Analysis
-
max time kernel
241s -
max time network
252s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
05-05-2023 21:00
General
-
Target
tmprwm0tnp5.exe
-
Size
1.6MB
-
MD5
170860057f4aad06ddbeea0ca2b3f1b6
-
SHA1
db04c735b769df458518f959ae7eca39cfa06213
-
SHA256
e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998
-
SHA512
f8bf57126bad026be2414121c798d5688119f06312404c35dea3f457deb717f6422291f5401178586fd23055577f893b4e6236e413c909e3b526c45d3b957766
-
SSDEEP
24576:uU7taDBzgNEfeEvFTMxdzYPh1ogay/zj1weNgcHFx5MpfTjU/c7jNXPohE:uU7PNBmMxdEvogdzxzHFx+pfTgE7VPI
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 17 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 20 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 5 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"C:\Users\Admin\AppData\Local\Temp\tmprwm0tnp5.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD576d5c0d56396fa0a797161669b1fefbf
SHA1b83fac4eb88e9959a491d056b939ca08d3014a58
SHA25673a07cfe74397a6d673b78f16634f11c9c444cc521abadcf02031723a6ba46c8
SHA512944d68e6a039947c32228722a9ca5bbd53331eaa6f937daf4dd7f33233039b151f3fc9df34afb526a50de83e8e9fd423b5b4f8c0631462034f9535517aae84d1
-
Filesize
1.4MB
MD507100330e5362a454d6e769d36a38e05
SHA11e4cdfada40978a11370eb8fc40ebdb8fadbbfcf
SHA25614452c9e50d743610ffbe5705990d05fcbae158d2698389322e94c9ce83a880c
SHA5122ab664d359fd643a9fafcc318c24d3da132dfc05d57d688e7acbf3beb435f59e72e24f8c84bb2de6fd66cdbbcba42470c46bb35eca1ec3ac4ed6288b8b6ed80e
-
Filesize
1.5MB
MD5457e81ce6b81930bcf89de26011777f8
SHA1f0a2aa00b672847c89227edfef4e07e7540b9010
SHA256774d8c3b6542a6018725b76f9e90da182a305134a4b407c823c4bc9e27c6ee2a
SHA51220417726403c99e5bb15e67f25c11a047bc4b7f10fd16fb75288a9890034c627a6e47da70b1ab074db050bc2f954653f5211b14ca70e9e865268f3a94707fb96
-
Filesize
2.1MB
MD5405b844ae508b922a5a05d36da302bba
SHA12a9a0281c9643005fbe1787eb801de8d758ef755
SHA2565e02c2c54ae9bb4a0a7d55b2aa01bffbc9dd06ed5012818b78ba6106cb184f0d
SHA5126ddc11d0dd339e6d774998550a9ee340941730d06ad7ffad6609cca4559420c7a65967788cfac9c5be08a8a399a0cc59368a514090c25674d284eec5ef959b3b
-
Filesize
1.2MB
MD57f8ca59ac311f6a421abaf3c063831f8
SHA198c85ee49707c30be4585c4c55428759818874a0
SHA2566436830590b2c632b1e085be0b6662f0eae6eea339b0503b69231f7e9f815150
SHA5120dcc973764299177ea76678b23567533eb882959ace8054ac7870d159faa83365c1be056fc6a07a42eb90032112d2d72a70a542b312f41c94074dc2ce609a633
-
Filesize
1.7MB
MD5b713240822daaab9c10d8550dfc467c9
SHA14fc3a7b119e30de1a962484b80f52a99db8f636d
SHA2561afff821db9246196734cb7dba38eb7e1c19637bad6bfc2547fea32fa5599e15
SHA5122840f70dcb79b4a1f7863f22f560ae74b8852feb15b772b77be044c1dba25ba9c54efb9520917d0b0cf9ee5e57c00b4d8f2373b4199a676212263393e9da4b2b
-
Filesize
1.3MB
MD5a2c9affe2c2f838a6eded94a9c88dae4
SHA1b7d0cee532c6a9785dc4f93f1b62395af5c0604e
SHA2569b8cdf9ba71146ad895f311fc2662343b50cc330135e66c0ebed0cf30cdd69a2
SHA512f2a6c8b6051877f1c69e112789df91e4470623ca14c7ca86a95b51dc6cbf9efc361376e13334851744fc420b5dbb3b7a2ddb7d39b4d14fb44dcef98526c64b8c
-
Filesize
1.2MB
MD5698dd743c814e538e4f746eba7e1b703
SHA12bc162b0facdaa8db23aa571badf02bf63c5073f
SHA256a5022d93a7a02fd5090537541f2ee1878a23a88a6c1781e0824dc3e69feb26af
SHA512791c6849d7500a1c5653e8cb4e8471bcdc692c5ca76dc47c77548ef55fb5b4cc7ecc5692b7d073ea8ade21a1e705385651f418b1dd74260fd4e623884d8757b6
-
Filesize
1.2MB
MD52486bc1c4607b3a1905ed1490c8aa45f
SHA114d055c6476ffa6cd40ceb5cd59b919f561d7a6d
SHA2563fa80b33a6fe88495540674e5253d18921c85d2f9191cb0cdaa15c7e7ff2e2be
SHA5122c736af54f0494325082c0dc6a95889818351eaf4a6d92ad247a4c536224877a929bd6f5a1e766412ecbfa17e3738ba87a0ec791fa71618735f7b3e95462ec3d
-
Filesize
1.6MB
MD5ccde53da73511b575e0a5fe5fdddf8cb
SHA1fe2bb0da078fd02f8fb2f15c7ea5f68f307cfea3
SHA2562130b661d90525af63e1ca25f6e8efa5328c683a360cf45700cf5635f67b0bfd
SHA512a7529fccd9bfab97e879cd7fd6f8f6c8952c76548260fd1a607d9b7887cd2e29dab176d542c708545e91c1673015d240a7fb8b440e5dabec02dd27727279b92a
-
Filesize
1.6MB
MD5ccde53da73511b575e0a5fe5fdddf8cb
SHA1fe2bb0da078fd02f8fb2f15c7ea5f68f307cfea3
SHA2562130b661d90525af63e1ca25f6e8efa5328c683a360cf45700cf5635f67b0bfd
SHA512a7529fccd9bfab97e879cd7fd6f8f6c8952c76548260fd1a607d9b7887cd2e29dab176d542c708545e91c1673015d240a7fb8b440e5dabec02dd27727279b92a
-
Filesize
1.3MB
MD5d3e01aa58ecc4863c849d204694037d4
SHA133fca89d98a6345de089af222985a487aa5d3523
SHA25608f7b0aee13f297f4d04f2d847b6ab4c2e31a9bda3da0eb4f057f02654c454d2
SHA512415ee84d399b715c6d90c628b857e638dd5417133ec5dd9dbb3b8f59e2fe2f0796dc61fdb661fa81b72099247274fa0454b346c912af8c7e503d3530b79bb888
-
Filesize
1.8MB
MD5919aca35c1590223e69926f59f1e239b
SHA112cc8ad9498303b71e08d1879398b921107b018a
SHA25686183b694bd3262e58f764b4f3765832a3f86227f0ea8af756a2965ce24bc4d1
SHA5127ef141cf08e342f921f36d7906be29cb3d698ad76b71c6e59576034b34cdc83e01601c72ab9f8925038d951ca9753056bbbec39302d901979ac48573ab67522d
-
Filesize
1.4MB
MD5adc6782e9873f3e400b30ec116c2a910
SHA1bb2e4b62069f6f9330c0373d96d5887ff4c51db8
SHA256974d58627ea48e61176cc004a24ec4d97236f51741142f8ce33744f3a867f342
SHA512d975303422a11ecf6d4f10729c1f391cf7f1b73dd2171e7fceea2d589dff767a87f8ce41ce4ea542ee938763825baf09f0b2b70e866fb80ce3d60eba55c58372
-
Filesize
1.5MB
MD57cc7d010718e24a590e4bf8a2f21f711
SHA16e043769ae7a8e3688cdcfecceeab588ed6ed046
SHA2564038932a54996d69fde92040e9525736d6480bb7af3b4407fa3b6974c66098fb
SHA51201e0e891f99c1e49c7d5ac9e113440255b3030a8d0113c6ab02da059283e84b8a720f782099aa6338705f35c602f63b4a24fbbac70c52579c5b3f7541010ecce
-
Filesize
1.3MB
MD57ead92289088e2efe1465fcc60d49234
SHA17a33adcda2695cfa979e9d4896ad557d58c26515
SHA2561b969e5209cd8d9f25a380eb55186591c09091e086b1f4d4fe7f8596750e48d7
SHA51272170d0888f6a02227b850f8452c0676ba1b235b832a51f5760d25bf186c1d9daa7ac7534f67db76e00009c86d638c90e1208441d2f2dc73d5e5ea45212d50f4
-
Filesize
1.4MB
MD53cf13b401fb7d6b45b1c514a50ee7eff
SHA10d78a7a233917b0ef6f2710cc7e832535ec87809
SHA25625b356e325ddbaacc7759079ff3698ad8c93812c123e08b5edfe90bab7c6fe50
SHA51261fbf620106bbef7442a2e486158fc344345cbf19807c8d94244f46a81ce4b8d9e8446ad3ffcff51590ed3a259626504a05e34978a2df5d06b58f9a700d4a5c9
-
Filesize
1.2MB
MD57be948544051128d2772bf65db4897f9
SHA13be7532c54fcaa0b29f1e4ecad6b05e9ea358e30
SHA25651d90b264c9028d408cd04467ab18d3b1e3bd063aef840f7e4afd6df78a3fea2
SHA5121b4e22788e1f48ff992bf04e3dc42c14371a2d63f62096f1533d4ecb10f4d3f4eafaf1f235afe4eb261047d88f15e374ebf33372e1ac73eee6c52f1bea6603ee
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
1.6MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.3MB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
1.8MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
408KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.9MB