Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
05-05-2023 18:17
General
-
Target
427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
-
Size
1.4MB
-
MD5
34aa0ca40863c30653a0b6ba10d3daa2
-
SHA1
c5dbbc9a3f6d537ab49aeb89223810cd67c256f7
-
SHA256
427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9
-
SHA512
34e46909f3ea586033baa5f73ecbf1f5072f2d05cfaf77f6ab2535ee0798f01427b1e62719fc4026f4b38af03e445a33ff2deb22ef9817ab42e506cfb5cb10d2
-
SSDEEP
24576:O94Lauo2BLrZ6dj7Wd50QKQIsBJXkQsUc/i/Egj87qLom0Y5m6Uy:O/uHrZ6WPKQ5X0QsUN/EgQ7qEmv
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe"C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe"C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe"C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe"C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 908 916 924 8192 920 9042⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD527faf58ef71742b1e8bacae8148008a3
SHA123308c83da93c6daa4b395c215a1e2c1c82ac903
SHA256a7e66ae4865624e8c74726f17403ffae48054f56729903e216147047805d07bf
SHA512aa9225228303b55bfedd8d59d49cd1ac804db633d82870b86348a3f188f05c694f627f87d3010931c2eaf25e5cf5f359a391c6877dadfcdb8edd70cc2f370191
-
Filesize
1.4MB
MD5cf499e45b07d1142b3ffe9cc695c0194
SHA156e704514fe7c62e081c86d25ced83484241484b
SHA25649b7262458961283b1a5f834203ea78c88bd16ecae8519c51e9736033d53a0e1
SHA5125273daefdae93d580d4de8012ab5f3b61b8286c8f1f5c3a635d20aac32e3f5624e23ddb697a777d210748e6ff1e8b66cf51758637b8736374a824342eb9cffce
-
Filesize
1.5MB
MD545dd9126faade7c85aecfd387c2a4438
SHA14746a18da678294a820ce7c59c49bf722185efd8
SHA25632b849e3ab8b4792af4a3d33dc653190b7c8435827b7eb2f732ebb1bc91d0400
SHA512cd488d22d0d66c8eb22e68bc06909596bacb20ff233729d4cd6098e2969e30323d21c09a6c073ed250dff624bc1dc5ae24ba735d9cb695dea0b5fbd2a8c7ba3e
-
Filesize
2.1MB
MD554493886d8871bc88b02325d8edf65c5
SHA1299227fcc0d486c7c29aa4a9b51f3f598cf601dc
SHA256fb7ac08d53b89f1175675a8b787370065acb407624bcef6afbf25d334cfa5b70
SHA512d06f7deb3f81d1e47c385d76135161a609e44e4cf09736b19f4b89d0db1ed34b77c61105f23a682e680a6550092501904cb55db97ca68a75b2bdb1a7f8b1988b
-
Filesize
1.2MB
MD5bd3d638ecae9606d746fcfe5fbc1db09
SHA19a29f6da68c8386f536f554b0a831a86c7773698
SHA256bf1fa52210dd2af33b8298170757bcca3ac544f1eb19a31b18d48044d0d76cb2
SHA512def6ed146c958883e0dc925df5601b89fd17fdc073040b552a2d1e6ccba2d8d47e05e78de8f8d2559fc341be3a56a7d30801d4d858aa391d1f9e3d1349a53cfe
-
Filesize
1.7MB
MD50dbc0729ea8b9210a2408d4e6dc0efcd
SHA1f1b2992635767b7b8c514a3d89c8cc4387c4a6b3
SHA256645819f95f6d5d0d474fb3af7deb0c9c939530007ca4e65b696993fe64054ec6
SHA51213fa737b4c3b28efcdda1f66c1a75d6141bcd687018b7775c81ba7e02f3168e1f5c5f0468b12fedb432b9fca12de2b1006df9e3d4793ad08f26b7cb471caced6
-
Filesize
1.3MB
MD52611afe7d4bd496ce6b1680d973668e0
SHA10488878d7ed95554a139b7c897ddc2227906ce6b
SHA256e414b1878253e4bcf9d0150c75fc1042ac14bb558622c3e2befab4c23bbde9fd
SHA51214c5850e209bfd20c4a686a20592c61776757b16d2bdea9551ab2b17f67e25db80d42bd5d0112c5cee966698ab602a803d848ec4ce2655f9b380e855c9299ce8
-
Filesize
1.2MB
MD5cdd2deacbf869d0b8c813f9f3afac8db
SHA1a279ba8382985d4fb8f73a94f499e9a33f87e55e
SHA256305f593efe16fee8317a2314cbb4607ce080152897d7af3bfba33ef636d9a97c
SHA512c1ae459d730a59d995d5ec2b67128a23972a4d7698635cf58b397363c646ab0d8ee8d4fd0484f1b09b3efb8e2b8cdb577d4fc356825020a40724ab02c791876e
-
Filesize
1.2MB
MD51127f5c1185ba61a37f3c187a12dc277
SHA15c50c3ad7bed94dcaff13675dee7f11d84c1f2d9
SHA256371bfb78197f74716d83d62fc27533fdb1dc99ef8b9b38d72c19bdfff9217baf
SHA512fbc5de00406dd1c13d41d5b7b15ddc0745c8c319983a8af6a23d17fa9234d5d70f11b65db0ae3a19972b64b6b09b03b65bd309f7438fd6d01b9d5e7144cd3286
-
Filesize
1.6MB
MD5fbd64535ee7cada2c5dcb3ff4a237d93
SHA169f217d966269466f6666ca4a97250e78bd32e0f
SHA256b4526ca80a3ea6bc4885c3ebe5f8189326232a3571eb3358e96ae60231aedc46
SHA512446c4c7478eec00eaa4a0d31141d5932d6cf225fdcac6c0ad613e366ce0b0d2be9f9496dec3e6854f4b3b4714eb67c05ade5d16194456eb2f42d8b59a4822d8c
-
Filesize
1.6MB
MD5fbd64535ee7cada2c5dcb3ff4a237d93
SHA169f217d966269466f6666ca4a97250e78bd32e0f
SHA256b4526ca80a3ea6bc4885c3ebe5f8189326232a3571eb3358e96ae60231aedc46
SHA512446c4c7478eec00eaa4a0d31141d5932d6cf225fdcac6c0ad613e366ce0b0d2be9f9496dec3e6854f4b3b4714eb67c05ade5d16194456eb2f42d8b59a4822d8c
-
Filesize
1.3MB
MD56491912a8787bb0ad2e1af426457d6eb
SHA100e844f40dab80ed25a95792acb63dfbe65b9298
SHA256074d2ebd1a784da5691759913aceb7d8c3eed71b5c524e6cc0733dbea8eea0a6
SHA5120c07cda3ed7262ac04855122b5cd808be9d8d64230e27702155c45d2fbf2a9635a349add6d5362720b134d989f3472941e7e92a44732c0ddd1b36880f32998fe
-
Filesize
1.4MB
MD5f9eea313d689bbae765830b0ef1df481
SHA1f15fbf3c5af06f6343d037e47ac23b355543b588
SHA2563cb6aa919091e62c3016e6cf370aef7c1375aa84eaa1d968a62474741128ca90
SHA51284e65f978911d12dc2ef1b079a40866d8b8bd0a1ed46f2cea4aa543661e8452a19bc15af0f9616c5e5edb46e59a5416608e3099af55890c319b2a69dd7d8f4c4
-
Filesize
1.8MB
MD5a2967c16b19781c1fc8dd6df8d1256a5
SHA1e0d4fda1feb22958f1f257f5f5cad421bc503310
SHA2565fbc9ae91ed4336eade0290a6ea4ec6ee187b3385639a79f51bcf1695878248d
SHA5125dac8d328d87062f0ae70b3f4bce261db1ec721114a90eb61df7a0b6dfc77598c2cec7ec5f811c07f068cc126ed76cbd8cdb161a9f560dbf4d7581e28a449e3b
-
Filesize
1.4MB
MD592895b40b1f70a0c16bb7f9866d23190
SHA148a802e6b80c40decc5f7c4e698f7cfcf5a27f0d
SHA256aef8b2846256cb4a8f2bde75fb8166eec53980160dd879a98d65747409fcba23
SHA51222b684a63c31c6fd2d5f6fd0c761b67f9f3e7fcdd35b07e825b09c75046f9c0d48dbb36174f046b5744308664d6630c1f5fd5d77a77f5b2c13cc71dad06c1550
-
Filesize
1.5MB
MD5304a4483d218646bba4261f5f97c078f
SHA105b227ce7fdec7a3f3490abce8464c06ffc07445
SHA2565f0e7c8aeb861895803d14fa7f33367f387ff26149d2c83871f66cde991bffc3
SHA51285e0cd84acb7e9d75c89b36cdd0413cf0b7910d1a9f4ce5e07922c29a11a5374aa4b8842f40a3ef71ac0ddcdd5c8235ce3e04bc8e60c8a0a1183d9b47edd41de
-
Filesize
2.0MB
MD5592d05adfd835528fe3d33243cfc3a13
SHA1f0b1cbffefe62dfafd8a329cfc2d676a9d8e3223
SHA256277f51080b7009c6129191f05de5462b8828f52e462314c0c384f8df94db6e06
SHA512396ef1b5160b3ec3457d55674cc9d00daeeb22bd8be7a71b8c678ba562aaac77686c4d1d45e12649ed66f3ed85ee677e1fa322d428dd53bfddcb49e55ff5f52b
-
Filesize
1.3MB
MD5e53d7d5be122445251371a5d7c1ad547
SHA1be4c46f6e3ba14f7a13336ab7d951580fc4ad3c8
SHA2567c84f3527aac09d7fd19b44050aece6881b3c86f414580bd558a5bd2bf9dccba
SHA512f816902aa97d4c38c8dc188bf2432bb3354eb00a52fee859b4340d600e1fdb54fb712fe89e5ed56de83300ded573665d0e55b544f34b4fed802659d2090d1566
-
Filesize
1.4MB
MD5316201a11debb1d5e0d308229a5aa8d8
SHA1c7d94e3fbce39fde6cd259401f9a9d670b40c7b4
SHA256c172eef05ba38f2fc9541af974031ac9bfb6ca25177beed0d1006d8f322f4f2e
SHA5128bb213c4e0945200107f82be5af974d00dbf5c6cc7be18f645842188aa23b00179c62a5575d773ac27c24fd2a2cb43bdd56a07602ca7007356794a9a9a11dd4d
-
Filesize
1.2MB
MD5a326277b6202f2fb5a79e90faaf0542a
SHA15dac78daead0b0f554aabfdd9c6ef33a5f4e2bd2
SHA256db8f0eb48ba05601046585c23ffc75cc99790c9f78c68b489e7835781443fe46
SHA5124fe040448c81e6a57951422855405d9df5012f248d10ff7c3fdf800c113882928bb8e9129f4603a597b11e0b8b340d05479dc2e3812df43f35ae84a326bce516
-
Filesize
1.3MB
MD5cccc873a5d6b3a11ee2f4d0f3034b273
SHA185206494f7e02b3ec1fcb89740ed87520e99609f
SHA256ed26a14027e949da63572cc85e7f249894a78a5ba64c0fbb7332595513296803
SHA512e9e65e317309ec51a599a426a2abdcef349eedee92c1c979ead6735fbc83e7271b9b4d45e9621d42cde3006bf41ad278a3e7d3bf8b137490d0513e94c3497e94
-
Filesize
1.4MB
MD5d4c3fb3bc36287d82d321e03f8d585ab
SHA1f5696ca4b4f4e2943588b26cef1cee78c548c6ff
SHA256dd9153ec424144c7e2f119c54753f6dc76a778e2becfbcf6601f9665d250b081
SHA512a86cdfb3c71c36c0b4287a2cc3c8fe55613b61933c63683f8eb4b7114c8c1c8b87dfc9817367d167b99b1063ad15e356e25f08140756412c36970622a9bfaa8d
-
Filesize
2.1MB
MD5647ff72584e7a9fdbaca49fce75fe6f3
SHA16f9db868071475f76e7c152e6f6bfb81dd56acb6
SHA256c93531a47904a58f1c14f52bdf4d2bb9b56e54c4f59b145bc67782907a8505ed
SHA51206a37eb7d433a5432f42c184bc0152144f574532befaffd66bd9a6ca277487eb32ddd49cb3acef49712b20863c6e1573ebfe143afbd0f57b3840ab083f3e2deb
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
40KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.3MB
-
Filesize
1.3MB