Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
05-05-2023 20:16
General
-
Target
dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205.exe
-
Size
1.6MB
-
MD5
e90e41677f6030ffc3eac62929ced1d9
-
SHA1
edb0a2acdec33328a864ac178bfb0b42a2e0d444
-
SHA256
dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205
-
SHA512
a2e20c8b160c366baed60adca173587e5c3b94b811f4f52ac3aaab01a0301716e30cc7c7d2a426ee32a6df651021717e4fe097073610860a949e7933468e10fa
-
SSDEEP
24576:KRKQxWUF61/J27K4mgZB67gTsD6RROjiDefziWX2GDjGBXtnZYx:K4QcUFO34mg367gTOwMMohjw9Z+
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 15 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 38 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205.exe"C:\Users\Admin\AppData\Local\Temp\dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205.exe"C:\Users\Admin\AppData\Local\Temp\dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5b9abdf8c6c91ad1573d15f337d319fa9
SHA1b30c104926ef03133778a2880b907910fb80a83d
SHA2566e44118d67ae58a710380de3063a7c311851fd177f436909a7451525f060943a
SHA512f3759c553a32e0174c6b8c5415c2aedef84bbdf2ed81279055af8d2c87078c1c0be90bd56457879de6420a9a9608fd32a164add7b6ae2612ab871d6c009396be
-
Filesize
1.4MB
MD5a15903e5a41650aef370bf16061f3d13
SHA1ac65a9dc15684c20b33c6120defa888b93487020
SHA256788125ca817c3f8a23a6e1a4c2de0df3e8fee6021912ae3ce9c8085f1ef73971
SHA5125b69e8abd700182a6a7576d30d22a2fa649247dce3d32e2304986025bb5e7bef0364e50dd79fdfd4acc1edc8072ad95859db137bd812a105f314a3f0db62377e
-
Filesize
1.5MB
MD506d19ab10beda359839c5f1f480c28c1
SHA1fd54d189602c6149ad0fca64ad28ff39a19f44dd
SHA256cc6e1e62ec8175f8f2f477f1a9a523ea4de1e637b5cd68e4a3a2c72247658a86
SHA512e26879592bf95b052eaf21fe73dcef3536b877bfdff88654b9fb47657f120be181716a1b5e6795a6dc62447d55a557482e524506480ed374ee4ac28fa1c2ad28
-
Filesize
2.1MB
MD58cb85cee2e7cacfffa65d1ebddc028f6
SHA1c789edbc70170d067e968efccdec3f7985cf6371
SHA25689e7d8584daa2c336305e3ae5369c3db12a323122a1e3fb3306709bc5133c3f7
SHA5123833e26587a5c7794238028c95948df0c2136ffb043fbe7df16642aa3bc35ec7fb1417fcfd7c4dce7c7f5dadb226a588c643760f0deaa506b894d3db8af0eeb4
-
Filesize
1.2MB
MD5dc1ecbcf21acae019f9f9eca1d72aa30
SHA19a026b8ca8c8842d0f23cd81ce79284b69e15501
SHA25635886f2f5376ee073308e9720440d7a515274111377ef5d14c1643fd20ca78ce
SHA5125ba4ea58b65cdef868875d6f5e3536dc3dde3c8729cbdb68e6a397be0cdfb6005515137eb668d34399d708f520dae9089ba24fba0fc81672460adf5719093a4f
-
Filesize
1.7MB
MD53d810c213c7168b3c5cec2b91f38ea34
SHA1b47f1d9f8a2f809219685659adfb2f45e07abfa1
SHA25635498179e4816b4f9e61c378d751f39520c32dbc9c0fe25a248f8bf5437b17c9
SHA512a3ad5a10483301a8e26e3b97a20a77290b8822102d7c84d9167403ef6252ab1c1ce8d409550ffcd92a31b5e48b5e027f11ef0f91921d57a7dcf79d67ff468bab
-
Filesize
1.3MB
MD5ce6905dab96c71ab1381dbc86a912530
SHA162fff038bd6f43cd15c0acc4d0b4a191cd7b669f
SHA256fdffde4cbae0ee436baa168e168881405dfc6a8214437720226f6f34e7cf9c56
SHA512bd28d7823a0ba995aa1070d0204db019da8f676f8fb1a84bf8f10620af001ad103ce394ea9ce832955347675b18ea92d6e45da8d6dba0ddde74caf37e5963b95
-
Filesize
1.2MB
MD5fd10e451d868f6f9b22f1a17bedc6106
SHA180024fac410d941f47138f3581ca066453844b8a
SHA25606d8745edc28bb0e4b1b3b08992cf11120c0eddd355829d978318d7bb50b8f92
SHA5127efd4d48f523de0a6483856af690882dd91e196036239c182034855a6076fe75f6fe2c230e46cfa0ad31cb0cf5d77ef03a70a9da347c1b9601b63fc23c27f2ec
-
Filesize
1.2MB
MD52faf285e17ddf5d529995f826cbd368b
SHA1c99ad0244d895d5bae861691489aa28a906340ed
SHA25673b966d3c1151fffec058fa7d30b88769cd65ded570619c7915a97ae9c061086
SHA5126ed975fe2590fca599c8b701c2e202227454901fc0d1792da9321d507ed8fe88be76644c01186e4c9998ce491fb4986de4dec478455f7e79968e4ed8aafceb07
-
Filesize
1.6MB
MD5859062bf1fa348178bd77038b800c20e
SHA1d318cc8e2d868dd5e11a03947605422fcfde0638
SHA25628c7f6e2d33dd26cc69cec4dec459c6d03dd38041557849fe073927eab6141e9
SHA5129372e43a2aa4b7f077aae565df76640141888d2b7acbb537d218ece1a63d19f54af3cd12ddab1e572b1d8878b0236448efccce40a06f24836ba4c6fa1ba9bfc0
-
Filesize
1.6MB
MD5859062bf1fa348178bd77038b800c20e
SHA1d318cc8e2d868dd5e11a03947605422fcfde0638
SHA25628c7f6e2d33dd26cc69cec4dec459c6d03dd38041557849fe073927eab6141e9
SHA5129372e43a2aa4b7f077aae565df76640141888d2b7acbb537d218ece1a63d19f54af3cd12ddab1e572b1d8878b0236448efccce40a06f24836ba4c6fa1ba9bfc0
-
Filesize
1.3MB
MD50561c5ac2447e22a0027e79006738ba1
SHA140c2db9918a6752cee176d252b886f21ec17f712
SHA2569c1d5c21d4c87f7c80c70e4d4089d41e08274e3fd2d485f857bba0fe09a8ee1a
SHA512d1cfdecf9112cc66a767d7e55b264979e64db0f99a6a1710ab89c6da737810ac4bd935de87ea04ef826e2e1b16593d52bed949717920b0fb64a2d5e4587c1761
-
Filesize
1.4MB
MD5a0d2834b07d13cbc4a685ecc190e6e7a
SHA1bf275f1686ba1d458743e7ca5980991860441e48
SHA256ecc4f14126b7425385161ce6c4afac4f6bbdc757480d9e44af2d95e724381694
SHA512195a4a79ef3e771cadf015c671dd5c596015ea9d0e84e1056e9dea7a4326be8117b886f01d9f98a10d21be60df911809bfb8bd1a87ddfb71f9261100b3c97d7b
-
Filesize
1.8MB
MD52540a4b46afde009307bcbe9a757583b
SHA166d006497b38a85fd648067bc5ea49de4a7a1762
SHA2567cb2dbe989b101f452066ac1bb4c875599c9b3f1a32a780906f0007e4dde42e0
SHA512849383eb95d3121931237b36665e24b8cb3b190198d174dc594f2c54870826283e9180934bcf5368e5bad38763314dc2278615a97dfbb851d652f25216874459
-
Filesize
1.4MB
MD5f9b8ce0c10e7b811bf48e8aa4627ccd7
SHA145b7eb83878fc2f050b11455f30fcf5c95d73c66
SHA256299f5eb1c2751e906314cadc9c83cbadd3f0889c43fc525bfe8f324fdb5ce1b4
SHA5122ce88270d18e93d6d6add977596899f5944a75245fabf07fc98c9b1f6765ad2b83acb5fa30652251985a7d5da1cb4791dd87855384dc004f7ba8807e7587f7d6
-
Filesize
1.5MB
MD56194b0c92d6204233f4d60c29056d3c2
SHA14d13a7b04fedd97e96b2c90071418c6b3e3e1b44
SHA25671a6e42af599fed9c5ff52b8ad5b399b7cfefc18392f481115f1258546d302af
SHA512c9b8a314c0f9f79d9730fa523fe81fd5da8d89d7c832c169b7259de4662baeb237fe07e918b5543eb31ccc4f21ee83df6b75c1cca22f7d9fd0a32fd7b21a9eea
-
Filesize
2.0MB
MD5548f96b2064d01061daf748b3257a2ec
SHA185d6bda4203bb27c65bd15c97e355c424e6c8aa9
SHA256dbde3115c08691a2e594a3d639bf20d94149cd0b9eca61c51892aa5f633a166c
SHA51262a664fcadcec523ad8dfd76cea03040ece0d2666dd409131ee703b05fd1c3f091a79ca7dc103648f9ad41373fa9d1b12d365dadf3a4aaa1e16c39f8ee4f5b45
-
Filesize
1.3MB
MD5bf1592f69bafa0dae5a625a17077b7c4
SHA107ebc3b5a531fd74e64fe512f0e44c361c0d1ba6
SHA25663ca586a6c35ea61f11c909c2608123664da6ad5b9986f0a7f47346cf0f887bf
SHA5128af352d652b69aff96efce33e2eb4fc70d5077f28bde5448b1b5a67758e61ecb37808ae8092c8aaf263ebe97d5f4ebf027d9d6d174a790ed48eac838bf184791
-
Filesize
1.4MB
MD59ddb08921e349f8a727175c1c2f6954c
SHA1bad88869bd3b378dfef68366c8f7c9c95335301c
SHA256be3b6d1318619b5691702eea025184b63af6cd6056d2c93a820c91e19b0597c6
SHA5125df802983fe695a4ad7f3886da668f3bf7af572f71932c3840b34817eeb920ddb1b15b3edc6afcdf9c8f2ac30f58a5b12a22dcc38dcc5b0cc8cef86c68e7e96e
-
Filesize
1.2MB
MD52725a909d099e8b58f6ce23da568544a
SHA1cf9dd472e1ec4c5809a70d0603df1c61125226b0
SHA256fa80a38418c0f57dd04b2bf235c426a82a125807408a705ed0fef81c29219ce2
SHA5123140001dc10d86c2977eb574c36f22db70c305e44f09ab819f5edd1abc87b5a56b352f535d7cf4419745f6229e42491317956b165e7737bdd64e102ea4fac7f4
-
Filesize
1.3MB
MD54546d733a8ca0cab3f2aacf0e9b7cd30
SHA1305faf1d335d456c125d807362f5997eaa7c924c
SHA2563dfc485217e7868f659ebb94f020e37181541852ecffc475cddb06146688151c
SHA512c432a3de4a5b2aa0ac3d72fa5c31c06149955611c505458edf022b58f5049e11f346599168de0da99fd7e7acd1431e2ca69ed2ea1b0ee62717f4025cd4346e66
-
Filesize
1.4MB
MD5ed9b99da3de2220832a80b58dc924a4c
SHA1688d73f0a1918f5005861fcff1f8a426587ec3a9
SHA2565854f19e1f3a3a2cb106ec9f62e86fd67702d337c4349e3be9d822664a5e582d
SHA512d752f59260c6f9f3d9aec294cc9c2bcffe73c3cfea87d849d7fce200e2b6bd4138c3494b80c8589e17b5541f78b1527cff2bd2c60f87a5f7b943d19d85a28e4e
-
Filesize
2.1MB
MD5884fa33bfb37bfd1c279a51a79fc0c2a
SHA196a6561470b5410de7c01c28a26044208c5052c3
SHA25684f162d4d83a7c28ec560d781e44ea206489980531e4c4180e7ee7037ad9e1b2
SHA5124351385b7ca18253f734872f5e70087c2d633190c254b59b128b0be7e5d7f8fcebb1514dcfc475c3d2319e38bc1208de5eb5f8d048dfeccd67d3b3582465488a
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
5.6MB
-
Filesize
1.6MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
408KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB