Analysis
-
max time kernel
74s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
05-05-2023 21:00
General
-
Target
tmplhf3940d.exe
-
Size
1.5MB
-
MD5
13dc441ec2f9e3f9aa1f354a4b14d318
-
SHA1
05b62c596ca78745d73514cd5d43434929955863
-
SHA256
6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c
-
SHA512
30f4da77bf1ba35334fc1812a6792bb91396fdc8cc7b918f81c6395a48523079cccc89c7090b5c21c30ab62939fa8663cc695ad7d876f083773f7c85cffc5242
-
SSDEEP
24576:TwMryIYPOfPFxgvnRnc215nETdxUA6p7GDHDCf0uEywBk1EM8Xzd:Md5PsPfgvRv0gA6pYC52lD
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 5 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5415fca1d0ab64db6af68c7e19df61b93
SHA1da31f1150d3e5568a38ca5de493cfabec1490c41
SHA256aa3ce632a54bb76df0028fb12b34833c75fb20570df9ba68984309b0b383b25c
SHA512c04d529465c5085cca2af1568d6a7c4f6bf9b783021a94d3c9be4215036bb6e4642d0411d07943c24fdc2a4db7a1d1763b271ee1e8a59bd1a5137c70b465b78a
-
Filesize
1.4MB
MD55edbbf0ede87b0d89fecfa1127d09553
SHA16ab66d2895f2f567ff2b7a1789bf50e9bace60a6
SHA2563fcb67e48fa3f5db932909ec989eb1439bbaa8e4164e16b9f00e3b5f01115ed0
SHA512a46dd3b2d21917548daa4de182f13bcbfbbd7adddc7db8ed7f7c32f618125aa52ad7cc284511c43198d9869204a4b77a34a47ffefefdae178899b28757327a9c
-
Filesize
1.5MB
MD54148129b05267bf2e811fcb9c79ae730
SHA12ee29f252d77c9dd7fd19bac733c5f3ad4920866
SHA256cc46a7d371bf662c1f7aea978df947dd33c5f5ec535c5d9a6e579b33e7e2dcad
SHA51277b5e70a1f351c7e16c06d0624a967cefc57805c1f209d7e473e53838ea9eab011467b40898b498c1b2cb0559a9443d2de87861eb1c236543caada97a8a3ddcb
-
Filesize
2.1MB
MD5686c4c45ad3def993b0a70bc43d11e5e
SHA13bda14ca2a975ea2138efea37b47ee65b99372c4
SHA256ea58ebcaa52a2d95cd68d7cfdb5cf696ed8e60c86b3b3f6d7ed3b4f7c6b3af99
SHA512e33005e4ab7583ab9bd7dad7666e76f753a4016bad61ff47671d3bb4ac44418974d94b5a6e5dd1b7d49cc2361c0036f364c9c47b7df15e4682ac4a8c8a070549
-
Filesize
1.2MB
MD5b8b50d677c08ef2728a6bc734bc16392
SHA18ee774154af7d9e95e7a3f1fcf7b57379b8baa43
SHA25638ed8a598d7526f0cacef91f3f6372f4a93dbda583d9fa0dfd2465e979112a15
SHA512eb119091fd4b9b44bc016c9e63cd9441290f672c09fc736368cc1e2558765ab87678ba796e224e030946fc5e489f92151079a0cb6ae0f304154da41e5bd13798
-
Filesize
1.7MB
MD5e08cbf43561f9fa5468e63a184078409
SHA171f1e06cee5049ed426927eef4a6ea6ca4fa0867
SHA256d1bd0fbc9b58210a3b171ba23b3d1b010e0c4563ad91704ea8711d5213d8b39b
SHA512db29fd5ccc00efe1f3b730f509cd0234ed6e06e3aaae9745cf36d1ea5964af92447829bb151b3115349b5dbeadc5161ad1d7cf432503f678504ec47325c6807f
-
Filesize
1.3MB
MD5200988d6c99ce9be6fe98bd8ea72ed56
SHA1b84cb9db8360bb8546b9535c56f1922864a7443f
SHA2560fa97b9ffc91ca26b987a364ed9309c2a0f2a084c1006538b80c6697decf2792
SHA5125d4e545025eeb17666206cec1cc730ff8691aa4ef62b170c607b01f26f2d41d35bfd16d9dc0b297bf9fff88f390297d7648f02d5575d700a2d0012ea370d4493
-
Filesize
1.2MB
MD508070ec5f8ccc6a56ce70549b67b8842
SHA10299ca3f97c0fc721ac13f34d105497d028a262a
SHA256fdf0fd094b9dc416d0e0447e7263c26258c5806b3bf528b5e0158b46c2058d7b
SHA512c01dec5be2eb87161d60d2e88b08a2ab82492b9a26873df48c36f1de54a205a654bba9a2ce89f55e673619c7e311de4fd96e01569405b753d08a83401a843c50
-
Filesize
1.2MB
MD53c3ccae12696c723d63d9cf538cb48ff
SHA1ad0960931494398b033986087352fc5b463e9b55
SHA25665e435ff461a6ed857ee8df7ec12e7cd71fd7a4ebde98137e4b02292b591114c
SHA512175aa59f87eac0bf91fd172def7dacb1c81cd3886ec4edc89a91f95699988269cec036e88561b0d5d1984dd210a2d80511e26ed324007ce3329b304091f57c53
-
Filesize
1.6MB
MD582f715172ee7e154998e4407a707252e
SHA1fe7cc7e7f650d3f1a4dcbeec9d4f9a7e3211c59c
SHA256e421a3e507d810e831aeb1792f3093101672188f3d50dd509d8169237e65be7c
SHA512e29c826711fa529fc411d89677fb7f89434f02309e1eec4c17841864683384e36922fc9a728d77fe50253f2eea4100c8db7973050998a7100e20f2b34f53b299
-
Filesize
1.6MB
MD582f715172ee7e154998e4407a707252e
SHA1fe7cc7e7f650d3f1a4dcbeec9d4f9a7e3211c59c
SHA256e421a3e507d810e831aeb1792f3093101672188f3d50dd509d8169237e65be7c
SHA512e29c826711fa529fc411d89677fb7f89434f02309e1eec4c17841864683384e36922fc9a728d77fe50253f2eea4100c8db7973050998a7100e20f2b34f53b299
-
Filesize
1.3MB
MD5a9480a8301868710328cca59246a52bb
SHA10dcbb5645030d7e958ec3ca177421882e52a66b6
SHA256cb0ba6b78c329cdb51a1f85337092868b55595358c3a04a0158f86ba0df7ba9f
SHA512a870283266de06fa6f3295edbdf93ad266331da5cc5073a0bdc7d519c013ec1499e129bce3788c06efe6036ab7f0d7819e242f8049f81ba0067c0c15abe8aabf
-
Filesize
1.4MB
MD5168fd9f69676ec9b7bd073c416a5c962
SHA1fa5c3f37d7942f994afce2e8832d84c84f226e04
SHA256c21a7e433c2e3fb880ebca90f588da9996545c596db4e38a7a65dd8b2f56cb8b
SHA512755e81e2046f57610c6aadae11de9dca289c36f60da8b0285f9920caacfba04048ecef007d9e579c81e7fe0ebe3c947ae1cad6516d9bab4ce763cacb39a66c35
-
Filesize
1.8MB
MD5814d03ed9228c60dc04fbe7c71c40887
SHA19352c4095d6085001a714cf4b27e71fadbb5695f
SHA2565e6284871e8e80b334ad05df7d8ab725771a8c6d51be5122776bac1b12637957
SHA51220bf96f9dc4d062c336a59ab3eaea29190ad529a84a62eb4aa365a1b0ea85de97bb8359b13bc6317cf9b002c94fd49c679b4238f683f3221d15d3c5c6050f4ae
-
Filesize
1.4MB
MD520a83c40114d334e775e96c17d1b3fab
SHA14d0517d4c36c6dda133033309a120ddea634f2ca
SHA256d8b57d0fa610090d0462d2285ec2621ffeafcdec0dc2fd4aa3235c9b296b83ec
SHA512054ec90cdacbfe208aa6b6c46005386b52c331a3e5571e6c84cd6b89ab5d6fa1c626c989b1f29950140de73e6a2c250af31070275fb0c3fb3e74a0e590c20220
-
Filesize
1.5MB
MD5a0b613fd2a042da9d4f6f0d4d8ada0bd
SHA1ab58a09904cd3e95c8dd026e5a5426caf0deb537
SHA256a34d4d4078b3ed3992a971db6d13e61c7a4c5edd5ca03e00c7320b3ef8bcb3c0
SHA512c8ee7473c70923a2c65d9795b8790434c8b73da3bfb8c77a6e8bfc28ea156779fec6d2bdffa7bd886bbcb666b522220edc1de20ca6e5f000ddaba158f72294fe
-
Filesize
2.0MB
MD59978d55de26d3124dd9a4cb6e87fb641
SHA13cc5228dab32f24da27ce46fcf91e40b678a706c
SHA2562d4428fce7eb3ddedea3e3009b77a02fd2c7eeb8dc377e23614642bac1791bd0
SHA512c71d95e92b47c0a469f0f203e187b40b849475eb2bdb5d702bd8b6ab240765161a3d4e93d03b5a590d859220a8f2eb5bcd3c9724a75ca248f2e19bd397230a3f
-
Filesize
1.3MB
MD56c0dcf9b4ff6e205c56d2c7fb5ed7698
SHA18955b645dce4e800c17504088a6d83074f19c79b
SHA256042ee41c4b1168d204301b1088eb2f2ddb990db39c0c2577cd26516519332c9a
SHA5123c484298654a4759bda6f0c7617e11d73bb3a799f7c5ae1be2054160219ec6533308c0f19c9d360350efb2be90e7bd215771e1706be50b0f43d821e461373b1d
-
Filesize
1.4MB
MD5052bf8ca2e7b868c6f251dbb25240d72
SHA170a6b7ab134f67b5de4abb70b2e89ebee945caa1
SHA256ad40c5beae02b7b54c73a89ecc8608b9a2b6a47805b8f18cc038e515362c6cb2
SHA512bdd5f82c06c0fa97b013b3836f0027d30c1c1e8157905511ebce3a2dd81a8d915146d0d44fefbb80f45f5aa4c2fc99cf922bd4458224af758744cf37be3ae7fc
-
Filesize
1.2MB
MD55d7d904bfade8ebef2df3fb65905ec09
SHA1151292a16e73abe84d2706cae2e61fa28fb16af0
SHA256b57bd5d96df9b90e78a4bb010cee27ac63d56cec13e2eacf59127acbe2b32ce1
SHA5120ba8266860b0ab306bf2c3ca60b9c1ac6e92bf760d84b2df24c14f93e5133a512f151c8556787eccb1d643e7fc6c58506a995c30f67d7225ef797ad411f2bfd8
-
Filesize
1.3MB
MD5b9e6a012c1b77e2268a685590f72ddf0
SHA1fd1d9663a721b6f35515bd4bd13cdf62f57c0469
SHA2568b840e49d3648d8b31bd6d2c5d2f8d648c02a31ed67314fd4715031a0926685e
SHA5126610c93427b25205008a172fe1d229fc36cf06ece0f561cbe439546089463e6158f62f41bd03b8b9f2aa8a2f15c790fe2ad6e3ab66deb3b2c368d17f468fbac0
-
Filesize
1.4MB
MD5f5c29a4c0f97d2aca28e0c3fb18f47c3
SHA14037df80188bfe3ff68dd26b1da6a84b5c587348
SHA2566c1189c1c9e3a99dd0c1239a5e1a1038357f21ce58895a49c1bc9f2659e0ff3b
SHA512ba93db0f2592ea59ab315f83b1e65559f83eebbe89b891b976cae755b8bf75cdb6610ecfc364fcbf41f3a6d2b757d95092c0fbfaa10d7be396e640159b0d7e3b
-
Filesize
2.1MB
MD505d1992cb5e6dda53ff7980dbde7a297
SHA14691d28ce42c712718f320807aff71b0c5a0e194
SHA2562940d76e1faa2a48fdb8b44ceb91adcb8f084ea8eb0966f18914e4553cce01d2
SHA512c94fb9a929cf240c5d12feab5e64ff4dcd34b1172c52efa1f5bdea3b99f9a21d74ed6ed6579a52e39995be09f49896427f92366d43f110015f5ed65d2b42c8d2
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.9MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.3MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
1.9MB
-
Filesize
408KB
-
Filesize
40KB
-
Filesize
1.5MB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB