Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
07-05-2023 02:08
General
-
Target
693c258cb5620f7e8714d4afc7215e2c7dc16872265148341db23b639906eecb.exe
-
Size
1.5MB
-
MD5
ebf99fc11603d1ec4706b4330761df32
-
SHA1
c560ca5ae10593d7861701654d839d1071515866
-
SHA256
693c258cb5620f7e8714d4afc7215e2c7dc16872265148341db23b639906eecb
-
SHA512
d31c699f201343bd02c07bbf5d41e00df8368b81bfbb1d037fb4b1e1894fd3b8232e80b065845745fa6dab7f23d47efbb1d8b6a9143f5b7db0fb4a57395c4f4a
-
SSDEEP
49152:NQh9Nn3uFcWIY2YZGIUtNlMpovD2i9c2:0/37Wp2YPUtNlMG7N
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\693c258cb5620f7e8714d4afc7215e2c7dc16872265148341db23b639906eecb.exe"C:\Users\Admin\AppData\Local\Temp\693c258cb5620f7e8714d4afc7215e2c7dc16872265148341db23b639906eecb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\693c258cb5620f7e8714d4afc7215e2c7dc16872265148341db23b639906eecb.exe"C:\Users\Admin\AppData\Local\Temp\693c258cb5620f7e8714d4afc7215e2c7dc16872265148341db23b639906eecb.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD589726ddd06ac565ceddef5c62ca988fd
SHA13017de38a75f6596c83448a7f15e2f98ac178ecb
SHA256753ba29d08bc93a0c9721502c961d2442418637234395163a82692d9a704036c
SHA5125ac2b97748ae528ace3ad5cbdeeb183e0a40a3c68797243ac011bb60a34475cb17b9eafdf77a1e7310c34aee4c1d72936997fc3c1d4c5f6334eb24b6cb4ba8c0
-
Filesize
1.4MB
MD561eb4a73d6743dea557e699d51414f70
SHA1ac2bc6fb938df956aaaf3edc22731c78cfb22a0f
SHA2567f1dc2cf3d8ceb9481d0b8f7c03451651cd6b06060b29f0ff28dffb4c4cb0215
SHA512397927ae5b100c4c417afd71b72aaf7ff31a1bf914d30b89efa3b498e7b3c14d216e18b2aadd9f0306e7518e62e0eb5c597707ee1769c8ac99dc483222bcb439
-
Filesize
1.5MB
MD5058368b70fa22f109aea73704e39d1f1
SHA105d51112c71e2e1b7c890b5ba2563e1ec7f446bd
SHA256dd584adf2c4fff643c3b00e9d3753471db5999286cde62df410632caf12a2246
SHA51240a7e7c608b5c66b3eecf2e7575360767564f0304c89adeb426db5c1ad8695bc25e30cfdc46ce9f4307cb6c7d1deadc1e427cbeb7b884c3754322d127552c515
-
Filesize
2.1MB
MD59307c2d7c0f4d5c1650ed0d081fb5260
SHA1dbfb8eedf298fa2f5d721dc473b79673bf57e037
SHA256cfc9c4094cc673373741f4dd90dc8d56b4f1e18f6ac62c41c2f1b0a97d9752ba
SHA512bc34f616930692c6610171f392c4048f445591e3bdcce81ccdda2f847bfb36c7d55ccdd78566d46534c47fd3a1c3f410eaefd060a8b835a8ee49c55fb68f3d7a
-
Filesize
1.2MB
MD5954c88c182c9f565391cd03df72e298b
SHA16d9720586d8650ba44eeea8768ad8f7f3bb4d93b
SHA256e7932f7cfede5240e7fc4c367dc8f194cf48d693adcdee44365d88b86aef2be4
SHA5120263dde903eeaac2c354bf449bc8828e17faa9d32917895a1c3db0da5d2527747a1543efb3a41251e743936a9b59616f34c9cd60aa7f3b32220d1426cfb2ebae
-
Filesize
1.7MB
MD55c00675ee7b01950a2d0358022ee7110
SHA19e1c1d0675bd53f12be1a7d74cf4253b75a62cfe
SHA256b4996e8a7da74f1a1c619324a3a663419f45ff575b86251e3047514779d976f6
SHA512d75a7992fdc7fe67c7d4a35c7b8943764fc561ae97697cb7592da9fc9fb299ce3f5ee843deaa86b2d5116cfe82e8b7c5c32378c22e44c251b1328afa48cf06a5
-
Filesize
1.3MB
MD50b081c2d0f70d2c2847c607436d1aae2
SHA1690001ea9eb021acacebd435b5e20953e7a3dd1f
SHA2561789c25c8806aa480709857f6cc5f98c918b4e27bc55011f783a1b032e8b7ff0
SHA512db710c7016e9067c9a60f8502afc00d645319cc13b359f04aad88b2c73ac28e7dfb0df562c96037270df98d8b5bd598619de1ec3a5765a32cb93f940acc60c3d
-
Filesize
1.2MB
MD5f0a6058a972b7c37da094a35e5d5835d
SHA1b7ddae63c42a07acc41a3aae159f400eaad57c85
SHA25640fbdd070b5f9529c7b192831a284032f96e2ae02d755436441e51ea4b597cc4
SHA51209a2988d2ff582b3fb6bd143e6733c58fefd501780d2a61f785bf0c2f055280c309f521233d5f8b1827d726c8a27a4d95c464ae97642e3ee0ad9203ba82cceb9
-
Filesize
1.2MB
MD5f7bab4c23beb71bc333bc7db132f377d
SHA1112f141cb12378a55de106662b84c2c0eff5d2e7
SHA2566325f5ba08e1444261a3f7ba69006b9144d760b0da38028eae5108c940ca850e
SHA5123f1cc64e588a6d42e8ad0d209ec831144cf5ee26a861790fe45ff9e25586e78c9bacda47e1cd31e41ca7857c9dd787352ef185dde373c97f416f73569374fb6c
-
Filesize
1.6MB
MD5bbb91f1807de29ec2a41d4e19333d577
SHA1b8201015b54e4103844008c6f1973cd11d56dd0a
SHA256b6d21ce9eab6c5f5f7777fd1682d917341b187723fb5e96ef9c56ffcd7c97b83
SHA512ebfca958293ec6bc7f408a2aa33866248aaf1ef14566f68d72fe7cfc9bb0323a70e05b28b8ef2dfa907f3eea4db294c51d7ef7698834caa30d0c411ddbaed363
-
Filesize
1.6MB
MD5bbb91f1807de29ec2a41d4e19333d577
SHA1b8201015b54e4103844008c6f1973cd11d56dd0a
SHA256b6d21ce9eab6c5f5f7777fd1682d917341b187723fb5e96ef9c56ffcd7c97b83
SHA512ebfca958293ec6bc7f408a2aa33866248aaf1ef14566f68d72fe7cfc9bb0323a70e05b28b8ef2dfa907f3eea4db294c51d7ef7698834caa30d0c411ddbaed363
-
Filesize
1.3MB
MD59632b8cdb404e5fd61bf07966eff0a6e
SHA11a769e1f8a814c2e66149ddbcfcf8d9d357cd0ae
SHA2564dc506bcc876b2cf773ac61ab70ab607ad21db453c6070a9ce21f3a90fafab38
SHA512c67f127377dfdc7993fcfd30c8bab66beca2527a81d8bde44b10caa2ffd185c30d73bc9a79b7e5349dfe9fce165e0dbb712c738dc60c2b3317059a44152d8465
-
Filesize
1.4MB
MD589c6b91ec67ec247e178b8c3a913b05e
SHA17018a44d3a57e0b473ae27b5957f1e991e77f3f5
SHA2568f7697dfda0213c6398dc17103c04d6cdbaf8ff42260dc1fec51ebf4df1155f0
SHA512c4bed42d8490af03aae98993386e7817428231792e97163483bb12040844e6fec27a02e4f4a2e0e3ff2ba36862d70e81209615ff2243d42b566c931f3d18a677
-
Filesize
1.8MB
MD5d4f2c250c44532a7126e2d53e264c7c3
SHA145122637335b95319eeb6ab25d4731ee9f594bb8
SHA256bcf2a831c76364f8e07d84afbd1389e1380d4a77b753dd4ec762e5aba765e394
SHA51228bcc8239b0cda073ddd47d0e0689576e95ba7807586913e66a81331c80e955f5c1df52dc4547f1b401d9b11332f43d54405afa898dd4fb2aa0eeed9086cc396
-
Filesize
1.4MB
MD595cdf4e0f75cd043ef6e29d65bfc9d02
SHA1339bab792d4ac6fb3fa62748211422c46437a602
SHA256dc00545887be56136bcd9e382a7887d102de44442c2e24361703e7e660c18782
SHA512d1987e04703a052fac5042804599bc2ca9935643183ce44423daadedbcb3a4aa79654a64d39ffb042ab1660426a3f8bb2dc1d1870c19a3fe96ec52e02463f6e9
-
Filesize
1.5MB
MD5791065b0a870fde9dcb91c25c135e591
SHA15cec1a53d95c443cbfff58fde14f5fb37bb1afc3
SHA2560bf3de6ee3b82b7ab72552623dbf34e15d90e3955c032548e7b0b0b34e0ecce8
SHA5127ca707e512b6e148d655028d4b3286754300c044fc35b21678471c569a5fde2998a439eadf784cb8d037a669a9d80aacb511f0c0baeeea14cc44bae62cd359ed
-
Filesize
2.0MB
MD52b8826f3e4790f6c82a4abcb76a9134a
SHA12e73e3a4890cd1622ca16233a2b7a89990f8e21f
SHA256c49cbd35bb4198e94b3d06723f19081bcd888ec8c3e4376541bd2e807290c0d3
SHA5127eaaf61e94e458ccea7c45e8e56e1bde9d0aad2a11e4fb221f62f336593afa6deb913d91b6de5f15cbcfd64867b30d78c336e6891a89ed3b956624f79fa89920
-
Filesize
1.3MB
MD5819917556a54584fd06c91cb33d5db86
SHA1897b473aee8fdfd9697e5954a85a48453d106024
SHA256d232fc10a2f80514665fce5a983e982a2d7b3365d8003a90a7f4bac6867759c6
SHA5124b4781e7e92fe7c9789143f5ba0c771f77073b299dda740073fd69562b313a9f55cfd370f8979afdf293646db52dd96f13dffbd842be2b35d82e57c5018f9647
-
Filesize
1.4MB
MD5e904fe71e9101d1f17282eaba313eee2
SHA16460d9a4bfdd0b5c11cd6534c4f5c1e69f38c540
SHA25679b9eab6a919c42c3f221d606b227859d3b76dbc9bdd9acf0aea6fdeb32e0aac
SHA512a7333691246f7e22e4a7e1a4db42e3f66e04b6f23fc6dcb14cda6fe4d001a864b283335a27cf6008edb9e0f179b544a5cfa4680049072142415e2d63faa5e225
-
Filesize
1.2MB
MD5b3c3b4c7eec6cc06c4f0a8630e5bc5a7
SHA1acc7d590672a4dd7686d3a5b4ea89725fe4b2fda
SHA2567b7c30dda5c5d202c4334e2c3863a0f883df08a912dd114bc867e3410c82fd08
SHA512d828cdbfa65275b4ec92ea59873c6a13c16a9e11bfaaadcda6773255db71f5df22ffa8651c02790b06d04e7b16a5596fbe6851aaaf6065f19cafe313628337b4
-
Filesize
1.3MB
MD58db0fd96e8ec8979e3912ed4485e964d
SHA10d071cebca103a1f24d082de337417ba5c3360b6
SHA2565aa64648ae943d4d44431844e79778b199cf4f00a3d755acfb5f62ff3d46002b
SHA51294af7d8646d951de554fb97903857c8db2a6d9022dfebd5fa6f87e463022e79515160f709689f9cf091a8156969ad937a1c9b2fdd2c3998179fcd49e44c7fae5
-
Filesize
1.4MB
MD59b022a2f8f01897ba9d9f3258ad2191d
SHA1483e04f06f640dcdf348cdd733cca860958c4fd0
SHA256bfcbcc987411bc465cd2d6275f71ceceba757f6d1ac8034aa79dfdc0a6ad2f23
SHA5122e91bb2608f02e37aa5202d059df58ba30adf2962ffd3e626ff0bfbd94163065a849b2416180536d96938d3a03f04bc01ac5833c017fd80cdaa7876de633a6a0
-
Filesize
2.1MB
MD54aa2cbc21511757573671ece78dcd5ee
SHA1392812f5cdeb72a922b0ea72e66c0e6300c400a3
SHA256a8f1f85716fdf6a4f8d271ee017201d0ae4344e906b14c555f32087053a377e9
SHA512f294f533eb30662f43a3979ed8c772afccc692144bd4057e08eaa8ccff5b11f040b2ea4d57f45d28c4e7d2a6249f92ce994b61afa82fa7894d7df16e9959fb8e
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
1.5MB
-
Filesize
624KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
1.8MB