blustealer | 6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c

General

Target

tmplhf3940d.exe
Size

1.5MB
MD5

13dc441ec2f9e3f9aa1f354a4b14d318
SHA1

05b62c596ca78745d73514cd5d43434929955863
SHA256

6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c
SHA512

30f4da77bf1ba35334fc1812a6792bb91396fdc8cc7b918f81c6395a48523079cccc89c7090b5c21c30ab62939fa8663cc695ad7d876f083773f7c85cffc5242
SSDEEP

24576:TwMryIYPOfPFxgvnRnc215nETdxUA6p7GDHDCf0uEywBk1EM8Xzd:Md5PsPfgvRv0gA6pYC52lD

Score

10^/10

blustealer collection stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Executes dropped EXE 2 IoCs

pid	Process
460	Process not Found
948	alg.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	tmplhf3940d.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\709ecf9c826a969e.bin	alg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 520 set thread context of 1292	520	tmplhf3940d.exe	27
PID 1292 set thread context of 1540	1292	tmplhf3940d.exe	29

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	tmplhf3940d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1292	tmplhf3940d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1292	tmplhf3940d.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 1292	520	tmplhf3940d.exe	27
PID 520 wrote to memory of 1292	520	tmplhf3940d.exe	27
PID 520 wrote to memory of 1292	520	tmplhf3940d.exe	27
PID 520 wrote to memory of 1292	520	tmplhf3940d.exe	27
PID 520 wrote to memory of 1292	520	tmplhf3940d.exe	27
PID 520 wrote to memory of 1292	520	tmplhf3940d.exe	27
PID 520 wrote to memory of 1292	520	tmplhf3940d.exe	27
PID 520 wrote to memory of 1292	520	tmplhf3940d.exe	27
PID 520 wrote to memory of 1292	520	tmplhf3940d.exe	27
PID 1292 wrote to memory of 1540	1292	tmplhf3940d.exe	29
PID 1292 wrote to memory of 1540	1292	tmplhf3940d.exe	29
PID 1292 wrote to memory of 1540	1292	tmplhf3940d.exe	29
PID 1292 wrote to memory of 1540	1292	tmplhf3940d.exe	29
PID 1292 wrote to memory of 1540	1292	tmplhf3940d.exe	29
PID 1292 wrote to memory of 1540	1292	tmplhf3940d.exe	29
PID 1292 wrote to memory of 1540	1292	tmplhf3940d.exe	29
PID 1292 wrote to memory of 1540	1292	tmplhf3940d.exe	29
PID 1292 wrote to memory of 1540	1292	tmplhf3940d.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
"C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:520
- C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
  "C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:1540

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
dac50e57266cd5e5a4676929e0240acb

SHA1
1fff5040d9ba9e7199c4a73af74a0b33d023bd16

SHA256
fde7c32677371d655e0041fe959bc7e5747dcf9feffc2fcb176f581c3d3f7881

SHA512
5f39d2f311feccee434982d6b5412f03ad16a4d3219d3fb19489eac14a71b2df7efd29cbb545bcba0fedd3398450028b1218f66e080d93e3592e06d729486a5f

Download Submit
\Windows\System32\alg.exe

Filesize
1.3MB

MD5
dac50e57266cd5e5a4676929e0240acb

SHA1
1fff5040d9ba9e7199c4a73af74a0b33d023bd16

SHA256
fde7c32677371d655e0041fe959bc7e5747dcf9feffc2fcb176f581c3d3f7881

SHA512
5f39d2f311feccee434982d6b5412f03ad16a4d3219d3fb19489eac14a71b2df7efd29cbb545bcba0fedd3398450028b1218f66e080d93e3592e06d729486a5f

Download Submit
memory/520-60-0x000000000A360000-0x000000000A510000-memory.dmp

Filesize
1.7MB

Download
memory/520-57-0x0000000004FF0000-0x0000000005030000-memory.dmp

Filesize
256KB

Download
memory/520-58-0x0000000000920000-0x000000000092C000-memory.dmp

Filesize
48KB

Download
memory/520-59-0x0000000005CB0000-0x0000000005DE8000-memory.dmp

Filesize
1.2MB

Download
memory/520-56-0x0000000000750000-0x0000000000762000-memory.dmp

Filesize
72KB

Download
memory/520-54-0x0000000001070000-0x00000000011F8000-memory.dmp

Filesize
1.5MB

Download
memory/520-55-0x0000000004FF0000-0x0000000005030000-memory.dmp

Filesize
256KB

Download
memory/948-96-0x0000000100000000-0x00000001001FB000-memory.dmp

Filesize
2.0MB

Download
memory/948-95-0x0000000100000000-0x00000001001FB000-memory.dmp

Filesize
2.0MB

Download
memory/948-91-0x0000000000170000-0x00000000001D0000-memory.dmp

Filesize
384KB

Download
memory/948-85-0x0000000000170000-0x00000000001D0000-memory.dmp

Filesize
384KB

Download
memory/1292-61-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1292-62-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1292-80-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1292-81-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1292-69-0x0000000000FC0000-0x0000000001026000-memory.dmp

Filesize
408KB

Download
memory/1292-68-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1292-66-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1292-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1292-63-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1292-74-0x0000000000FC0000-0x0000000001026000-memory.dmp

Filesize
408KB

Download
memory/1540-97-0x00000000001F0000-0x0000000000256000-memory.dmp

Filesize
408KB

Download
memory/1540-98-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1540-99-0x00000000001F0000-0x0000000000256000-memory.dmp

Filesize
408KB

Download
memory/1540-101-0x00000000001F0000-0x0000000000256000-memory.dmp

Filesize
408KB

Download
memory/1540-103-0x00000000001F0000-0x0000000000256000-memory.dmp

Filesize
408KB

Download
memory/1540-104-0x0000000000980000-0x0000000000A3C000-memory.dmp

Filesize
752KB

Download
memory/1540-105-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing