Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
05-05-2023 18:25
General
-
Target
18d8044858441edcc126e76dab8c868a23acabb9abf7bab966e4c3eb24f44043.exe
-
Size
1.5MB
-
MD5
581f51fd35e943a69a4c569fa8654736
-
SHA1
610e7579a996ea788ccb688a9dda9d4855a40a2d
-
SHA256
18d8044858441edcc126e76dab8c868a23acabb9abf7bab966e4c3eb24f44043
-
SHA512
8bb8ce0f096c5a08e2457c7039f0169ae312f850e8189e240176e7a4ccf4ba113efe9f3a19e4e282ff66b60e48b0e07127270da804e0192f5ef091f7ea9e03db
-
SSDEEP
24576:Xbj8B+M73OglQfGmzu7SulbydbwcLxTDkU9tMMkB5lO2dMqtX1uP:XX++tglKKPwbwcLh4otmB7ldMg1C
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 39 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\18d8044858441edcc126e76dab8c868a23acabb9abf7bab966e4c3eb24f44043.exe"C:\Users\Admin\AppData\Local\Temp\18d8044858441edcc126e76dab8c868a23acabb9abf7bab966e4c3eb24f44043.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\18d8044858441edcc126e76dab8c868a23acabb9abf7bab966e4c3eb24f44043.exe"C:\Users\Admin\AppData\Local\Temp\18d8044858441edcc126e76dab8c868a23acabb9abf7bab966e4c3eb24f44043.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\18d8044858441edcc126e76dab8c868a23acabb9abf7bab966e4c3eb24f44043.exe"C:\Users\Admin\AppData\Local\Temp\18d8044858441edcc126e76dab8c868a23acabb9abf7bab966e4c3eb24f44043.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5ea476d1fdb54f317d7fb9d68fb239bb4
SHA1d116d8a688aa5dbb1d08265e07975070ada55fec
SHA25676699ea2ac1073cfe691d5c6951acfa7d7018954a45699a6713a2437e94a7192
SHA512a34cb371aeec33c34a64b7669556045c221d4bf9d2555cf0821bac13c9f2f72e9ee02470ffb0b7a03b7832f6cf1e11376ec82a0ce6e80697e014e7fa3efeb4ab
-
Filesize
1.4MB
MD5397b36fc6898de1d47010a69efd7228a
SHA1bdfb89f5d1b980b416ad369c19073c09b9cdc9b7
SHA256fdc8922f67b55820ada40d4264d9391e9dc23992f06960ef4fae91827fdafca7
SHA512af332ecacac3e2ff076b56cd45341b6019d1d15b843256d882fe55cb1356fb738f9a11d7460817c0e2c8f016f016059913035992029a41219549a719311542b8
-
Filesize
1.5MB
MD5affa61f257c04d67d8a73d8e4b08b8fd
SHA13f915f7ecb37243297ae1ca342e2c8aa16e079b9
SHA25690a3fdbb1dde37ea16cc9a8bc5b1319cbfd24f8e4cc1a05e97104b3152c91206
SHA5126e8a39b2ce13ced20291da617258a91d798df7171a8e6b32baf872b611fdd1fc2da2da0281ca621de6fae210f40bdd630329a525eaa4b44b95b1b0a627106242
-
Filesize
2.1MB
MD58fa9d3936ff1d7fdaf51b91c9527c6a7
SHA1d45291d5cd1a4fb6acfeb6ffd5280779dd81f65e
SHA2566c49044db37f94468f5a3eedb16590b132811c4e1be62af1be490832814452ad
SHA512ee50e4f83184be10363b160c973b1c451cd810435739ed93b0524d7e8d50285af41bbb6a1c7f94bd22f9f6ee22f783136d44f3ec6527d512430c497ed5a3b3f1
-
Filesize
1.2MB
MD55a2558940cecbacc7bcadcc3f62e07a7
SHA172e826f6e3e5cfdea5c9e98d47a1711bb743f427
SHA256c0cd3023add0c6fc5b4c19e9af843849045cac9880e220dea3fc29f341b4dfec
SHA512d56a3b1001232699363f77775fc9881a603b5c9412580a93a65649ef47c8904811b7616a8c524a2683c71b6ee3a1d76906f66b14f95a1efe229a1f2403b77107
-
Filesize
1.7MB
MD5da81a4f73ffc829cebf489e3bd714e47
SHA18562a2e74fc794ff508b4f8f37483eed40241cbe
SHA25663e52ce3e6f5164bc89f765767b906018643f8b38e4faeab834029a05c9d82c3
SHA512ee33e9fd88a512710d0e6b4818566e36c424161450e91afe5b2abe760f5d8dcb430d1916f496d6e8c749e8087defdf5636843fc040e5c4fe4e2b6522b9b6bec5
-
Filesize
1.3MB
MD5192cd7d4ef40a570c02340e2478547d3
SHA14066eaed436378401659b32fe43ba505444d3f5f
SHA2569818a1af230392200d7e5be43e0a80fd3ff4b1e5ee1266579cf5e9e3384ab19d
SHA5122a77ab651e8f3a8b8ac52b2779a96a86e11f4be5a47cfeeb056631ab1f378da2061047f818d65b96135557a54471df1f801433bd9deb9cbb61c79da0ea27a429
-
Filesize
1.2MB
MD51f13de2135d16459ac7b484c9c4c0d1a
SHA1613fc2917f677141a379f112fa14d0ed98544e1c
SHA256a3e5d5edcf977ebc37eeb0b92f425d7dcb2aed24525830eaedf10a86ba6090b4
SHA5125ce57a203cf87cf5c32a5052c16a2897448cb89219c02247db8ea27bb192cadb73950b9a7613c42adeb0c79b73fdfee657c8505af227dbcf353e4f24b083edfc
-
Filesize
1.2MB
MD51965ac98af72550f3d764c8a719e2b2a
SHA109e430ceea4edd57d05582a45c7c2fdb2125d5bb
SHA256347249d430855662ae750ddac46fa21ca4685b16a5ca3c2b0c814db016099561
SHA512029e106af1626930be40b029ca69106b39935f8bf78494fd6597c489fcc10ccc3f2da7c5e31fa513ddeabf38c91b6384728d31736a217e31c75f5bd69b912994
-
Filesize
1.6MB
MD522cd208d7d109950771f5a38a99f68f5
SHA12af4bb6291c2d1ff0a479063172263e2ba3d9a58
SHA256b050b38dbe0560a96f9b3eb44eee2b3d58a04b2267c253bb7117fa4ff3810234
SHA512b20d31f1fbbb95d3f41cec562f32df22f9630f6a9c9a7757e7fbda100537c02faa4d6c7e07da863ef475ca36ff077e9c15f4cf78d81ce6b523fafe5952a2a8f1
-
Filesize
1.6MB
MD522cd208d7d109950771f5a38a99f68f5
SHA12af4bb6291c2d1ff0a479063172263e2ba3d9a58
SHA256b050b38dbe0560a96f9b3eb44eee2b3d58a04b2267c253bb7117fa4ff3810234
SHA512b20d31f1fbbb95d3f41cec562f32df22f9630f6a9c9a7757e7fbda100537c02faa4d6c7e07da863ef475ca36ff077e9c15f4cf78d81ce6b523fafe5952a2a8f1
-
Filesize
1.3MB
MD5331b9a7470d41b23f076d8b74362a21d
SHA193d45607777ec7cb44fa33c9bad42ba8950dd1e5
SHA256570eefdcc5ff204463030ea3cbff34e5ff0671d069dc1743b59353a20f0b5f5c
SHA5128d39bf4b3b1e06a84b8b0cc0716e2c8d1e836d6c2629c1fa94b8beff143861150aff72783e2e2a30de1016f15bd9619242b652c92377366d87e1c1254888e962
-
Filesize
1.4MB
MD579b23c46e53daa89e8930ba5fab0f63a
SHA1afdc2f7df438c47039614cbc1278c54b35d21969
SHA25685d3507f3f24ce175ef7bf1c7335449f8067687b123a30923134dee83e3df2d5
SHA51240a1fb54620f08bfdf1671f5e319d4cc3f83610b489346baee5da205ef456ea18910f7d727ccea3ea7d229f4f5c09df0f3e09d44c7f5d5301beea630523cd812
-
Filesize
1.8MB
MD58ab78eb40460cb110ac52f2dcc294e49
SHA171195efa813c9f19282ef4b103c27d0e22d24f1a
SHA256451f47f764cd306858e8da33ec1435894ee783c51f5575ba1efb5d403404830d
SHA512b2eb8b2d0647edadb3a7e470b3401ddf6847db010a5a414399d7b85b2d0aab72d0270b3a21478bac36410fc60a2586c025e5779c95ffb7ce3ab9d12272a12d88
-
Filesize
1.4MB
MD51b8e1c4cfa07e591db99d642c2efa7c7
SHA16a51d1aa18b9c8688fe60f52d878ad25f27ca1e8
SHA2561d63bcea6f5a41b0a52084c359f32d49373328826720a87f0ea956e30595ee13
SHA512a87c32396226caeace7bfb2197631ad81cbd4bfb0ea3e4315b9cc9c74fad3a5daba2f4ad3f5c3cf17034583aee66267b2caca7dab8af64cbb72f0b8de8a7e845
-
Filesize
1.5MB
MD544c8b34f3e2205eb500166d07fa05286
SHA175f6caeab33a3c81666bbb5a12d15d58dfbab6b8
SHA2563761174dd3b79d96be96dd1457b42896a3d39d2efb4510024dfe1581bd476fb7
SHA512f1b09d32634bfce7bf145978fcaa98f39ec8979a595a0abf304cd9ff0a40f10b47213350c3b55de2ebb73b0a77fb8e130bcb6ca4622380511c6229aa7def9cb8
-
Filesize
2.0MB
MD53824812efabdf002b30fc3ccbe0bef36
SHA1ba1042b8537ca9c74b150f88726ea9940b713068
SHA256a4ca705d0a3b931df732ec652a00f23f40903b34abda97dfdea5396ac2a833e0
SHA512e6f19ee511d94adc749970195cfc1aff8081e80fe0ec1480c27ad6c05c6a71b8509f5ec2b3b800d0601ad64a2270abcbb725dcca1b560d650744dfc418de11b0
-
Filesize
1.3MB
MD5f2fa542ed566c74eb8a6e01b6706ce9f
SHA19c97cea55c77a681c3ab356fde33c09fada17a64
SHA256517f93e7d0d74d445c1bf6bb85725976e6deb021da670a4a6d5dd50505f58500
SHA5125bf193061ba65229a3e54ba1028d86614490a3cfff1707a504d7768ba03d7411c1d32a797656f56da4085dd538f0f320be305e2627d9c801d451c613673c42a5
-
Filesize
1.4MB
MD5633d796a2e5f8f612fb2a2ff1aaf857a
SHA12b372adfba3666502957b5e263413e653d0ac589
SHA2568a99f7c0064426320bf39f56aac32a29fcf3ebc85218c28cb1b11969d5824eb1
SHA51223fe11bc3e49e526c89c59c22b6bd7a78754ebbb2e376d63dcc864fdac711b1b051f3dd661ffe07ec9a9b23b7c1e728562ddee833e85e5e50f92ab41f590e62b
-
Filesize
1.2MB
MD543f887bf64f2fa26ec9533f4211975b0
SHA1c5c9c7c825c79f354a8b5f9d7263753d9578a7a2
SHA2564955e9a2f5b5257e78bc35a5ec0a422c9a8ed56449246f92c0c320bf5c12fbd6
SHA5127d4d3759e0efe7246b8668aefbf595a4afaba683785ddb11aa62aa50f0a0a1495ed1c9edcb8161766383f01187b7986046f55a0966dabfcefb567ad73cbc5315
-
Filesize
1.3MB
MD5383372e5255cba6da9ea6fd3a244c479
SHA1ec20c9f4ee3d2a6281c06f351fcb8038e3b24c55
SHA2568735158acfdce0d1dd15960e8854cf62a86ef4c9449eecd4553be5eb8e5eb0fd
SHA5128fa36fa5bf01ba2393a261a2e86c0d8f8354596d24507a96ee0d990bb755f6e9889ab6943aeb77f9f8352d507c09d8d748f1f29e8b5672f8f8e383f188eb5780
-
Filesize
1.4MB
MD56d4363ecc774cb702262015f3dc192eb
SHA19df3b42867d8f2d661ef8678197084da2a9915d2
SHA2567ab30e98a62b6eee3473d8feead26bf4178c6a772985cae130b682c56d31d163
SHA512c2569b77448997c8713e80a48e8496aa91e3cf6ee29afef8e698546e204945c2cd5b94a053ce36c031ee01aeb50e42a09e035f0e65fc7731a028991336a620ce
-
Filesize
2.1MB
MD5ad6227fc2f3e41726682addfb8daac4b
SHA1229a2f3a3e5aefc76baff03631cd1c064c6218f9
SHA2569b5f33eba7e92d0faeaeebe945f82cf17f1d16030e582782b79c316d7987d617
SHA512688df875300b7f937c77e12c84c152cd1d84e0ac3e4d3de90f41c63f6b98e28389ce2f8aa00a350eb8cb4cf8280441bfa2d73c1f4fc9ce15b24815e5674a3f7d
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
2.2MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.0MB
-
Filesize
2.3MB