Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
05-05-2023 20:57
General
-
Target
SecuriteInfo.com.Heur.24719.4239.exe
-
Size
1.6MB
-
MD5
170860057f4aad06ddbeea0ca2b3f1b6
-
SHA1
db04c735b769df458518f959ae7eca39cfa06213
-
SHA256
e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998
-
SHA512
f8bf57126bad026be2414121c798d5688119f06312404c35dea3f457deb717f6422291f5401178586fd23055577f893b4e6236e413c909e3b526c45d3b957766
-
SSDEEP
24576:uU7taDBzgNEfeEvFTMxdzYPh1ogay/zj1weNgcHFx5MpfTjU/c7jNXPohE:uU7PNBmMxdEvogdzxzHFx+pfTgE7VPI
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 37 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5c86fbbde9bb34e9ca2b92407795cacf4
SHA1cc54a23ac10df7f3d12e7b0abc594c8eb3d68164
SHA256cdb82c42c1edc71e7195c7ac3ebc288896454fcd007190a50f5e0124da3001ad
SHA5120d49ec107e46c61d8bbfe3f4ac9dcc135ae0168af007b1682b9abd44a7927a6e937ad5838444302625817b02320f04742d475ea12e515eb8c16f43eec19dcf5a
-
Filesize
1.4MB
MD5d4e432a9b644784b3f2e28beb5e80a0a
SHA1b40d1b57518a1b9c59881ba3a3af04690bdf7fa9
SHA2566883de1133af92117cb097f585dd531b50d4546c84795553976bae0c23e33c92
SHA5125fd07a1fdf9fe6ccba1ae676d6d0046a8e6d43d790142cba83baa19a0947d78f62fe698313eb0f416b03f0071d16b36a12fbf891015819b893303ac681e6f5c9
-
Filesize
1.5MB
MD5cc1301aeb13e0af7f2b5a8b749c72eba
SHA16353cbed816092ff52624ae921c571d0474dd8c2
SHA256d5b452e4150a3db4355f593b557a7c1d1063d915d3dd209398fd3b5f8524eb1b
SHA5121e060c8e3e3e9f53dcafc68574877e4d663564f9e33f429441caf2954c1a4f4a88548bf264cef224ada2d575e2a278635c054f68529cd9be1f9936ce6e112730
-
Filesize
2.1MB
MD562ecf69873affc5b22284812a65d9513
SHA167322d2ed5ee667602d42a8da03a85df52195585
SHA2564c197b7e0e11b8a7564122ad230adc19ede334456f755f968acf819209ac02b5
SHA51209b2f1821e18889cd2c3e1d6b26739f29c2bac0ff9ff4b06c94ba83ae81523dd3b3552cf8ba651e14733dc857a04d547d5be84108c4128739e9258e5106c6381
-
Filesize
1.2MB
MD5726a3f7cc42afb788d1b12352ee3e615
SHA1397bc0b5cbee086025b2a924e5b6fd0fa82715b9
SHA2563063f0a939a6a7b0c96c73d797b272f58dfe2b1d55a8b8742310ee5d039ea32a
SHA512a675b963739b9e8c8dc09ef4a1f6c3125cb1ccecb17af1fe8f55f654c2d7268134402b223ab392d85d1f982d520df15ef11cab4c783dc8022b3a13786d8fc791
-
Filesize
1.7MB
MD5c3b0311094e1f3baec897c50187e2d88
SHA13b607e45357de93926a35d64464f87d89e3c0243
SHA256ae3146fa9ac880275d2694a0229f1613deb3c84c54304a36abb8562a5781ef8a
SHA51233c266da6bb384a3944346fd6dcdff8ee2f07fe1c2392f6ccfcbacf03bb2f67946a35ff9f78ec1601454c9c893334f1e249c8a8edad6f3ef4e7e0e54872013df
-
Filesize
1.3MB
MD58b66225dc8eba81d39b8ca2aef38e476
SHA1b352e295bdfb8442209740231d6e8557b739a6ce
SHA2561c853052d554f0bc641c45ca4be988752fbe593f955b57cce7ed122997fbddb7
SHA5124acfd43c7d9649c17cdfe71a8ae05e5774d4a4d63dc666766e32d8cc65bd8080d46996d684f511d3f89ffb91eee2dd59518a24e1114b0bbe5d1cf2301a7d94bb
-
Filesize
1.2MB
MD561a3dd50c39d8acae5a69a4f88c53f66
SHA1a61673b429ad0d7e62a7cd2916c1a31adc2be183
SHA256ead55c2d37ee890d9fcd56b6e2d75436168e6c0b4d0ddc2517d75721f2464998
SHA5129d59ba74c21299a081c8142a05484c891a87bd33f96aa55cd6039391d87046ad9fcefc91969d21cf3f07d1762b8487a83c7894ebdb113fdf57034711cc082aef
-
Filesize
1.2MB
MD588780e869fb819dd8f9099c1d9535a49
SHA12f51c7acdae41bace29373840fa951cd7de2dfc2
SHA256b209331c0e9ff010e0043a6e1a51def4b7ae3466be1be8a8174568c275ec2024
SHA5125dc9c45727e0c1d40b80c3f25509f671fe88c86aa4d04677058e2c2706c6c3ddbe10ca0a4968fa1a4ae3b61f52be340b1946fabf0b8928dcbcbb85f5325ccae1
-
Filesize
1.6MB
MD556d9b600dea11997468c2c4c0b228477
SHA15ec37b617b7143e63f25e40054fac7af39d89503
SHA25630466f3976edca4e90490621573d33ca5993c3b116715890881d4f7e0658fd03
SHA5121f4270d6e4e10eb0465075d52d2876d835173091c8144c52338e338c25083685360b90fbe73ecffe1a26fe409544ca657e24777d8d81cac4c10cbd96d425ee9c
-
Filesize
1.6MB
MD556d9b600dea11997468c2c4c0b228477
SHA15ec37b617b7143e63f25e40054fac7af39d89503
SHA25630466f3976edca4e90490621573d33ca5993c3b116715890881d4f7e0658fd03
SHA5121f4270d6e4e10eb0465075d52d2876d835173091c8144c52338e338c25083685360b90fbe73ecffe1a26fe409544ca657e24777d8d81cac4c10cbd96d425ee9c
-
Filesize
1.3MB
MD586cce89dd7c5ba3c8a2645324116de89
SHA168841fc75765bb1cf6765d974ea498ddae51027b
SHA2566c76bed52e90abe0b29ffe67f599da29091d5fb397de3f44931781927b492c98
SHA512ca303daf14e1bb7c2a6bd3b877f290978a11609ff2a00085206502fdbde93a68a61d7a4313aedea472d7fd8e0e7ae3b5d3482cbf568f92646f7d8dc1274ad934
-
Filesize
1.4MB
MD5d172a6d301f868525e07801d4cc522f4
SHA17aa9850ab530caedb5bd1e58f7f8c433c39e8d0e
SHA25627704262f4ef2165b19387fc517e003654b5fd8d77d756ae8fca5a46c43c9a78
SHA512f4f59c0f27140cee696e530dd4d36fe5579765832e225b840db5814dd1632662a6fa6759ccc679e10a0055480f09f98c2e43deafbb8ad9507c0b63900703f0bc
-
Filesize
1.8MB
MD5c8381e4438df51828e02d3a92c0aaf96
SHA1a2dcc600fc848bf9185315e946e5cacb231133f9
SHA2568105be7c4eda5ffc5124e79e881706a43ff29b89b01b680095c0e5126a1dfc54
SHA512e89c3c955368cf3272a598ee207f5cd595b3e9aa899e525f728491205c5dc80999e949aed7cdec5ba6ef8fc94c7b19dbd8ad298a653d0ab53d081a29b975aaec
-
Filesize
1.4MB
MD55f7b2a55789fd9829e6e491608fdae16
SHA13ce706fc5749930c41f6bf2ac7cb368ccc0ec1e3
SHA2563e2baa415c60f343df04fcd610b7e74496d1f87bce7e1ec5cfedd0706b819626
SHA512bdd24d803bd05f941d1c405c0bb57b775b9544aa62d1923f1131a15038ffcca1810ef2c1f0ba0d073f6bea959efefbd1334151f465631b6628221fb1a4cad22a
-
Filesize
1.5MB
MD59d99054dc8df56cdad3f332e8a3d12e4
SHA1a20f0529e7fb189104638b782f38a0ddb6dd15ad
SHA2569fcb9d70dbd5d2f06d941e3c1976befbc60f65cb31539780952016932335811c
SHA512e35255132cae4b54b69f25ef1348965a6234e9c12d0feadb9822c3795003faa08e43f3c210b03d2e893a37cad90d196bc964c7961c7f604c79f7dd5aaf866c6e
-
Filesize
2.0MB
MD5b489d855fadfd7078aa0a87331711197
SHA10c6c5e0644b838e53bd0c648ba26d2f5872fe572
SHA2562dda217d21b2d8a7a794ff92a04dc0d676d610d4f2782889e4d6b9a16fae8646
SHA512caf97c93b73c451a4b828519b9ce0b5335c8a8ed74d30d43ae3d94cf657018747dc5ec9992b8bc4defe8531720f60ae86392b15a561b11ce7ab45bbccc9ccc5e
-
Filesize
1.3MB
MD559cb982e56661e6ab9c7d37ab699c00e
SHA1b552a591630f979db447e98cb8333ade7d80f0ef
SHA2566fc43057e617e83c892ff49735ece4eb711a9fc004c4d6ec173fae683a6521eb
SHA5121e3b76744be8b82f4f2d17676e79c09c864b4c81daefffbf36780381027bd006615b70a8bc09d2a503b49eae92a29d1de93a8b7131a89f94b8a2ba323e626349
-
Filesize
1.4MB
MD50831deaa89f159568f4a9e65da1f55cb
SHA1d18496862c695a52eec5ef6ed041b022ef823f8f
SHA256bd44ba4903cdb855c6f682ca45021afb54d10049f39f5baf47313a95b58ffe79
SHA5125aaa7a3193155e9c1a47ab05cb0546b038d55e5db0ae4aef23b52c948a2dc9c387a52ec93532672fa1de2eb53c6aa6f72b45ac9ee6d389c37dfb8341a9ada454
-
Filesize
1.2MB
MD5fd2515dbbe5e7c6c503cd6842bce3124
SHA12aaf6a3ab90deaf15b6ed0ff1b1409ebcd2453fb
SHA256e74794cf9e686847b983a16aff8bab6bf87ba0569e9acc6469d6d0b21cfe2acf
SHA51276393a2b6ca64b4746a3925e59940713615ae59fc39d226eb935f7418a96e79eae0ace41db5da6dada674e876bbaf6c4fa2883c87c02b6b5a459e26a001407dc
-
Filesize
1.3MB
MD57ef1df688da81edc7b72596a96267250
SHA1823e48f03b82ccb13badccf3a758ec173c0c0d78
SHA256e64cf569d76314a0e52dc1eb20b1123b7b6b738cd7764411ad58d32ff00a9577
SHA512fb7c4743c25e996278f13e3143b701a89fc51b6e13279d8e5cdfcdffcaf7bb5c3e6c5f4fc0b58337363e90bb9a66c31088956d613051247563c9b0dbeb3fd3a4
-
Filesize
1.4MB
MD5cd6fe1126133b9427cb920d0e9b6cca1
SHA1bf3bafa3d4e058dae8793dc242892322bbdd7c9d
SHA256bfa19c00b6dfbff39f490009f21419acc6a4614a6650540e4b987068cdfe0c66
SHA5122550d1d1b406024d36bcd069596fef45bcce68014a905b3a8b1c505185df01e18c8f8f6edc3353fa7976a790c79008787763fc1059ff7c3e9deffe1b34366c81
-
Filesize
2.1MB
MD5bca3c7c1f36459c52feba9aa9ba300a4
SHA191f7826a071749a1ffb9c422ad0d15f31b9ff54e
SHA25697b6b3611a62cc34386d997c7d8ef9816853687fc501321e039c6d0b832cc720
SHA5121c5b371e1d06d4803405f20d1d7c04f1166068d2132b09f80263d633606467134381527b8629f3905e201b437dec42538c99cad41d653eae7cf3335ff23ee268
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.1MB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
584KB
-
Filesize
1.6MB
-
Filesize
624KB
-
Filesize
40KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
408KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.3MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB