Analysis
-
max time kernel
155s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
02-05-2023 22:21
General
-
Target
dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205.exe
-
Size
1.6MB
-
MD5
e90e41677f6030ffc3eac62929ced1d9
-
SHA1
edb0a2acdec33328a864ac178bfb0b42a2e0d444
-
SHA256
dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205
-
SHA512
a2e20c8b160c366baed60adca173587e5c3b94b811f4f52ac3aaab01a0301716e30cc7c7d2a426ee32a6df651021717e4fe097073610860a949e7933468e10fa
-
SSDEEP
24576:KRKQxWUF61/J27K4mgZB67gTsD6RROjiDefziWX2GDjGBXtnZYx:K4QcUFO34mg367gTOwMMohjw9Z+
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205.exe"C:\Users\Admin\AppData\Local\Temp\dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205.exe"C:\Users\Admin\AppData\Local\Temp\dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5095e38158ebed694b777347df4491941
SHA1a90935ebb291a2ca8efcef0e64c1d8e3ca44ca90
SHA2563dca7d508551dd0b7d9b4feda43b51dc0c1bae0c6039f5bc622bebaa510341b1
SHA512785f2c625c0696ff1b0e2c9be46210961bb2287164cec2f309358870b6c9c33cc2e513d96bf5c7cd42dd6d09104a40e8266137893b935aa883ecdd4bdfd62627
-
Filesize
1.4MB
MD5a084afefb9ee26c8842f201457eafe6a
SHA1defc8bfaa639708d20f18c58dd072f7c6429144b
SHA2569962501ef50f86967a6906c3e9c01560c2584ef4be1988aa6cc9f136266228ff
SHA512fdfbc740acbf30877c96eef892ca063343890d8521c2b7ae20bca8057b478978705848f3acd41824f4e57cf4efe4da4c3dc0c33a0de588d66a9af602f7c421a8
-
Filesize
1.5MB
MD5a4fa12f2c82f2068b662f6a83ed29271
SHA14feaae4a027c5e47cf376a5eb72a0e0d23dd931c
SHA256a0d50ba870ea29d3b7d60aece461a9b7b5f062170b6125cb6e1c08e0c9448702
SHA512e50d5cc0b724989dac9d5ecbcbe389b662adb81e88f5ba5a9589f4842d867554b51aba9d96ecc0fe2cdfc70a9fde71a8edd95b837cca7e50b69d31ab29ff0b74
-
Filesize
2.1MB
MD547f19fbbea105c69844683095158c8ea
SHA13b5e15a4ff88b470182d5a393e8b454f667a6430
SHA256d2159ffd8febeff41424606098a7c00e0afbdab5039d587d63814f655d9599e0
SHA512d68ec1dff768daceb7a1090d4ba2b3e64b0f00d502879cd3d494675bc65f3fe180d440384a491f0f07f76f36f52b1321207cb0f6e79fc2cff7b2c325b7d180c7
-
Filesize
1.2MB
MD5781a1ab6d60d4dc071a29723924c7c26
SHA1263a577e8b2e9f182e0c96454ba8e0898f3ce238
SHA25688d25716f0faa7f21579aedc27b29d99249c6d86cd76cd8ad0d4ebec21493e9b
SHA512ec2c45ce7f61656943fc27b3af2250a4ab04a8d3bd5511f88b9489bbe282e28adc3be596a90d64d7639e4bb12bbc96bd44e4d79a4749d38ebe3d14e78c985732
-
Filesize
1.7MB
MD572185648658bfa3dd547f159587a04b0
SHA10b275c4f6316e92ff6f98e92bf0e64c31f6726f4
SHA256eb1d4521d4c74f17a0f4f03d0900205a260c151664eab4022d6715d1ece994e4
SHA512e7ca0fa205cf8fc1079415604c619a3eaa20aae81f9f4ddfcb88e62c946a2e440a6ce652173a8ed1035c42ac181b9f828657ff223aa96a93dddc5661026edb57
-
Filesize
1.3MB
MD56bcb5f73bb370a999cbf4ac80e16ee94
SHA187e17d1d1fad2d2e6680ac36016af1b5087fad01
SHA256bb29e644e7ba3f008f1ba699935e25af46fcd65e4d7a32c84b358af21c4a7889
SHA5124e1bdc9188b9258db6b218656ec5ec6be2e79cd51ffa098416599332c45d2dedb0fb0d5347a5905be02d86b325771038e2ee29bbec2fa66ab479989ddb0b76ac
-
Filesize
1.2MB
MD530787a6299f7a98ea305ae5ab510eb97
SHA14777885c5f5b7fe6ad7b935ba9257f6cdbc650f2
SHA2561fb8dc43f7d567e536425a8ca43148ba431b2119344d82c49544a9a5d3e090d8
SHA51232acce9774bd688fe59e7c9e0bbc5bc02e38bc9949b14e3163f4f31b41f681831c736dac2c3f264c51dbf67c147aece0b81b04f21304beb41bd98adff2c88952
-
Filesize
1.2MB
MD57a692772e263e4cd12340b795cf0dc56
SHA1d3784ec9508bea6524d0dcd6ce53c1ad77593131
SHA256fd15dd10d349df85779cde77cb33ced631c489d7e120958fa372f9ac3278949a
SHA512cbc912eebd3640799ba96c903bd60770e5a460b07b101d46f0355f060fe08808052710170875c8472e6430026c8e531635c52d56c129827c3612e60b44632a28
-
Filesize
1.6MB
MD5c1e069bdc6e25bb51fe8347c5279fb3e
SHA1491d4be44a5a204cbb96089489e37c1ef383e7ac
SHA2562711859f2b38c44b2309f849a53faebcf36a17a9950cad11654a23df530dd6fd
SHA512cedf8b8e09ec68bb4a789e0a751627dadfe06a095a61a2cd68faa47be59cce07af69a3ba1f90a5feac0ca747655b3b0f1bd55e7657b0682373c4012e0a3490be
-
Filesize
1.6MB
MD5c1e069bdc6e25bb51fe8347c5279fb3e
SHA1491d4be44a5a204cbb96089489e37c1ef383e7ac
SHA2562711859f2b38c44b2309f849a53faebcf36a17a9950cad11654a23df530dd6fd
SHA512cedf8b8e09ec68bb4a789e0a751627dadfe06a095a61a2cd68faa47be59cce07af69a3ba1f90a5feac0ca747655b3b0f1bd55e7657b0682373c4012e0a3490be
-
Filesize
1.3MB
MD512f79bf2990c29dc955f75f09980057e
SHA1492190b163a8f9d099196893b179a1aa858102ec
SHA2566e44611a6a8c74d7c84ff7af89f6a46e22d10352850486212a0256d07115e010
SHA512026c8815971b65dedec04af2ca03f367f1d5cd75f57d724af985d0580ebee349d266cc2f71ab9bb3271c5af6ebc47169752c54ccd82275ec7974825e8d3fcc9b
-
Filesize
1.4MB
MD5c7f33a2840849ea51969e7bf48a8296a
SHA1fcc23a1ef4a72425343c208f965afc0b32ca0b1a
SHA25664a5fa7796268f58c98bbf9d2e20b6787dd5c7881228cb122249d4672647bcb3
SHA5129bf1c2b0b70a28402c77ecfbaf481915977b7b2f740ef880661b47c0a8662c647d5370e17c107a5e20701d119a342e1e1756b2a41ea66afd80472a6e61e48513
-
Filesize
1.8MB
MD5afa10adc2470c034f8439d1a2bb0112a
SHA102eb9b4b030d4c5ad043aeb23d0e5db987ad990a
SHA256403c8853f8b5d980813f83318d562b3d03d450f58cba8e5e6434d3f5b7d811e4
SHA5128e7e96510ce547dd5b6e8bc0a60b63627dbf59e0773df0dc96de82d01cfce7dad13e65662f01385375b295bd722af2aac31c0ac8f95f70833d29d7992925ea66
-
Filesize
1.4MB
MD5c028048769cdfebeda399cd8505e8f4e
SHA197c566223a664bec934887c639a8148dcfc074ca
SHA2564ccabba8960d44641f477faa0ca11655a7c9d5e6c54a0fb79b9e9514ed99892e
SHA5128e2a8e87b9e2128b7d59eb6db46e726f9851cde002f15ef3525f4eb6c37b4f3cf27146fd03889279c7e1f5f2e1a01c5a951d03678e23652432df27c317eb45d5
-
Filesize
1.5MB
MD5c9be0350fff6b460b3f34b83c69b5361
SHA1fe5889de2c13f76ec1fadb1ebb7b61a455653170
SHA256b54d7c279c833c92ec0276e6ea342cc7372d1b1254a0c03c7df9921fa31e3602
SHA51281fa99d2667eed50bbf34c0b5d55f9a88117caa1863530cd91e38299cedba856155dcca544df8de1a71b53d917582c395569d00403f95758f8c03947cfbf64c3
-
Filesize
2.0MB
MD5fe1bf1aadef9ceb32983c96ff9a8cf62
SHA1745de0b0a1fad49dcb5745e6b83e402846e3a708
SHA2564cd4322a8bdc4cebd13c8bfac73cce4e95c0ec0a087071bdb01ba7a5db2a1349
SHA5122f290c06293ed80bd9ab2133a9bb6eb8a61c904ec8287542fec26fb83966c9bf3a19ffe4752759e64763815086bde60f532ca7c6ae1f01c9a49a078bdf623b80
-
Filesize
1.3MB
MD573d5660e1cce2c94fc3e3b9f3bb61d8c
SHA11645c2e2f5cc6136eac8ffa92b64074fcf03b171
SHA256e5be2be6d307be09810227027ecbb8add59edc7823aba946b750cd91e3ef28af
SHA5124197c2bf19eabc3a1115b9059d250999d6b86e22f6f16dbbb7266454dc31fdd0956ed81abf08e0c993b73d2b10d2346e77d334892da71d2bdf5f6f6731ab25b1
-
Filesize
1.4MB
MD57ea2c388feb3fa8897330e0cf70523ac
SHA12c35d54bf6118e4da370a1074c0f897748c1e7ef
SHA2566d8e088d35e1be09b36c117c52582146c4de9a3feac14479791b23177416b1c5
SHA512b7996575fa92439ce8ccd29d17902812bf8737cfd87664183fbcd78fce414d1c005e46772022aee92203f4de568e63d73d6ce3f17e48b1b6218330e3b0f195d7
-
Filesize
1.2MB
MD5121564325b613ad802115f8ffe38f0d2
SHA1e515fc1ea936ff2e40e8d72468156f0bcd849ca1
SHA256f9f33401b0ac575cfd8a006f381baf9f27c8d964e09fa9f52fc1dbe23c23e09e
SHA5126361248529aa21cdb1cc333360cb38b79c51f4f6a4786e2b1c124822490954874078cab2068776a19cf58604bf99f6a6a272203030a8e37a9fa999e6d8712274
-
Filesize
1.3MB
MD582db0b036e5491c5ab48ee4def9e176a
SHA1ee07c1df4bdc930ea0538a4ec7442710e89c61dc
SHA25698b1e4412b9dabef4dc2a72a33817baf59e88448a125e9791ef4200b8082745b
SHA51229a283558ab9fb62bb3b48af32a54b60583796583027085f7ffa453dc1e8632269e8d64c748df55d669cb3ca5ab4cb977a3c23067d5a40227d1adfc047c871fe
-
Filesize
1.4MB
MD50eaea42f7ab3cdf4a61c16474f594353
SHA1c56b5a9288d2cb9b5cf7ea66fa62624606b2c058
SHA2569c346fbea1df07af1de3857bdb9e9b92734939b2490ac0224af072a9ec13ba4a
SHA5123fa4475e50dc606e9fa3466a2d5a24bee323bbf9c3f96905bac0edce2fad7dce93d6b5d35701df3b70fa24de88876c2516c3fb62ef98c74843bd55958d14a984
-
Filesize
2.1MB
MD5f59c8db53cca029c2880d02871fa9996
SHA19e703a5428622f78754c4e6548a15009ad6559b8
SHA256c8a7b7b5c34b65f517c247628a5e219a6d559b40d4a67a666460ef05c8d631f5
SHA5124159137a7fc12d3fb417fcd341c6b96af9561a3e323930f6f411d941df8d96e32b7ac97654f11e6324d3e37ec927913c290d3e8df09b27c5674020d67187fd93
-
Filesize
2.3MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
1.6MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
624KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB