89dd8dbd790b7cc5917e82b06d043e2a526db6
SHA5120e0e4f5ed61993c1deda171e4c033c6946e17d540942e18b72a93ff40d9fb9e2264e03cf186ed77c0d6725e010eea5390c8ead8fb884facead98dc7f63f4992e
-
Filesize
1.8MB
MD58d9b7829ec450dc2fbf565d58db32a64
SHA192c9bcace466db3bd01520b5d521eddcf776dbc7
SHA256f6305d473d354223f23339e692a7e32530bd74a75e0e793b850da2554cfa8bc4
SHA5122ae346e4f85ab0453cc028c0076552b8698a087ecf32ece3de8ac0d58f557e43a54d03047e49d124fdab62d697f3a2655c694d7e10fd3117a09ef0d44d6d572b
-
Filesize
1.4MB
MD54fbab786bfa177b68ec484f45d010004
SHA11eac979bd3127323fffe639aebca623a24262c2f
SHA2561782f3e2c704bb937a1f34f0788397c22237ae636c8721fa29a1f9bbd9494e70
SHA51272d3666fc1b0d1cf1b833b1b63119e28508e82499ba152a88e9eb1c2d34953c45f0cc97c8f89b9a886d24464922be7fce25355ed79cbb664c85b98bc2773d988
-
Filesize
1.5MB
MD54fa98772e03d10b14141a7bd90662eac
SHA130bd6f98ced9b992f9a156e4ff29b225e585d69f
SHA256414c84dc2b1a6166da622d95ac4c29127f35ebfc08dcb02ef0b49feff6ffdbe4
SHA512cd1c6114064e472de859b7f3d5157ea5c521574b24b9a2f184a223615a76b62975f1b924bac5c830004d9f8d516a4a69c79719c37736f592d0fef49038dbca34
-
Filesize
2.0MB
MD53f99417eec81084afbc1dd9d6bc08b07
SHA1e36782a171e27b6f94b3285871efc8316fc2e738
SHA256b4a514df030f832cdb046dd726c0a9f85eb69a011ad48515ed984607422a2f8b
SHA512150c8131198db3c7db1f6f9bafee304379823105964b4ef80eaacbd44bcc7dfb249b162e3599d5ad7d5200040ba11d582635094f88884ac0ef858ace05c00a6a
-
Filesize
1.3MB
MD57bb66f99cd5a188c613719931045de56
SHA15b99253cce11947ba759b810338210c259267183
SHA256192b4c591d6a701a3a177cdbcdd77b14cc8a116265e3f0ea558a68e5e01d87de
SHA5122c1131c2e274cc643cdc80c0c52c6cb7652f33a812f6d3f3cc64e551a96b7a60b0b6e29ded1d2220912e4ef36a1558951fdea7ccc402eda2edb5eb65267e7f10
-
Filesize
1.4MB
MD51c2bb8e8e66233498fce0a9811928146
SHA16e12a156c27cf885a39010b70e4a9dbfff0c306b
SHA256be85d3ac78c68d5ad9216974940380588d6de07789aa34829efee5ec0f2ee204
SHA51279b6b7e935bab674d053c97872d273627a3ec28fcf0375f5299ce5515ba5d4c211073d1fc994db8a7174e106d3bd424825e9a8f9776837be82b5e5bf9f4fb531
-
Filesize
1.2MB
MD5b6b2c3ee8989904f27665d94e9b147d1
SHA1e86ae1ef2568cfa56f30eaa37fd6cdd84f5726b2
SHA256a151fdb79a307fd55407b02826a8cd17dcd3b648c4adb8e02aa410b092441b08
SHA5125b80006e043631014f0556e65802ff1ff4baf12bd93616a73f61d0839b60d1a89ef650a0f3319c4dd9a57eff004c219720250d51b5da1ff4878ebb1926fe9c41
-
Filesize
1.3MB
MD59cfba1639782e6403f41d2dd17c3cb10
SHA15416ee7a45ac75a25b12aa2dff6ae651bfb832ce
SHA256d319bf0d38f64b7475852112dde0bf69f0679fc39deec6bbc520ed20836bd9c7
SHA5122f1372e498b72d1b128be941bde9b8740d998805c5c2454af205f085d44e5953545ad14f14693079fab396254e5cb3b4c6cfdadace53f424d2822fdfa2b724a7
-
Filesize
1.4MB
MD551ee17fbb878d4e67c2101e62991111d
SHA12d90ed291c0028a4ea3a95f4281e8ef75f80a131
SHA2565c15065d686cc4c9a9cb723330cb687925aa6ac67fef0939aba27353947d6de4
SHA51253f24cf58a3f6f5278f6f2fbe16476be32cd0d4b33a176a3cc8fd139b3577884c1648f86d624c575208ab9cfd524cab1fc7f1fbacd2fb063d0566f632ed7a1ba
-
Filesize
2.1MB
MD5dac4013286ed8f8c18fd27e192517c6a
SHA1216801b3c38b50dc0521b2ffb533ac8cf70480d3
SHA256872e6ab646ac6bd3f17c35f4242ab5c976f04de0a6a9e60f352c2d36876a2f3c
SHA512c2b59bf079c0a44fc0f2d1e5f2b22a97e99f7a930e0cf00a54464e2629cd01ccc995b387a990d948a5bca9599b9a9069414b9009e4c4523f89e7b6bde864cd19
-
Filesize
2.1MB
-
Filesize
2.3MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.9MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
1.5MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
2.0MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.1MB
-
Filesize
408KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.1MB