Analysis

  • max time kernel
    116s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-05-2023 18:53

General

  • Target

    268-63-0x0000000000400000-0x0000000000654000-memory.exe

  • Size

    2.3MB

  • MD5

    92123683d5c88a2dca302f9159cf3234

  • SHA1

    4c54d4ebc4c625b7190f6fdb5e3d81ede07d9b4b

  • SHA256

    33b998a00933794947cb36f660568b6b5e44327e9d2c1680f17c11a767a1005e

  • SHA512

    5c34c30761ae2378c342fb15ce065c5c8937e398ade9a18edfdfc7463fdd8f9c6eef383f1615a09448f105bf304e6bd39569ab5e499d9cf49dc8e8b117ec4f6b

  • SSDEEP

    12288:FWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:qxgsRftD0C2nKG

Score
10/10

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\268-63-0x0000000000400000-0x0000000000654000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\268-63-0x0000000000400000-0x0000000000654000-memory.exe"
    1⤵
      PID:1996
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 408
        2⤵
        • Program crash
        PID:1240
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1996 -ip 1996
      1⤵
        PID:1728

      Network

      • flag-us
        DNS
        254.33.24.67.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        254.33.24.67.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        154.239.44.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        154.239.44.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        142.145.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        142.145.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        254.23.238.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        254.23.238.8.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        132.17.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        132.17.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        104.219.191.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        104.219.191.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        45.8.109.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        45.8.109.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        26.165.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.165.165.52.in-addr.arpa
        IN PTR
        Response
      • 67.24.33.254:80
        260 B
        5
      • 40.125.122.176:443
        260 B
        5
      • 20.42.72.131:443
        322 B
        7
      • 8.238.21.126:80
        322 B
        7
      • 173.223.113.164:443
        322 B
        7
      • 40.125.122.176:443
        260 B
        5
      • 131.253.33.203:80
        322 B
        7
      • 173.223.113.131:80
        322 B
        7
      • 131.253.33.203:80
        322 B
        7
      • 40.125.122.176:443
        260 B
        5
      • 67.24.33.254:80
        322 B
        7
      • 40.125.122.176:443
        260 B
        5
      • 8.8.8.8:53
        254.33.24.67.in-addr.arpa
        dns
        71 B
        125 B
        1
        1

        DNS Request

        254.33.24.67.in-addr.arpa

      • 8.8.8.8:53
        154.239.44.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        154.239.44.20.in-addr.arpa

      • 8.8.8.8:53
        142.145.190.20.in-addr.arpa
        dns
        73 B
        159 B
        1
        1

        DNS Request

        142.145.190.20.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        254.23.238.8.in-addr.arpa
        dns
        71 B
        125 B
        1
        1

        DNS Request

        254.23.238.8.in-addr.arpa

      • 8.8.8.8:53
        132.17.126.40.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        132.17.126.40.in-addr.arpa

      • 8.8.8.8:53
        104.219.191.52.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        104.219.191.52.in-addr.arpa

      • 8.8.8.8:53
        45.8.109.52.in-addr.arpa
        dns
        70 B
        144 B
        1
        1

        DNS Request

        45.8.109.52.in-addr.arpa

      • 8.8.8.8:53
        18.31.95.13.in-addr.arpa
        dns
        70 B
        144 B
        1
        1

        DNS Request

        18.31.95.13.in-addr.arpa

      • 8.8.8.8:53
        50.23.12.20.in-addr.arpa
        dns
        70 B
        156 B
        1
        1

        DNS Request

        50.23.12.20.in-addr.arpa

      • 8.8.8.8:53
        26.165.165.52.in-addr.arpa
        dns
        72 B
        146 B
        1
        1

        DNS Request

        26.165.165.52.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1996-133-0x0000000000400000-0x0000000000654000-memory.dmp

        Filesize

        2.3MB

      • memory/1996-134-0x0000000000400000-0x0000000000654000-memory.dmp

        Filesize

        2.3MB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.