Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
03-05-2023 02:26
General
-
Target
dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205.exe
-
Size
1.6MB
-
MD5
e90e41677f6030ffc3eac62929ced1d9
-
SHA1
edb0a2acdec33328a864ac178bfb0b42a2e0d444
-
SHA256
dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205
-
SHA512
a2e20c8b160c366baed60adca173587e5c3b94b811f4f52ac3aaab01a0301716e30cc7c7d2a426ee32a6df651021717e4fe097073610860a949e7933468e10fa
-
SSDEEP
24576:KRKQxWUF61/J27K4mgZB67gTsD6RROjiDefziWX2GDjGBXtnZYx:K4QcUFO34mg367gTOwMMohjw9Z+
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205.exe"C:\Users\Admin\AppData\Local\Temp\dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205.exe"C:\Users\Admin\AppData\Local\Temp\dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 9002⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5a078bae31ca61dc0c7443eea0fe89f3e
SHA15eda98f1c7683651c7845415536dd5e0a3ef41d4
SHA25678fc3f5a62a5d1aa588c7405bbd0afbe46872178d635c54a6ef2794c2f09c8ea
SHA512708040b2754840fafd68c435a7afec8cb9c6aed6c0f5c128028e65b626ef6c6e7bf7b68af046f55158fe98d592e2d9ed7ee4f4e2eaf668fa0ff8d2945dac4c2a
-
Filesize
1.4MB
MD5f8976862dfef28e159b175d0c4c0b17d
SHA1bf3d14f1912841744dbfe7389fc1b823a8c3f0d1
SHA256cb3d6d1340f2b54c412cc14168b2988120ef69d27c750dab6cb639e12ec6b483
SHA512132577fe3e7f436a0db8072cf5f0f6be93eb85c967a880d2abbc1e25318b3ea3ef3602d6722c97ab1eaa748cd9dd0e82e598013e8b01aa727ef85cf5b21115f1
-
Filesize
1.5MB
MD5b9efa166ea09166562511494b13ee91f
SHA10ff8d08f5e78c9f9d39a2ac6d8a1cd880735ed78
SHA256ef9a217fe11f62c83e7a42bb23f967a20ddb63c0ad671b47b4791c1f5aac2668
SHA512c4f09b0239af142d8e36faefe4ff206576a611b59241e519252b527cf926c472306ec1c5ee522a984991a7a51c26c0cc11c2f3656427f8d223633de19e91aab8
-
Filesize
2.1MB
MD5979a436881a2b7d516d6856aa66dbe0d
SHA1fa149f840ef1121cb7b86731e84b8b8693806a3e
SHA256dce2f2a6dc8a0b488f4a6ed7dde3a70483c03499d06d2c936e5c597ef70e6022
SHA5120bbe4cbc058bf4fc566ceb0c16c4cbf351601da910b20ab116ed34d3ff3a93952d220ffee122cfcadba32c6f178b137105ce27dd3b02dd8b8aca8782e1ff63d8
-
Filesize
1.2MB
MD55220f135ed58af95c64a7fcccb03d007
SHA1f7bbfcf3acf0edab1dd76ac0b8e89438b3792cb6
SHA256fe9b06ac990c7997a72de2d278df374b138898afe5ccc60ca375627f2800fe56
SHA51294c4f151d7c31c2dd4a768c814c965c3ece688d4f03e252ee0fe1a3b0da5df1368e5cf8a19e5bb827f19786513013c55750f032ec3937e5a97f49da97b8e07a5
-
Filesize
1.7MB
MD505ded75dc1d589acef01e7df6eb87e00
SHA1e02f857de09cec5682f9608144aab5f11a450789
SHA256e481d021ae59b9a5328cde5e0d251b8a9c34a81f88c444feafd1bc8b48f78898
SHA5125ab7907b161de5ecde90bb4d878f48e02cff5ee33102fa91d5b5b5036edfa1ba2836ca8d778c1f8bb7b412ccad90f3dc973d65c0705aefcd36e810b423ae2324
-
Filesize
1.3MB
MD5ddaaafb52ca44464a94ded10b988ea41
SHA1767dad49922a110ead7e51ee3aa37d07d4df387a
SHA256147e41abc7cb9adf37f52474f22e18bf33341940549b74c904a0d59d744b7211
SHA51207eb452ea4767b27953b6dcd0781db6f0db0a5fafda70bde45743a103201846fbc5d344cf28c424a7c71115d0efb91392aa3386b4009e7197bef6c7157de255b
-
Filesize
1.2MB
MD50dd5fef580590753633e480b543dd5fe
SHA15abf1db6075ba5c53ca668f312abd5ab704398c9
SHA2566cf85c12b5ce3d13ce2defe0b33f78404e5a3e561c0a77c82414d270e1134166
SHA5122aee4fea15a50f642edf906b5d4c71e70cfaeff3b811d54f827c24caa90b5ea945a482f8a7d71571c2557816e85047655943259c8c3dc7479525db96787c925c
-
Filesize
1.2MB
MD5b90ee492e940326b3f9e27f38e4ce42c
SHA1f2423ef284482f5d1b14863ebe8873f0429493ae
SHA256e4735c90af6f579caf746c25176c09abd8593f0beb0c3de25555e39fc1f26a9a
SHA51247e9e0a4c880cf1fb9964cba089088df230a6a7a0c3006978d4672a20b2de77b667dd0aedc5362aa1197434274fc91e9e31f45c8a6769449fb05c1c957a4af41
-
Filesize
1.6MB
MD55c20864446331d36a31371416f9e763c
SHA19c86a9540f309803a2671b175887a7208c9c2fa5
SHA256a7704fc71a8833fc2df3d083cd8068aa655a49a494dda6e3525c0da5b5353a3d
SHA512a56c5f15d12dd7036c3ac0cbbf6bae9bf3b37e3c157efdc1f41f9beace716605ce014be66e85f99a68f49b562363e3f074d7303e789724f008a078776820d9dc
-
Filesize
1.6MB
MD55c20864446331d36a31371416f9e763c
SHA19c86a9540f309803a2671b175887a7208c9c2fa5
SHA256a7704fc71a8833fc2df3d083cd8068aa655a49a494dda6e3525c0da5b5353a3d
SHA512a56c5f15d12dd7036c3ac0cbbf6bae9bf3b37e3c157efdc1f41f9beace716605ce014be66e85f99a68f49b562363e3f074d7303e789724f008a078776820d9dc
-
Filesize
1.3MB
MD5caddd259852226052009a136d56edfaf
SHA1d150b40f510917d22580876bb6345627745b7184
SHA256e6eb9ad10bcd2a5604437f04c57ee617e3ee6b72d1d0469d53b9a95fb7a2063b
SHA512bbd13e7545fbabdaf584b6d28c342be1b82b8165e18b8161c510e0268527995ba8afa0f6df692b3b85c4957910fb93c4a392c8ee670adeafbb69ccc91557d453
-
Filesize
1.4MB
MD5d390c2df7276cd2f5ea1c2b876dd59f6
SHA1e9bd3939a082487d96d70e6ebfe25d2a00976042
SHA256f19c77de8ca0c39f7b2122c56273aa1ee5854ae3ae8419c25206bbfeca8ea7ae
SHA5121ecd3b2c486bc5f84e675b10b120090f3d604cfe88e9f2b94d5bb78d6f885d9deccc936d41b884751d94324b01b706e9f89026e9cd2d61f2ed641f6fcbd21a94
-
Filesize
1.8MB
MD517ba156107fb75e6c1c3c9570e7f570e
SHA135c2ee5f60e111257e340dc1e1f15ee73c609863
SHA25608b832beadf3971210614c79a28b12ebeb0858e2ef3833862907ce6f7d0449f2
SHA512fc5dc7405c816e9ffe51786a7b40fbbdc71cfacc1384b5cf37efd8fbfd6038c3d7cb61f287e9274a3dca6e6fbf06004b8bd97bc06ad2b238970612aef23c5816
-
Filesize
1.4MB
MD556db163d7c4ff3e14f287b6b1bb6ae83
SHA130e5bbb85586c4baaf9e275f7a7877b295fced5e
SHA256a7a2fc32f6a7a13c183dbc5091af0a7bf6d7737c197007c1c72732dd1223b6f0
SHA5125bbad30a7278abcfeb4b7509f2f2cb1ccd4de649fc142828d3b3b68581327b17df2a7468bac71d1348ac1f9e09da0dc1afc53223357744c418359ecdbfaed489
-
Filesize
1.5MB
MD5b354556c29dcab25493055ca38e84967
SHA12048833206e0b6301c9f298b903efa5b6226edd8
SHA25657b5da7afd30791aa94490b0c79641b5a52e36af06aed9822bfabaeeb9299aed
SHA5121bdce770257b142f9de8285304bf64dd7a5f42cb57e39a7fcce6295b54f648ad166344468fba29e70e1d6ff48ee46986ab7f06e26091fdda4a6ca0bf0ccac149
-
Filesize
2.0MB
MD579f56556c8961a9134b410f9fe00f232
SHA19028aec959f158e6b88f2ead4a4264a8a79c5237
SHA256003537e4709c54293d71ddc48908f3d4a0cc61a6f7496486d5c04dc97ec98972
SHA51248e2ef4cc8f8a0fd4fdd624cbc03b11895fa3ee09123ee96298018eab97db0944df1ec86a8a167a36606d232045da0f24e1b998d08f4dc6da2c2806680e753f3
-
Filesize
1.3MB
MD53831316a7407d7f3be9046cb52715f56
SHA1a661209d218018090ffd0a3cfb3cf291a5c1289b
SHA2563eb1eaf4a2feb455a5543e0a3822a352a8832a9d2266d71e9dfc52806de41446
SHA51224e3d9d884881f22efe9a193e06a106fe02c38a1a10a6e1bcae554bf1b14cbefd68429159996ef0911843bc1d640fd8286296a960118b1c73c2ce97dd942c4e4
-
Filesize
1.4MB
MD505cbfe7d39f9f1d7f2ba3556991b28ed
SHA168e03b0629940fe7f59a632285d14fdc8784b202
SHA2568a7c15dee95d64d0d28a031e1414864ba4ab2c40c7b2ab8a411fb5b8dc1222b2
SHA5123d3006b5577d1edb594c1e9546124036bf1c6e37e308975770997d44e874811bf8ad33c5f33ecd67d427eaea97b67dab4effbee6e5bf78d8490896c37e4dd716
-
Filesize
1.2MB
MD5760ba3e8a0223f029b7c169354c37ffc
SHA198984de4659acc40ad917d9c24d2a62a4fe3e932
SHA25680f4a0b3dd49fba85076fb5282f32e62f5d7cbc9f37786ac79e0d2ce4fee99c8
SHA51223d3d0cfe2f5607fe162c5721fbc52246d4b848e683ef60501d0cf9cb6f25a8beb0a45339fad7e5892b5901e7e68990a9ec2efe188da3e17151153cc12136d8c
-
Filesize
1.3MB
MD5af44d1a8881edd1f9046dc7666d76974
SHA142a17b3c35a635f9eb3b945f94edfdbecb64d900
SHA2566f2d2b3183888aea25bb621a43ec877ce9eed725bc4633cc429dc6cbfb4b7e16
SHA5121ab1555882549f9b750de21e3e15f649239ccb7a6a756b281ed196512a45c5163e3644c727bf2e916084cbd13fdfa5f869ad8622e077dd6c62d465ac8047b8ff
-
Filesize
1.4MB
MD5e49282195310ee4b6407302763d5cb50
SHA1db157609150927698a6108d3c6ff572f9b186a33
SHA256c2daa246329e619813d08d9f2701f0ea55b7b2510077f9d79c6a0f4c3d5db059
SHA512d9bdbebee6f542729feab92258d6804e850458064ce71e0191ebb00f15de7554abea537253ec5b4f2548615890a9de95411286ebf3ac64b13adcf4a6e5397444
-
Filesize
2.1MB
MD5bda71bcbde70f7bb28ca41c4bcad9d5c
SHA14b4a7dc057be0859b09b14720ef56de84224c9e6
SHA2562c20c1fe942a0b88779c4ca64679c1de5049823b944581330f1f14709122d9ae
SHA512d83c7552078e63a543211140c5fabc0450fd8e8c22967a20251011183b380a719b9da6a84365f176ef9ec3828b889a18a0b775318c05790812778ad8816358ed
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.2MB