Analysis
-
max time kernel
167s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
05-05-2023 20:55
General
-
Target
PurchaseOrder202319876.exe
-
Size
1.5MB
-
MD5
a838a2013c038b3a5039cb9abb199922
-
SHA1
6a315d36c940cd95359cd4ef46c5688352a22a42
-
SHA256
d4f62b8520f3f0e84b19769be0f7bcdc20e41af8cea048261f3e37c0428b22d7
-
SHA512
8b80c742b598d0df74e5d7b57e5ceb386d74531572a41b02614651ef9f914367e00ef23c12548f9009500af8ca9d6085406d417fc405f6ca528222a77ea83cbe
-
SSDEEP
24576:Bq3UElwshsKgvyH1kz7iQ2Py9so+4XfbqQtTpSrwCDCSD85vvOn2rRAJdqfcd7AH:Q3UElf6Lk1y7iSFd5BvWn2WJdyk8P
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 38 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PurchaseOrder202319876.exe"C:\Users\Admin\AppData\Local\Temp\PurchaseOrder202319876.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PurchaseOrder202319876.exe"C:\Users\Admin\AppData\Local\Temp\PurchaseOrder202319876.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5af70ad8517db58a635d96498ee6be939
SHA16d20940f1b205ab62e78f66eaeaf66a6cbc43724
SHA256a9ea5735f3f3989eb7a1c3daa7c5f994e3a0898d8d2e70a3d2a859a57c175440
SHA51299ef51afccee6c8086b7258933b6b016037bf928174086e2c9b289da83fae5a1165d8a03686ad97bea5bc3538fda28b6931b37ab3767ccf93ddda77fcce58a1f
-
Filesize
1.4MB
MD5fa4debc8640b01debcd76c9571da0f6a
SHA1cadcaec0ea2418f8e3cf487fdafccd4860233312
SHA2561e10cbf5ba59869e9232331ff0ce45b8af8bceb5aab1e0cce19b0f91d38091fe
SHA51290e6953dbb0675d98d37d1032d894db144ee140ad7a2c68dc390ef970df11a978884232a0ba37aa1e7dd368a1b5865beb4abf4f5b189e25f043f96e6e92c358d
-
Filesize
1.5MB
MD5c64f81a7167e720ead6758b9087a3d3f
SHA1edf884a69495ade08e11140224c5d66e7f3ff1b8
SHA256a39cd850cfa082824ff4771fdaee2a31c9b734e2942d6e021648a9f87b62d8ff
SHA5123b53f3c2faf80840566acf3a5fc4211e2398b2de93b9d564867c5abd9f5c2ece2fcd3e8f781435d06d4b30fb5bc84cb5580b2a71b5b2513924af3e7d923e2b93
-
Filesize
2.1MB
MD5285841abf90491f00912250d26df1593
SHA1ac66749c579e3bf79edd21b8d065e649e66c544a
SHA2566991cac22a2e99ad6f57651ec07796250205f0fab2809e16044ef933e0c9f065
SHA512381ba56822c146ae90db38508c2ce1da78d5196dc6c9828b520b8f106991546e377e49c2f7d3fc3c1e5f307301ac6e9d9338d8231e53cbe070bbdcf04eeaa4a9
-
Filesize
1.2MB
MD56f8ba0d78e8d01e2396d63f1739e8591
SHA1e1f19fdcb799d3d902d6ccac63c6dae2216059d1
SHA2569684d645b0075fdc057d8e777656f372a4b49a0bfc6d0cfea640e420b7f80294
SHA5123f851e3e37a97f1d3016940ede2e8ad2a61112121dee3f52c2e12c4daeec3cfc7f794829d1220015bc70ccb76d4c74469b4de79806a4ff1d6e46576e46422406
-
Filesize
1.7MB
MD5d0311cb4c6907b68319df25ca5abac30
SHA19466d0dc9748dc1ec49d2c898e8191e5e3b85abf
SHA2563e9278619f34161521239ba925bb3dd30a12ce7e8624b8e07559404b276e6973
SHA5121c89c255a8d7f40a51039395086c8bd0b8601ba3b39145c65c2b73ddbd35051fc7d830e2577d8ab9749991cc86e1ad9909c16cad247d15ffd837aab36a6db767
-
Filesize
1.3MB
MD55e33b577393845cd5f25783232862c65
SHA1c9db07315063c99ef78d832d41adaedc0f1ef0e8
SHA25690faf4ed01d33aebef9c0362e50b22106c8748ba721e7bfb2e36dc899ffec379
SHA512ebfce0f92e232ef5e29744825276d345b0398d6ffbd00274d523d5879fa82a462297f2a3a8462e48a7a7c1296f9494c62a3373994d0f95cf010cf364c92cc61c
-
Filesize
1.2MB
MD52a583cbd0e9d9c6e76f0a4f04487f5e0
SHA1c605e25700e4bb95ee137a1b5eb367c182fd307c
SHA2567ddfa0fd95b77236c12773ac90dd978157050075318f9cdafc4d0fb62362f23b
SHA512fc5f400fc0bed59d831e8f30933c2710872854a96b849956d6deaccf1d575ab1b93a0dda002870c2bdb026b4d1c020cba55f03f5e5f3e5182a20708f38a5fa39
-
Filesize
1.2MB
MD53bb12b7e63daaf2bc1ea6537ff855f23
SHA1491e7dd5d7f703abc023b941121a252694f5c854
SHA256ad71bd4ea6da0e6b83f3766722148f77e82889e099c5104b0c8e59e88a636670
SHA512eebf694c2816c5b7a739d0a5dc950d9c6633da1655cde32bd1694e600a8708da432a6bd7b9d9b3bc9cdae09318c190bd2feb747456bd3ca4c3ce86072b64660f
-
Filesize
1.6MB
MD5e6d97818c6dd0daf5ed0c46342ae123e
SHA16bd2485bc34354cca1c1d9d395fe265752364517
SHA256421fdcc32626cbc847d9fcabd5c20d5f2cd8faf164149db0438ce5631df639aa
SHA5128639a40a8c06550fe66e5310e09a92b0519aa85f28af8bdcff60300dced5d367b89a4a079b36462959d5b76577ca098901bbcd77a04057e2e80148431165107b
-
Filesize
1.6MB
MD5e6d97818c6dd0daf5ed0c46342ae123e
SHA16bd2485bc34354cca1c1d9d395fe265752364517
SHA256421fdcc32626cbc847d9fcabd5c20d5f2cd8faf164149db0438ce5631df639aa
SHA5128639a40a8c06550fe66e5310e09a92b0519aa85f28af8bdcff60300dced5d367b89a4a079b36462959d5b76577ca098901bbcd77a04057e2e80148431165107b
-
Filesize
1.3MB
MD55bb0beb8ab4896622e6948b5b32ba1e1
SHA1cb397868b1911d7334d7db09ae504d2b5d964a63
SHA25617142b2e75b55200afc3e07a801a22164b3bc49e69c3ee30274d1baf27d35832
SHA51263398cb6f991483e74b4e356af8f0bcd2810c35f1f27c3cee1d9a7055017ab01ec8e9b4b68e09cfe44b20100a6d0ad3d3ebd665f72674b0c82bd10a651647cb5
-
Filesize
1.4MB
MD5f789c9001d67d09ec2bcb75e8fadf503
SHA17878167253883e1cef83cf60700a59188b9f3092
SHA25664a092e29a03847c8abcabf9f57729c083a87ad3f3e4c9155764b7dc5ffa3dd1
SHA51261c2cfb1e8019aed7146179af3376a4810f3caa63addd1cde217d96a390b81d12ed5439f761bb418a4b3094d11ede8cbf045e1d466ba3da6eec86eb195504ba4
-
Filesize
1.8MB
MD5c3b61ff8efa9e30f773c1c2f00c50174
SHA1ba5b35921de2bdf2168db5e07149eb3a4eb8aaf6
SHA2567aeffb502e2c47c93e69297738a7b31d11754589ed9a4b14b7169e40b3ebe4f3
SHA512bd3fd4006f8c0f364bfeabfbd9076683400464008c8483ccfd40ce671eef8fb628834e62de3ad9aed96d6e5732ebdfa323dcfe4ee61d1053aa904bb432c9b310
-
Filesize
1.4MB
MD5b88aa4600d56bccdb64386036cacb927
SHA1ab938f5094a277ed4f44179e4cb422b6e5a2b155
SHA256b5f5d2d14b645c30cd92b67416efb6f68cb6f336f0ce8ff15d00816d17b06fc3
SHA512ae781355860e3154cd2b253701a285a8bd711918be064cd55881476685d5f00109d013a1bed04a7e0691af1c4adac98188bac3dfa6b0c4bbf98370b8ecb19875
-
Filesize
1.5MB
MD5363ba3f32913b8aa485bc906f5090275
SHA17d3a55be236aef7ae80a839a846b1ac8a1a92d38
SHA256b8be65cbdc61cb9ee23e7c537151dc54a7d03c5bf8dfcc18ec566e42f853da1d
SHA5120f4eaa6d35b3362da4ce21bb21d43b29162d4784046b03d9cc3446ea70821729888c0f6106b3109e5f28019bf9779c2229046f519ce4317ec79c3dff5bef53a8
-
Filesize
2.0MB
MD52995c5442ffb7b0ca516b313d8e40f7d
SHA1a220786b394463771d576a1fce3c38a2c19d10d1
SHA256ab889317dffce21724916231ff3d0ce672022b495b4b265b1a5852fe8c619053
SHA5129f434d5cf757150b05fc507ca9da82ddf49189eeabe43c314b2f106e155fd796bf08a6061bb80b3315a05db351d4fe84fb897d5cd875177a74e0dbc68b7f8297
-
Filesize
1.3MB
MD5de10de836da2cb409fc37bfdac022bcd
SHA168bbf5b6d447f2127b2ed5e2b3b888411d121d85
SHA25641eec6ee9d7d00e24187113422288eca1780ccaf9cce8279cca089716770ac0a
SHA5124f45a2fb0191ccab2f14aae6433fddb877981dcf18199393d807902929d4039813fa6be6b7e5425f9265c0473d79ae682064d57790f07be92638900bb90966cf
-
Filesize
1.4MB
MD54b7bcfb4997771c1971eb0761f6863f8
SHA14f820f128823d6252840f951fb045a2c657a21df
SHA2560f6fcbb96b206a20f7b2d1fb02dd0db09ed3cfc25c5f9ba5fc615f538a12a6db
SHA5129c53fbac111b43ef7ae966a71ed7056bb51b0549e512e6b380527b502631db604e1f0e01f98c8eb0b858f3dba9c96611cbfb4d9d35564d7e929ee4075ade281c
-
Filesize
1.2MB
MD598744cb50511558b737e33ba515969f9
SHA1dbad43e424926ecddf666ec676c980d4beb9ac97
SHA256cf6dbfac05a7e6d49e8fec862542bf99c0dc133d9e5824b7ba334b282288319c
SHA51201fd3f107f741131d9255cb8cef7b40a4ab14f6e4194654794d04370a53c69f7cac0e27d36276cbb8da8697c8c3a5d76a92add53268761d4ded3d738b8cd9772
-
Filesize
1.3MB
MD5c0c72779cfe7ea57561df72497ff6389
SHA1ca1de6b2e90f30da838cee1f8b310b4089e56426
SHA2562744d627167f6d5ddf68b1e38110f4403112413f5b0b4234538102bc5d4a7c93
SHA512dff20648d4263037f0d5997f5202fef997a9bb48ee0ec238220d41abc328c120974cffd7b66eb3632d5b0a9c838f4b1f959ffee8b48083881c79bc94cad418e2
-
Filesize
1.4MB
MD5f23d2d3a5dd8231f3e49d3a80d48bb46
SHA106a71a806363eb08fc8b3052f0bd6a12fc026048
SHA2567975222bd3d9b29083a40c464c3e028c2752a8cb27d01f5022bd14fa3dabf56f
SHA5127154a339e509e85f69cdaff81b416e7256451daefecc292696a1bd3091836a6ece0355bf1ac86497d8c2c8cdca9d68c64a0ef85bb5323c68192a7f4eef06e7b8
-
Filesize
2.1MB
MD5289ebe7062c246bb010674c15968d0fc
SHA17ed7c6f5bf161f118d8ecf6276a39edf3ffa20cd
SHA256ad4fa6472fc7b8afaaa9f40f78d3d28e3478c88107c1c4383222481551f6f5a3
SHA512cdc139330986061717d414dad1c0e030c85d9aa4585a8b0107f7b42db83e808627d34ce5a6301bd789b49f6e29f51354447a427e1a3d724308e684f3602ba0e9
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.9MB
-
Filesize
1.8MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.9MB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.9MB