Analysis
-
max time kernel
159s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
05-05-2023 21:00
General
-
Target
tmpfkfb5hd.exe
-
Size
1.4MB
-
MD5
348bfc0c42d7254bc63e482c4173fea8
-
SHA1
ef6a18df4c2d04c6c194c5cd959e714114a402ab
-
SHA256
66190693a0bc90c29db018f37585b54fe7a3d42bfb01dbfcdee7567f37e7f8c8
-
SHA512
ebabb70e503b8631210ce53d89c03275b190823e85fb1591216022c575b271cb981b2c93f63989b0179bfa6fbd807c11d1cafd43d335d2010d35b9ae9f21be43
-
SSDEEP
24576:+3y9ZjI1Uw2ojP1WQ4C8KJ/Ixl2KVpLNzwOKb3uR/kCrVKoNZXgUFqssP:B9Z0xWQTJ/uAWp53R/k+VdQW6
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 39 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd.exe"C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd.exe"C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD572af38466458274df2a8577889e27252
SHA1b2d0f53b8a8eeaddc7e45467d8d44d32be03bbd0
SHA256be024912b8d8d7363bb170d27e427d274a40cab502159bed5f39122db3672644
SHA512980640ab062993bcaac17cee7a07f9d14d2ead70c9b4e65e1611ac0eb1684565bf103d8e6346346d083e059a1bc0e7fde09504adfe3912b1cc026ebbc154997b
-
Filesize
1.4MB
MD55c1233ce714d1a701923f99879b3dafa
SHA144d8e9ef5351a7ad889e38d34d04ac94239223f2
SHA256f14bf25333e504beeb0bbd956be81d66b0b539554ad375bad2eb5441693f48aa
SHA51270da8dcf9f8a3e5672623735de354854e4ebf7e10c024e0c7db6a3877b148a32c362472d1dc85f64fad84ab387c07a9ac022b16dc6b8f9f3aaa7dd3409ba711b
-
Filesize
1.5MB
MD59554de6242fadeccdc6e063302e747d3
SHA15d086267cd2434664734da5912cc264e92ed5d13
SHA2566a05ab7245e9d5fb7a4f544cda8e351052d8e93485deeaf72962a1f19eff542d
SHA512a8ba7e55d7309fea9f5da84c1a2e5bd82351fc8d2db38c8176af170f107b16bf5d2be66d6a50df23713a0670fb8b57bcbe7bf1f51181fc2a92d44378a1fd0f90
-
Filesize
2.1MB
MD504e21674277af1c251004f9e72989bc5
SHA1642a01de49e77bf98d9ccc6c40050e8811901e46
SHA2567fe43021786ce3ca52650d72901e5ef5a146e2afeef9e9dbc646f9414fa45c4c
SHA512249556b62aeb88c11245572dff3961253c8ccfd2694f4e2474b36e3e1612e0dd1a23d4f0f37e74a0c0928f84f4d7d03ab8137f7ecb1d68f7ece3e0f374cdfd75
-
Filesize
1.2MB
MD5173c25a4441cfe6b6f6e8116f60f04fb
SHA164d8b8292c62266d03e4756653d8c4efbd9ea7f6
SHA256971d19a88d988d53bf4098832359aa2135492c41aafad79877e32207f87f6219
SHA512f16ac6476e8f77d8c55bd76f83c7a5c081b0384a179bb48732ab6a55e8515b6f66d5bd87302eb588a5b14d25070c529a9c4770dcd44ac3cb3856dfb94e7485fd
-
Filesize
1.7MB
MD5b059a529f041a3b7c95c7d8a72b54e47
SHA1bf6f993ee7d286bb28f3fe7b76790e1103efc8c2
SHA2560969da14ad498b4e3f127c3d7c86a3db3ecb1489172df2789b080691f031ebfe
SHA512fa9b0c8409d82cfdbf38352d8b4abee36556ca099e87d8479bf4afae83438add1c91eadbd82a26c01c412ae6eca1710e80ca6e282f362d58d74f040284e99c02
-
Filesize
1.3MB
MD544018245494d131da8bf1ee379af2cb5
SHA1a64f4caa1b4bf38f823a0999b6f0d4e9564fbc19
SHA256b074fcc8eb6900085c3497373b00a715d17004588bcd20362adf0565ca622fce
SHA512e1dec04fe020c61c6b3defe497c75d6ba6ac2ee4eaf4c3f37fbe3b22319029002535871c63763c6819085e45ac0cca7a53fd1d0e70e8d2b02b9f14e2871d8285
-
Filesize
1.2MB
MD5c5c101c6e3c4f86bd84bc1575fd3fc13
SHA147bc51f6ffc2416531cb0c36b05f22b24be743c6
SHA25676639eca3de920e670364aa75fffff94073d093b7fe7a0c92b7fab0742568db3
SHA51261a556c807e970b69d49b5299653a91cedb04d416104b7f9d047ea8fc836a63cb35a9df5d78041298dde33e5f11f7c324bf7ee0d2cf8865ceeed23a02cfcaa67
-
Filesize
1.2MB
MD5643044b00f3cf081adefb7a5937af632
SHA1eb785bd57fa72ec205d90dc60129487c4117ce94
SHA25654393430003bfd12ade757c880f3a24ea11831b3796efb6de50c89ce46c26b4d
SHA51264e10b68c204be2184321040ce45f478fa032148393678e22b38c513cae985c77e227b6b8a486ea1a19dd3d52d8463f95d95760e78b26e18f82f3fbd270d4d22
-
Filesize
1.6MB
MD561de13efb644b5e09877f6d9b2c2ec33
SHA156b078c75ccbea48e9d6d5556ab12fab6d8935bd
SHA2560f6b3b70acf2e3f048baa65cf1558e96852a5bc57ae11b41a27100913e560910
SHA5127907dc71b2fab8fa583e7d50a14d49a5880ca7d084a7333459d7dc4c33886534de304e866dc90a54655b338524cc5626445be3afec50bf6dba42c2b6604e9b61
-
Filesize
1.6MB
MD561de13efb644b5e09877f6d9b2c2ec33
SHA156b078c75ccbea48e9d6d5556ab12fab6d8935bd
SHA2560f6b3b70acf2e3f048baa65cf1558e96852a5bc57ae11b41a27100913e560910
SHA5127907dc71b2fab8fa583e7d50a14d49a5880ca7d084a7333459d7dc4c33886534de304e866dc90a54655b338524cc5626445be3afec50bf6dba42c2b6604e9b61
-
Filesize
1.3MB
MD565109aa48716d882addf96cecf2de895
SHA11a309d9cfe147877d92f0e59c52258a0f88df132
SHA2565b835f4b413e1883f53d00e4c89c0a78839d7708e7b1b6b338b6dc89db429694
SHA5127a63e6989ee4fa633d500c4061001580d8565411d4e4291bf00f31fb039338bf4c14bb72685e6dbdfd725fa1942c2bd33525b0235359b90f32002c0228ea0be4
-
Filesize
1.4MB
MD59767d69c1738d8cd31ed02a247a1e703
SHA150578d0ce6a8643023f4833dc34da3e45ae077ff
SHA256c5acba30df670cb6e553feff812485a50056143c18d07a2a1fe6380dd0315dd3
SHA512e2fc49c1ad53bb309ce6fbd84d772b1cfa4e4da9bdbd78c955ffdf9a30b6ecdef64563af8b51d505837f3f39ed6022c8ad539f466d590101b5d80ca0e8a079c6
-
Filesize
1.8MB
MD50d9a27216d14e0f2bb9d435b336f1a0e
SHA1e3baff3982fbdfb10c0bd52a0764670d47b1ef95
SHA256cdf5f1c5fdcefcf1b011bc8ec5140ed7ad6bb60315e2c76f3506c95c85c1f759
SHA5120eb0fe2a13e957c0b113c1efd1ebce51ac4a82bc75f4cedc78a12a94fb938a59d834aae46409bb07cd589bcb42302cfd6c61e58bfcf80e18897bf476da7aeda7
-
Filesize
1.4MB
MD5bc097121bf58f7636177a42d95eaf542
SHA132d73e784ec8ec1adec1d4284225d5912f0af998
SHA256f54fd935629154e25c2fa9688c2178e0ddbeb85178d875f4381785a19fcc72b9
SHA5122e2937ad23f6595bafa8668267fb1793228f59b14c9fa5c58f0f43949ee35028df66fe4eb2509a6301bb0354a9ab279155b41177f17eb46a448cf3c47de97ff7
-
Filesize
1.5MB
MD511b96f6ebe7b742321ce76bbd8e772e3
SHA17836e034cda52acaca5957b879477d7ac8c9902d
SHA256bf74ff11d5c6d322a332dd73360cb67db55c8934bdf6fbe2eedf81d81efc3434
SHA5122227337282994d1ea8ff17c4d3a3866ea2e2924be503ce5efc51a7d03e0a944ece240ae54eeb5aa907165f05107398ddbd0b60a86a850b1064e692a1b7ec2965
-
Filesize
2.0MB
MD5e36ce912376bab178c04c9b9497ee554
SHA1f0fdefaf52464ef74520be6979637ddd00ec60ff
SHA25665acfc76e9949b4fca793e0ec8cde7c5acc833bd5d98deb9568c0d80c828f63c
SHA51226b0bb9aca98c5b83b91948ecdbfa9f11ae241cd6c35b5830901bfdb9b123d79f871c778354ee64cb01c1ed45a208206c874e2e06765e9dae6a9f7cf0e2dea6f
-
Filesize
1.3MB
MD5d93e88e5727e119d699006b3399409a6
SHA1acbd555f48899e6f6a893219ffe16fbd761e1ff6
SHA256e5bb8b538424bbac7cd101b75ef29f03c27fa15d4ba483f3f9539488675e093b
SHA51275c2cd7a1bb0323cb3d0ea2d562198c4cd56aaf2efb83cf08f0506d4b5ff3f3be1d4b6117de6c1737b192ad5eeadf69eb25277dfd54a100eba1f4a7c922d5ef4
-
Filesize
1.4MB
MD5e3663481baf78cb09dc0f6b3b4e2a361
SHA1bee2459c53c3074e8bff99623c9b9ccb40db5cb8
SHA2564644c758dde2a2967b76907117aaeab857b65ea23bd3cb80cde5825f2c76e4ed
SHA512f698698e483823b460061e8ce068759525d50ef77637ed3f81bfa342708629b4c552729af1f128b500af6d236bb7ae4cfb037dd73dcd4ac84fb6415506e739a4
-
Filesize
1.2MB
MD51f4e6a040ebeb2f4d37dd395b1ef4e10
SHA1cd6b4d564979c7dc542993c050298604e300406f
SHA256517921ac0c32f94fa05159a044d4a6282ef7242325a9d49d015d4399c2363128
SHA5123be6a82c6828790ea3dd26b890c8f5fac0baae3413bfa0e75ac68658a1f3c80fb3f6e17d0325096f04b2539f0c7af5be9301a4ec27a960a2e5c41a6f6f024976
-
Filesize
1.3MB
MD5d215b2b5c9bd1f60ff24fe15ebc25e27
SHA1ad82208e3cf7c9626eab053c432b7ad19345dff9
SHA25601fa9736c9a875028159a8cecd66fb23aff16e1cda6b28f895eea1297e0dcc56
SHA512d0e3cd50735d582bf5980e8e1de9d65ce0f29f0f45c530f28d04f32a145fc27fdd4a0fd8236bc24e8fe02464cbce51c50decffe92c4bdd6f89782b5421c12295
-
Filesize
1.4MB
MD5eb517f3aeec0e3bb1370137113f3f9a8
SHA1d0dccaf16635924ea21c756e256c98247a8d647e
SHA25694a4d2c451dda9b1a13e8f2c53733e347df3828f78f4555404576e6d6babc275
SHA512b8824655243ea3eb3109ceb0c2f721961a164a555ca6e0c62729723c62aeae31282936c14234d9a43388eef26fe5f89f7990650d72e7e4a0a90a6762b3366e78
-
Filesize
2.1MB
MD5151b381f691b77b7af2108d23c27df52
SHA18ced1292de361de88cbcae1876629d1a4b461535
SHA256545045a6834a0c7b367327ca54e1f659b3d6ff164777195be86eecf48bb83e20
SHA512588dec042ee3f1e9d726d5570fea50037e0b8d64b7cd056c72847a8e624d90c4a49be70ebfd5b3c4b9b41eea5aaffb3b91381ff3a1e637bd89ab84322b5aa464
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.1MB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
1.5MB
-
Filesize
1.4MB
-
Filesize
2.3MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
408KB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB