Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
05-05-2023 14:28
General
-
Target
Technical Spec.exe
-
Size
1.5MB
-
MD5
ebf99fc11603d1ec4706b4330761df32
-
SHA1
c560ca5ae10593d7861701654d839d1071515866
-
SHA256
693c258cb5620f7e8714d4afc7215e2c7dc16872265148341db23b639906eecb
-
SHA512
d31c699f201343bd02c07bbf5d41e00df8368b81bfbb1d037fb4b1e1894fd3b8232e80b065845745fa6dab7f23d47efbb1d8b6a9143f5b7db0fb4a57395c4f4a
-
SSDEEP
49152:NQh9Nn3uFcWIY2YZGIUtNlMpovD2i9c2:0/37Wp2YPUtNlMG7N
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 37 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 9002⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5b109a633c2bf3c698c5de5ae60960e97
SHA1c43c4508fb77da3847622035c57da40df5b53725
SHA256da840391c8f0fe8ece73f81261c1e013cd510976cdb03206a3e9bb39c0d78ac8
SHA5123dbd986683e1dba27924d42f4ccc33270962c0bc966543db4f71b4e9eecb3b168e8c86f5f18d6a78b39df691e7948290c530aa71e090c25b6e9c24cc910e431b
-
Filesize
1.4MB
MD503393f866755335016e96f590b6a7284
SHA180fbdb8256c78d10cdc9742c23b519dc0b9d3d14
SHA2565327d4f939b97261e6352c3ffb37f14e860a8560d78e83e99838fd6285d72b36
SHA5123e077ae1e4e6ff917deaf3eb4abd238b0aa3feae55acbcbb480f0fe3ab493c1b3bb518ae136dc242ede571eb3f6a5983a3275e9c1ed2f1ee1ec06b506e1ed15b
-
Filesize
1.5MB
MD58f6a5b93fa39c0790a5930e3210515c6
SHA1b4c9433deb94b9c9cbfc5720dda23629fde79929
SHA256e477152e9ae2b0a9d249f5b4c59e68d9ae23cefdcf4139c186aea494539703f5
SHA512687e12f5a6d68a9be1f3bf91ea29799d92f77227aab98d8327ca59394a8f03dd979f42b4d71fe2cc1d76a8d685c2ba19a26f1cad96523c68bbdf62aaf2b55e2a
-
Filesize
2.1MB
MD55bf2c3fe05ba4463a485a763ff3348f3
SHA1e707300ac527a1c6568824b9bea4f625b1e34df6
SHA25664855d8ec88e287e127428d79380b810472bea70b771416355509feaa65a50bb
SHA512600046963a8b8cdc437cabdcc2332e06d7637b34489d36449aedae650ab1d0e0423635516279baa50872ff43275c4a98e87ef74cbd64744dd9cbc1f213383177
-
Filesize
1.2MB
MD59d995a7502b2f756bfadc8777af680b5
SHA1f3d41013e895381473923dc075649d64bee8bbb0
SHA256a9d7b3fa294d43aec24f9ed7fff7adcf3d501b3f512d2adf73efe8c3083d97a6
SHA512c7daf8e85adf53b321fca1b2322aec2959fc79923710dd30e93392cecc56c51b342afce37b94804bc7d8d27abcd6e7afb14a19be229d1653bf2bb3815dd6fe41
-
Filesize
1.7MB
MD5de33f0352397e8f7e6226b7aece93588
SHA155a9cc0123ec9efb685124cb2db1adc19b00f984
SHA256c2514d1585963b4d5c93ea06fdf2fe4c7359ff12c1ba6ccb79b537c219c47e55
SHA512fafdcb8af18a9458cc69f50f57bd61cb5272b3c650eac08bc310c17dea0d9b0757c3bc587a762f73ec886a77dc0cd5e7db75a01f330307e86d5d461f81aeca91
-
Filesize
1.3MB
MD56a9418983e7773db0754058892b862fd
SHA1af52942c2ed9592c2620c41b9b2b9b28e632d52c
SHA256e32947df891700d293bf7f87548823f41af63f0ca4013aaa350a297365a2248c
SHA512cb79ac573c0e17803a155a1c7b468aabd9346d99bd3f727f66a25afee3364f2452b8db9a561d583345362fe64479d4c1b56989fc644d2454fc0b75f753782127
-
Filesize
1.2MB
MD50d67250e3ba134f0552ffc01d57c202d
SHA1c38949a5a429c61a2ab304f38aca91cd65d06409
SHA2566c9c43a221a8ae553acf2775d1cd23557d4d6d03b699c876602fc0321fb20620
SHA5128d724b75b63f5b89ed278e73906c79d6a65c1aca6105b82a014c7e87b3bd320de1fad9f09dbed86247d456b8140637dc696dbf838f58aa970ed177a2e8a5b822
-
Filesize
1.2MB
MD5ee2092b90e631ed206f9acc4f9108c37
SHA19414f10f062bed509c55606a847de77c7f19c0c9
SHA256b686ec391098f8c72592cf3ef6679c3ee7e601f09a887500dedd476713f41b7e
SHA512a17f9c51e13a05769874905f9e22a4a2e8bb429602cb20017abf8191d8dd5337fccb592cc9983e066a3369a824e4e9fe62a670f3ee9cce1613c1567df52c3555
-
Filesize
1.6MB
MD50b816ce3819feab064609eeb26220560
SHA1359bd5b42a2c928dc2fbdf4a3b838b8f5ca5e745
SHA256763c153ee2c61bd47808e24bbca71a655f0864b04342206d1f6d49ef4ad53026
SHA5121171c7822a28c5f3ba899ea983dae8ed8ecc9dab8ec06c80563f7d8becbdfca5188113b8cead0720b58db437872bc53ed536429576433ad7a27d1d20eb07a038
-
Filesize
1.6MB
MD50b816ce3819feab064609eeb26220560
SHA1359bd5b42a2c928dc2fbdf4a3b838b8f5ca5e745
SHA256763c153ee2c61bd47808e24bbca71a655f0864b04342206d1f6d49ef4ad53026
SHA5121171c7822a28c5f3ba899ea983dae8ed8ecc9dab8ec06c80563f7d8becbdfca5188113b8cead0720b58db437872bc53ed536429576433ad7a27d1d20eb07a038
-
Filesize
1.3MB
MD54c7408ceccabd942ae65e37d59e42559
SHA15ac82bbba77bb64a12c0cc47e9fcdbcef3d0a664
SHA2565c6c1ffdbf4c03692bdef75ea75b38d6506b1bb4de00351bc77c3f1fc8ddd6d7
SHA512cca1f8194452333fdcde82a1a97aa41817b81c2286b6c3ba6c8cd1c2f0d668560bd0ab335ee5ac6d2d4e3692393752a32377e380afd7e97b750151e8d13f76e1
-
Filesize
1.4MB
MD5580be07387284f714716644b6ce450c1
SHA1ea066cd7309219b76361f8a55ef9e59bfdf43d0d
SHA256004c7b0f8dcd63315b830a1ec160facf0bc3ed6092c819da52a3d041c09fb8a1
SHA512ebabc4c80b055342ef76ce0281d4bbf7bb146330f58157a4518fef395579161a9921da5e378097fd13def94d35afd6acbdca4aca47ea2a80ed31721ceab1951c
-
Filesize
1.8MB
MD510d2e1a4ca6fc101a622ae7ce3484398
SHA1e50a0bc44131b75d6e0ef705b138cf5539e14af2
SHA256072172c6ad0e4261194f55a52e47804b51bf68507242fae80d48b7ae3b1c2806
SHA512060ecced3ca2b1bfd75929170df574eb8ce8cfba77c6466077bd24e8829ceb6145b939fb5ac3b3575e9330039aed54bdf7dbb7183202611399766554adee5181
-
Filesize
1.4MB
MD50d1305c82e143b82dbdc4b2bfad42282
SHA1e7b9104ee3ad1b0feb1d291aa5886e03b88abc03
SHA25674fccd1778e6ab599b6b88f55f78b467ba25ee7c16e49340505623f864652b2c
SHA51298317ce604c89b743cda0f6ce192d8793f609aeae8778b4c336ca40e3fb6cc32b168a327fd0ac81d9d8a31b27f07e120ad0924c77b24186bffed2e41600994b7
-
Filesize
1.5MB
MD54a8011d26e4f55e668b752aa2529e1c3
SHA1a03bd9ed4e23a686171d7f1c3c4c3d3a4bf4b4fc
SHA2562d153ac993a19560fee674fb8aa2f3ed18913a0d7efee04f054a1eb8f30a3529
SHA512e211a6139811253c635e92e81efaaf495bc20ac2afa35cacb814e631827a9fd9dd30a07879883b54e9f8d4a187603aa29b5dbbf7607bf4169df1cc0742759517
-
Filesize
2.0MB
MD5e724cfb7b1c2dd5b63a5f22bbe840cdd
SHA142eb5521063b9a2a9dc76aee5936504a55edadfb
SHA25638faec1a812d8737f1b6d2bb984efaba53abc6c5ef6f58487e95e28ba4373137
SHA512080c9ff5c708aacfce7b5a94662d6b88129d358b5c0ebe37d3e6643073b7271ccfd0e4b8103910fc0d13e96ad07afe5d5c27dd19d9bfe813ecdcbec1f7ad6089
-
Filesize
1.3MB
MD540f9f451bd8a5c019bf90663ab83369d
SHA120656a96be33e72013ef263b8ec35c8ca0df81d4
SHA256c91de9cf9f0d24023aa708b164f24a05691bbf6adb381a59375daae81b5ca7b4
SHA5125f2e0e96a4a77e3228d4873e28013255bc677521a61bcb80480aa4e0e867c5100a0554d6d35ce43917d9d33eb044d585fef2e0c78b676916ba2bf7c75c9aec59
-
Filesize
1.4MB
MD5f7a0f71efa831e8092e14351b26032a4
SHA15cc6fb43ad17994ba6a6be656017a3d8f0c6a3b2
SHA256afaaabfeb78f74a1e27c2ef1a0ad38f9469d84690a27850817c2125523a2df05
SHA51260e52c99305a904acd7ea4f5dc2e72f553d4626ff18ed6b6ab2feed52a48b1e20d6af9818df2c86c2b5178e70faa6ceaf37013ef62586e8892b0da3547032b52
-
Filesize
1.2MB
MD5595d11fb27a4536a419cd0f9a69fe9bb
SHA19893de68a213872dfe35c0a0d8208c206306b5c4
SHA256be99905c0e3142f93c38af5940bbb1805ab12e8f863640aef88768adf17cd7b4
SHA512520fa13fbeac620e56f055095311425d965531f4e4650b48a8675634016ddd4fe70c3778cb69c0b448f61caf147d005a3f1a30942b4a912946e3221ef2adb88a
-
Filesize
1.3MB
MD5947ee4944b416dd3c35b779e1978c32f
SHA1bfbd897856f5d12fd7c92bfd453569e0488cf130
SHA2569f67f00e925f1b8f517f16493df77ada337921fd6ac8ec36590927a1b8d55cc5
SHA512f34eeda54accd79b51f15bd24be25979358f599ff64de39b533d13714a6c92f709605d876cf7a9de8fb0d2688fc2c92d6c82bae81365ef238dc894da19381314
-
Filesize
1.4MB
MD58f3f5ced2869f2484a6726c533de3639
SHA1c16007d50c4673e2d1436db42872d514b110ec0d
SHA256d8b7b2ecde3a1754b43a41976c9ba7ae0d53b2b225554fe2cc54038d881de369
SHA51260e7a83ec55a65549601bc38ef594b208c22f99ecfc8410db198e4b3d306e98e8fe765e21dcd35bfa235a6b608bb8bd4fe98bd6caa735777638243db60e86cd6
-
Filesize
2.1MB
MD5f95902aaabe00d312272cf17b5bbaf54
SHA15cc866ccf00d6918be12218958ae4aea71d2b8fc
SHA256d4985602728fddb711b0a4c1f8aab0bc2bd063bb2972408d8806ca5d267c1b11
SHA512b6cca3889aea00c38fe4ceb4c7b7f8267855c8ca4c4b991df46b2aba5d30b21f7f402c9b3b179fbf7db02e4f8419b542db9487f4d1ccd617fc2ad883e537ccb0
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.3MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
408KB