blustealer | 90382d070f58dd0a9f21d05327c2589116e2271e2cce2cce69018e1f4d836c0f

General

Target

Quote 1345 rev.3.exe
Size

1.5MB
MD5

e2b30c0c90faeeb878ed21be152d2dc1
SHA1

b64e8bbd7d23f9585a7ff9b24a61a7ab119f1769
SHA256

90382d070f58dd0a9f21d05327c2589116e2271e2cce2cce69018e1f4d836c0f
SHA512

7126633aeaeaa91f08d5c0dce6129bfb7501287cad6ac106f1c64c2ab0cb010d3b870680047ea3e9dffdb3bfccab2a9d2a11f8057dd302dfaf140b34022bd74f
SSDEEP

24576:PnQ3GQdfKrh2G8uraReOgX1yFQ+5irxTCQJ5xvCwUXZMnKfJIxzN5b2K:P9QdIuWed+sKK+CQ5CwMZMnx0

Score

10^/10

blustealer stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Executes dropped EXE 2 IoCs

pid	Process
464	Process not Found
340	alg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	Quote 1345 rev.3.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\360b1073826a969e.bin	alg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 780 set thread context of 292	780	Quote 1345 rev.3.exe	27

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Quote 1345 rev.3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	292	Quote 1345 rev.3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
292	Quote 1345 rev.3.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 292	780	Quote 1345 rev.3.exe	27
PID 780 wrote to memory of 292	780	Quote 1345 rev.3.exe	27
PID 780 wrote to memory of 292	780	Quote 1345 rev.3.exe	27
PID 780 wrote to memory of 292	780	Quote 1345 rev.3.exe	27
PID 780 wrote to memory of 292	780	Quote 1345 rev.3.exe	27
PID 780 wrote to memory of 292	780	Quote 1345 rev.3.exe	27
PID 780 wrote to memory of 292	780	Quote 1345 rev.3.exe	27
PID 780 wrote to memory of 292	780	Quote 1345 rev.3.exe	27
PID 780 wrote to memory of 292	780	Quote 1345 rev.3.exe	27

C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
"C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:780
- C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
  "C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:292
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    PID:1720

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
d633342eb3745e29f7cc936fdb830bce

SHA1
68b04cc397f147b01c00a8b9cf435e55b5252b33

SHA256
4c1c14a8535ab8e57ff3abe8c1e8fd535445f3ea5da17d0e0d8d8b8acdbbe603

SHA512
2ce4a459acc3d1c410b1db662a7a8a8826f98540a640d89c13e58089f8611cc8e7f940fbf0494e7ae460b50cdb4a19620384f121dd1c555dba843f05080ab98a

Download Submit
\Windows\System32\alg.exe

Filesize
1.3MB

MD5
d633342eb3745e29f7cc936fdb830bce

SHA1
68b04cc397f147b01c00a8b9cf435e55b5252b33

SHA256
4c1c14a8535ab8e57ff3abe8c1e8fd535445f3ea5da17d0e0d8d8b8acdbbe603

SHA512
2ce4a459acc3d1c410b1db662a7a8a8826f98540a640d89c13e58089f8611cc8e7f940fbf0494e7ae460b50cdb4a19620384f121dd1c555dba843f05080ab98a

Download Submit
memory/292-79-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/292-66-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/292-81-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/292-74-0x00000000000F0000-0x0000000000156000-memory.dmp

Filesize
408KB

Download
memory/292-69-0x00000000000F0000-0x0000000000156000-memory.dmp

Filesize
408KB

Download
memory/292-61-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/292-62-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/292-63-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/292-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/292-68-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/340-85-0x00000000008F0000-0x0000000000950000-memory.dmp

Filesize
384KB

Download
memory/340-84-0x0000000100000000-0x00000001001FB000-memory.dmp

Filesize
2.0MB

Download
memory/340-91-0x00000000008F0000-0x0000000000950000-memory.dmp

Filesize
384KB

Download
memory/780-57-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download
memory/780-60-0x000000000B710000-0x000000000B8D0000-memory.dmp

Filesize
1.8MB

Download
memory/780-59-0x00000000060C0000-0x0000000006208000-memory.dmp

Filesize
1.3MB

Download
memory/780-54-0x0000000001110000-0x0000000001294000-memory.dmp

Filesize
1.5MB

Download
memory/780-58-0x0000000000950000-0x000000000095C000-memory.dmp

Filesize
48KB

Download
memory/780-56-0x0000000000930000-0x0000000000940000-memory.dmp

Filesize
64KB

Download
memory/780-55-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing