Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
08-05-2023 13:30
General
-
Target
Request for Quotation.exe
-
Size
1.4MB
-
MD5
235c2d00b691656b63a715eac1e7511b
-
SHA1
511e1e3646ad2ca0012709c56544ca9497b969e0
-
SHA256
374bd46f94cdf56eb2775ec23f0b70e8179541f348de2959a4a885b8f22af99c
-
SHA512
f0432f5f5668af790b8959a0cdd75236389cc0a3af2c033e04d92066373207d935f7a75261a0e46a9339fc8d083097555ea9a5c6f032310c54c4659dc7913ec3
-
SSDEEP
24576:AR8UY0b6vrCWFHojNYhS8vE1BiCJQwcGJVdOeyYZ3pnFchs1D3x3PWh:28emvrCmIjNYJv+BxHcGJy+3pnFcWpNP
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 37 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD59d187fdb3bdb95eaf02e620024cf579b
SHA19838514cce784f8fbb24731fc3c3296e79a4399a
SHA256d884101f8f01fcb0fc0594471d6913f60f221f567dcaa252c4bdba1f6d0dae88
SHA5125d08427e7b9824d55c3f38b32674e0ef6f0d2db02d75865340dbf7e7f00c323a2dbc1380f90ba2cd293667afd78a8a6d9a6f87811cda9a1cea031f989478869a
-
Filesize
1.4MB
MD5f8672b3673049304fbf19e242c8fd3ca
SHA1fbf8878a74fae1a62120ceabbc7c420e26dbf2aa
SHA256ed7f338362784a192bc890e1e24b070633b998309f2c21529c41d86bd541929b
SHA5125dce1f6d0645ba501640e368fec1ea8c102de6ef6531368a52012743f30a84753d7f1a03799ce62aecbfb524824b5832652014e6dfbfb7ac0062b7a9f6713325
-
Filesize
1.5MB
MD5af8660cf6cdcbfb153d1ea669b393c73
SHA1414da91f3d0f412bfc0693a8056d1f9131eac954
SHA256ddd2cdbcb77610698c19c992e68266f7373e44227e5e240a4913ec1c61adc17b
SHA512b5deb35513b368da9520fe51827af42141389da2c7f1f706309c3fad8b5f10358ab24cbb93a828ef2c16c05f07480122270b14d07f5e6338d53ab82126cd2fd7
-
Filesize
2.1MB
MD583021eeff52afe283a0ae3603cba9d91
SHA14c683753864b0a001df4c44ed7f97f456b19fb76
SHA256ba7d880627df50b4b82415d5e0fca15cb73f91191ec0fc1f89b4af041e3f6d76
SHA5129ddf134e364a9ae4f37b75900643012126b53adf4e9b877cea126d93855f19cf61e2c57d99df8554d5f63c6e7069943b450f60be150d2bc32c3c5a4fa610151a
-
Filesize
1.2MB
MD5f1de1cd691f44849949ede21aa0262d4
SHA1fcab44cc959f32655eee0f8fd9bb0259612cd8bf
SHA256e1051659c6aa0ca55ce6338d4fef8e3205e316de98bbda9eed1d3cb7abfddb0e
SHA512a8ac91ba70d793e09070fc09e2b24f17ddcccbc657de490be32295cdc83c94eabe6725435d520958d6750a47900ad552fde6ce24abaaacecc179bdc0fc9d771b
-
Filesize
1.7MB
MD5505d8e5162ef2a1f07f4337a0ee1c203
SHA10d91cd46b77976f4c8ab49f70624f645ecd122b6
SHA25620d083465a893d040ac8fef97f8c077e9712b77ccf8092e31cb2e1de628d3830
SHA51234628437019f125977c6076f33f8c3e66893e7e1c4dd6164d89cf8d956f2ffe702153c392c737dc5afb0c44a127af549f45cc9253d77ce9ea4f918d15c8e751f
-
Filesize
1.3MB
MD5821c4b4d6a00f5cd50a5ca0e513420cc
SHA16cb6b92025afb1ccf32273bc33766e1cdb384360
SHA256543bd900fe17cc0d8eeb337f91ceca3acf385cb905350f4458589677a5a2adc7
SHA512dae8f3bb79f031d191f48cd2d1d0f286573e8dbc710aac7d8e17602ac3ebf11fed283419481c9b690b2bbb4a41111864acd17d2f2a891d1017632c75fb92b69e
-
Filesize
1.2MB
MD59fd2d30be1e5aa6bb635cb6006f8cda8
SHA1e73e32d48f6d953cb44d53d39700a26465deffd0
SHA2566ebd77b18d621ecb6ed19821178802355756a6f7298c3de2c1c2e2a3d9df87f1
SHA512c157dac3672a1825d2489d72758487d46912e6ab2d73445bdc96ad061d3fd95c939faaa1a65fae8e7712e2999dca6951a6b59b0844321195c50fb8f03f3133a0
-
Filesize
1.2MB
MD5f09269007e3320a1bff8ff2af407ab6f
SHA1f5a511cc7250ea48105587d86596b21ff0c82fa6
SHA2562b9d17a88b4307b03bddb111827f781b0308831f08981a3e169a62fef196cf2b
SHA512cf47850d21e182a2f5bd546ac2028f7e0da53aaa21e90d628417f958371e0d0b5de2b975ac8034d0d0361b15a8309f0b18ed031d2260015be857c3ea0051f9e1
-
Filesize
1.6MB
MD507bad32fca37c8ace6d04158705f2750
SHA1411e08343d22215c14440da2ac1585d33cfcfffa
SHA256633c67d90329f5e3af3e89fd88d27eb62ffc050dd9762e1d7e42fcb69972321c
SHA512b869cac3b15a29928e66f593af53e0f6425bead6e14c0fa9617ba30f9b48f4e964f82757d1e0432e1f072f5e2df4c1972f2dc67d8296f1e5d55017198e801955
-
Filesize
1.6MB
MD507bad32fca37c8ace6d04158705f2750
SHA1411e08343d22215c14440da2ac1585d33cfcfffa
SHA256633c67d90329f5e3af3e89fd88d27eb62ffc050dd9762e1d7e42fcb69972321c
SHA512b869cac3b15a29928e66f593af53e0f6425bead6e14c0fa9617ba30f9b48f4e964f82757d1e0432e1f072f5e2df4c1972f2dc67d8296f1e5d55017198e801955
-
Filesize
1.3MB
MD5b8b3c2feb922f3f29a798a05fc896a2a
SHA1b7b4b27ec2011e82530838a8db9eeb9f207c0477
SHA256f97d4c775144759d5818e1d47d9c1911c3a4bc1a781e8bab2233a559b50da511
SHA5129e738be436281d5828493384f2936ecf83cd9da0da9cf5bc2d929bc39e00cf7ad86adfe14e48137eaea3b7632f7d9bdc38791bd7e817cf9300b6eac04a0de1b1
-
Filesize
1.4MB
MD539ec753b9a2054011737f8a2000b3de8
SHA1f541900af05aa9b900e10fab16d596b520af1332
SHA2567b798c4741e9d5a6bcfd92db4b01f076f08c6688e5c7e54272052ea642d0ce22
SHA512535c123b41867f281437e209c1fac2cfbcc17caaa14b116f4cff034c46daf537076dd67b4db3426622d6c3cee9a47d145f1dd28d2975647bde7b2db9579e8774
-
Filesize
1.8MB
MD5c9b3a4eea389e1bfd5f5fab06b5cf035
SHA1db46d25b95592d6b57c466b35a32e203f1fa4fa4
SHA256410e54cbe8b0c7c6a02b8c226bd18ccb29dec304af4a357a04611b58a72e43c3
SHA512a3f413ab622bdb88f2ac7fb6e6a7b0cbdc07c1ad2014b257ebf34a028e47a2160f6a5e5ff18416a6e8e5528669718402c29a1486339c5fb3b9c80cfcdf640249
-
Filesize
1.4MB
MD54d5f9984eacaf4892213a18932283c62
SHA14500987fc880278394b4b8222d89620f73e59f2e
SHA25680aeb4677e8a28277b9697e94efd03e2450e96ae6b3336d26213b1198e1af936
SHA51202ee2a81132116e47d91bce10072545bd17cab0e16419a5356547e619851be466555d7594981b8600e3e4643051c1a7efcbfe3ab8b85bd1c0f52fea9e0c00af1
-
Filesize
1.5MB
MD53d01378ce8cebb641c1e04583516e5fd
SHA1754ebbf9e2a6d70c4103d630c050a19ace22ad81
SHA256ed7ef41eaf939ff93e61c30d838a8d705a8d527b3b68aeece9ffb22102639378
SHA51234fa858e0000474583c05bbcedb5f6706c7cc0f26a47f69c345bc196a160bfe032342dbb8431fd7b3c8023c7584069c3df269cd41acab4aac9c33a63ffacb4dc
-
Filesize
2.0MB
MD5e26503c68ddf4dff0ee5b20aa9a452f0
SHA1d4dc273e44cce96984f7b3f8b5ec7e2c6640d161
SHA2560139bb1996294e481eefe8915c97bf936d168d634c87e7a4dc1ba10baef13d90
SHA5123b100c2fa40668e435ab80fb76e51bbfddd11bd505943792e4c5544678ba80518315cddb6882faec51286c80f5c2f47ab81830bd3da7d6b3980aad5165d95e6c
-
Filesize
1.3MB
MD5d043a31628b228aa56ca7339dba256de
SHA1c0613d81980208773c76b124903fb1ead6d2bb34
SHA25601aa82d766c227fb1d3f6117d9746f577c9b2e71b65cc46ec98f55c005cd57c9
SHA5125b5e2b6ff26ffbb65ec8888ddcb006c48384e4f9bfcca119c1aefeb73bf266fe21398a9a76b87b0959925cc6efc1f1d79717f0e26e053926f827394eb931de22
-
Filesize
1.4MB
MD581aa820c24afba489758f2b76d8e4480
SHA19d7ca6f776936322ac39466513a1c54ad02ed810
SHA256c70fd9e4df2893fc16674233996a44189908b72de98117b5eafb67c4e3d6d884
SHA5126e3c0add93231bef6f2e1e6f6e8a44973e758c7a3c88458d15e1ffc82b64e78c7f6eda73579a9ce81a69b3772eae5db6dfb097c3251ba58eda8eabf1b4a1f2d7
-
Filesize
1.2MB
MD5e18e691d9994b565e1c3a894538bf28b
SHA12bf6b1fda26ec631e93d8598201624a6e70b5fb6
SHA2569889c0398524fbb8532ea5d1d818b0beba60107030ef7185591c852cd19738b3
SHA51263a12162830db0059e20a6169f832480055a31f11673d5494feb098b376be5b4ace13b8210770fe8ed5d7d426f4c168fc5abd4f9c2292fd6cd76e977c5936e64
-
Filesize
1.3MB
MD572b490229c7b3cd6e28bfd0155c0e83c
SHA11f300c9000f68b7b9bacc08255daaf90b5f00029
SHA25607e57c3f8d8b9f847a57923cfc8de5bb0d92769faecc436e395783b110c8b3c7
SHA512bba3e3f242e4f4b16ac87d3ea36f8b615a2cc2b9dcc2b98887a3a4044202f5a24bd7767bf0050c82aecb3e16259b831ebf61404b282b2c0d17b184e75dacc1cb
-
Filesize
1.4MB
MD5fec4891a350c5a987824ecf0518f55c4
SHA1949dc2f9a432b8ee0418f24b9a5d857bb8610dfa
SHA256115370789257c6c4ec8075610c9fe92ea1adff733ede9b6961bb9af0d47e64fe
SHA5122e310885265670c392d0ff575de96be979d44ef3ccfa148c512ad4ac94ccd5a8bf1bc54b114e4a5eb1c606f747349873448fdaf4eb9d3b0a7e3c172f4bf3fe31
-
Filesize
2.1MB
MD5fde28d6ce3d12d74484b07d88e7cce8a
SHA174bf82e713af865ebdb34b4d9e88c7f5a9957636
SHA256de4013b7c9ca1be1a68b12e2b3240660a71a60354a0962a7436fc8d55505bb99
SHA5121f79f8836de2c3b3a6448c3a8bdb1293304278a33f22eca7873a8447fb55259c896e3b8f9871f5262057e75cd71cc6f770e20a1af069ad14fc0b3e6df83c8970
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.8MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
624KB
-
Filesize
1.4MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
1.6MB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB