Analysis
-
max time kernel
153s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
01-05-2023 20:14
General
-
Target
tmprwm0tnp5.exe
-
Size
1.6MB
-
MD5
170860057f4aad06ddbeea0ca2b3f1b6
-
SHA1
db04c735b769df458518f959ae7eca39cfa06213
-
SHA256
e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998
-
SHA512
f8bf57126bad026be2414121c798d5688119f06312404c35dea3f457deb717f6422291f5401178586fd23055577f893b4e6236e413c909e3b526c45d3b957766
-
SSDEEP
24576:uU7taDBzgNEfeEvFTMxdzYPh1ogay/zj1weNgcHFx5MpfTjU/c7jNXPohE:uU7PNBmMxdEvogdzxzHFx+pfTgE7VPI
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 11 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 39 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD58967097571d288604cc8a27d3b3a1efd
SHA186e303cc6978a9f4f7938ddabba2544cbd1cc40d
SHA256b41574115fdd682ad0e39ebcffbad412a4c3cf7332c4c8de0196997b2663d51e
SHA5127a461573d4772d85366d0429ed146d38b752bae7adf177cbd8cea746ba415fafb49e2584221ea29bcd204250083ed12138e7047b3934ccb66d724612206b61f5
-
Filesize
1.4MB
MD50839a308b061edb7d8b8d6895076c07f
SHA19f949fbc6a16be3b27d6444150dc55f5e6ebf003
SHA256d44d0eb777721152dd10f0d1b10d33ad50c688fdc4f75e6d6fb5d87c0f14ab2d
SHA512c9d14ba6ebc400bb2e38ba4be6472bd4efca88d5af42998be9c69f0e7d0045b1e4e463016e0ea0cc07dc6fab5d3db08cb2af555a0165869ef7174094d5e47833
-
Filesize
1.5MB
MD5b657e33f0855b7ce102444ad932d1129
SHA195f4230a082d1e869480ebf8ea9b960cd0da0dae
SHA2560997718d8d26b8bb6cf9af2a3fe2c9122985bb6b2e513bd684026b7d23ea9dd8
SHA5127490f5ec4e924620ce9d761b17e80180f3b9cc6a95dda02a76ed517c20bd1805907f8dbba435ae089e434e5f88f52c2bd092dfea756f6d4d95de8ca0d49dd81b
-
Filesize
2.1MB
MD548c1d5d33ec3de51a69b0182a3ed7721
SHA1579cf5653890c156dfc3dd33f43a1e2613183e6f
SHA25617a7d462c60b06793ee2ba8114bfa9334e0fbc7ff9b65bcd0631deb6ad4bd84b
SHA512c4d8d6a64618eb04e9c50b062309a3a429af74dbafc521c7e60e8d9c8445d3230c5f2f1537fe0d52482babc7140eba7c44bd04702218d643cbd2e8301f8bee03
-
Filesize
1.2MB
MD51ebadf65d907ec6b959df6197ea99b68
SHA147f586d9e140d6cb5e71257072b8ee3c03f836f0
SHA25622da944d17538eda1c3267435390e863133d30c747b7e66170af12d9370b0a30
SHA512039b6510532c9c51e1ef3060fa95d7b31e636b3a352683ae300a6a1a6a077b4d3256bcffc6b7e5b32177efca551cc0c414f1129f186dfade9f3fefa7b3fcac94
-
Filesize
1.7MB
MD519cbb3cfa9452f1e5aff5ab57e0cfa5b
SHA1f40877be5735382c82db6339b543ad5438d0f710
SHA256313f7b1316406d4681adb4859683138adafa32f15931da18015f3afef4131ecf
SHA512502ac502142f9948723b0ec43adf60599afc17991db641ca330723f4553d795fffff6af6655b50e1fbb19117067a65cbece92c95ee302e7ce84c9aeaaceb0490
-
Filesize
1.3MB
MD508998cd0707912d9d0c1abdce0bbf553
SHA10722101f27955a6871e443cc3d2cae625662dc85
SHA25680535ee741805fdf7158ef369e45d23df564fdf4dfdae74e098954ab05adf24b
SHA512c4a98f1236ad7187a6290d7bd115959e8d0d9a863f7fc2d6acfc18b1dd1e226979dae6eedeb3b4eb9c0f5b83866db2678a9411622bbfa43785357fac2399dc11
-
Filesize
1.2MB
MD53b782cf039f32ec6632aa4036e84961b
SHA1f2aac2b221cad33867cd918eef3732ccc65ce149
SHA256e35225787e01c2c32178d2e5969ca5f565f86499a186f7f4f2f75c888ebd0f61
SHA512194914ccdac398a717980e7d79ca711735b48a03097e01d68e0aa5588b03cb24dc0af93e8100d8aa55a4da8ad9926d9537119f297b0d4478936a02815bf72053
-
Filesize
1.2MB
MD5671606556a23007e08184cb2622eed93
SHA141aca8f4b58e3d84637ad342b475da4ae572c118
SHA2568daf2d393e88c93fa22d604bb14d6a8dd1333a2bb40d91f043c1356c43727cd1
SHA512ca09f114d959359a177f74ff20dac602de8aada729450911a0188c9332215bdd23ff7759dca50331e34ba1800b4898e2aa060ce32d9b8f8b1ea53ca31a37375c
-
Filesize
1.6MB
MD547b4e43bb5e27d7509e1a721223f7a28
SHA1147f9a8b62d9f2f0094da2c34bd608284dded47a
SHA256588abd29950b1b4823fea33f29bee3e8d9818ff83c7e3a1794b891e8fddc71a1
SHA5128f131cce393a6e532b8ee46d59ccaa53236e9105f4f5217f6f6cdc8fac04ddab60427aa5b09e83ef204f97f0bfab7f487b4934a5de7738c17170a71d15ed124c
-
Filesize
1.6MB
MD547b4e43bb5e27d7509e1a721223f7a28
SHA1147f9a8b62d9f2f0094da2c34bd608284dded47a
SHA256588abd29950b1b4823fea33f29bee3e8d9818ff83c7e3a1794b891e8fddc71a1
SHA5128f131cce393a6e532b8ee46d59ccaa53236e9105f4f5217f6f6cdc8fac04ddab60427aa5b09e83ef204f97f0bfab7f487b4934a5de7738c17170a71d15ed124c
-
Filesize
1.3MB
MD5c4812b4d033a0d5f8258b02c6d202ab8
SHA1bcf10b582b4192e71329a1ce0e505f1a6303a732
SHA2562b2654c924b303eea1931c771a08ac8c244d304611e4b676cab46d1c33c7d31a
SHA5123eb620fbad647161ba40dc9eee4314dfb32606c8fa236901f7dc5f89c86d3dd8907820ecd5b3aff893528d19a6b3642ea355d68259e76f9c3b1a6ea6a024643b
-
Filesize
1.4MB
MD511977c08354332f40171281aadd50d7b
SHA195190c84e28ca4daffc0f3b83fdfded045c5d67d
SHA2561c560e900fe02de08816749264657f77dcbc723a8f0ca36f746334d4e21aa59f
SHA51254fc0f384b32db510d77fb4d8544788fb845a3b42023de20d24613a0d4e744cbd7596696d3629871b472c66261caf2b37566b2d1637efa705cd3b8f6ad7b38c4
-
Filesize
1.8MB
MD547160ecb9be7aed19f7c20378081c5db
SHA11248308c1d367d3d2cc8aceefca70d37a5cb7add
SHA2560e5dea696864defdf4b94671bfbb06c96b1af179fbfb5452b5ea39fc1bd7dbb4
SHA512cb6223257939926e0b0b3d7b4a3bd9ea4a34e72cd94294842bb601d21d2a1c295add7b8a55f82bb7e96c593f1256da48a0fb258a2a568eacb857b21f96610199
-
Filesize
1.4MB
MD52d55fdfc0c07f38a1d06f4035d9811f7
SHA133915bb95dae8e77dd46112a182dd45a56ebd48e
SHA25635393218311012d8e2478142ed24a92f71cd8a08ed01d4753639b343fd27bf9c
SHA512e45d5cd0fa5c8a9b76dd2aca7bf0512b47af1327bf08ffd617c936b85974882d6feb4436b2a4cf9490cdb3fce15736296656db07e353fe1e96e8f9a96f27d9de
-
Filesize
1.5MB
MD5becd83b35f45a8f41e0187e15c099bcf
SHA12d956c8b7813c1c7379ba609a5646c4a272916cc
SHA25682b77d9edc3ed03c86beef2239f3cfb5a773028affa70b4efee422ff6936c9fa
SHA5121e1b14b78ad56d109f4bd51dab84efa6a9efa47b1452077b4220b40d54b98dc5d72dde082dc912acab080772222e2663251170efb195714fccf298ce982eb54b
-
Filesize
2.0MB
MD507de899cd670a663f8d489c903448796
SHA19603a63b356121c0390ed512f52c96960ef22765
SHA256c6ae33957a5b6a0a568434adcf8458f595bedb314fd73937910b0aa17219d5e2
SHA512d7376843c1a71c7979b7661eb2daa136fe2bdad1e50bc99cd203c40c28baabbe697d379176b93c18dc4f0010424bfb9616644c47b768031e684aa06da5ce6637
-
Filesize
1.3MB
MD52116d400d3b7faf23c2d104584eab934
SHA12e14bb60e58477a168c047aa10a3130c3ba4556e
SHA2567cc96c0bf747761544226b7443c90b08e87a6515fac28cca8972f914320fd388
SHA5120a7ee3fa0f6a16dbe77ce8eee6f2be029d904d25a2673f299673e27cde61b26bf20d8afe83c03f30ecb4d6ad1b80ce99ed11f63edb3e48745f8297a31ce0f1a2
-
Filesize
1.4MB
MD574eeac9050aa063b9ed419810095cfde
SHA144e324ce19aac911676cab517869ac4db67533ab
SHA256ded170cb901faa19e95a2b67c51824a7b6c808ba5fc695103ec0688b40867287
SHA5125f39e17ad7eb55ef3763207ff05d1e186e28d4edd1092f40d77a4a9efb48ef39cd138e99ddf018a71ca4fa4ba62bdec9fb90ddf61ece87e0c7fb15e066a3b5eb
-
Filesize
1.2MB
MD5a4496bb54b1ce8cb956222779608c8d4
SHA1cb03545502d3d9c8d53da0660d6f9ae6ab6f57fe
SHA2569475dee739d6ee39b7965133338e71ea4b7fa379522e8c0d1a64f21b32070499
SHA51238bc1033c9de507b7620b1ca8007b2fbd1de3ed3f383e09b90daeb5711be4f894514250e85732ec949d822a35591ced2e113d608abb70326a24c8b5b6840e36d
-
Filesize
1.3MB
MD5276fb13f2e695f7dbfbb31fdea3addd2
SHA1d0ef9c220d167b2744e46abadb8fc7fe8ecf29e8
SHA256925d095b43278380e7d12a2f4e7e3a42886ab3b6a7b3635ccae48d6c1b3fc69e
SHA5120ad68ff5e9466f5b6cdc11c897fde5cb325cf58f7893ad1f604aa3d0a5d5ef8bf61dd37a63652fc355ad6431b96a7fedc6222d59155f2476f2959525a0ceb28f
-
Filesize
1.4MB
MD5e1e79ef1ded7cbaffd4dd1e3792ed479
SHA16a8737e9c346f22b72abbd3f05c737f2610d2d19
SHA25656b0982bd25c3004e5deb21cec28d1ccc3890364c31c8f790a09293f57ad1183
SHA5129f0249aeab3c3315dd8ef103f441b3219e9da0742773845d23e73e91ad836550dfd088f9843661a03e959f61643df27b724c2c52c5f54aa90d6223c3b373c1ca
-
Filesize
2.1MB
MD55f97eb29c5f3ff13ef2e2843cbb6d508
SHA12718d89897d609deacc06dcae6b630f89db71303
SHA2562ffadef006b731f968c117ce5474a6ed4f96bdb75d99ec3fb312ab1da0796448
SHA5125860e0baa88cbdec191177138f0b08b689a2749adddcbeeb3359530b26b3d206f4fc23cebbaab7ce8be135245a437829d500893bd7b142351e745d6f3f91df18
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.3MB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
1.6MB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB