Analysis

  • max time kernel
    64s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    15-05-2023 10:36

General

  • Target

    3.exe

  • Size

    855KB

  • MD5

    2616d8fe5d13f7a2c5f35428c4e76f0f

  • SHA1

    58ebeeb5b7dd11a8fd372e647c766eb294e2c802

  • SHA256

    36dcb265b7a10f3e1ccf2f51e28b7c086675ac2729e19075cf34cb59ba17105f

  • SHA512

    f5a88e15ec32392095c620b5e765ccb3ff9bac896146f6b226e3a012ab8d7c08e263fa4d3c3b55d1d8f4532cef849af1a9f32b3d492245c787e99cf53c953a4c

  • SSDEEP

    12288:j8ysS5ZKeMMOZ/g2cUOjoYIh5V0wmf2MhDHVb0V5fPTMXtg0mpEpo+g9cK8CD:5jKpejo1b0phDHVePj0mpEpo+4cOD

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3.exe
    "C:\Users\Admin\AppData\Local\Temp\3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Users\Admin\AppData\Local\Temp\3.exe
      "C:\Users\Admin\AppData\Local\Temp\3.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1908
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        3⤵
        • Accesses Microsoft Outlook profiles
        • outlook_office_path
        • outlook_win_path
        PID:1852

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1536-54-0x0000000000870000-0x000000000094C000-memory.dmp

    Filesize

    880KB

  • memory/1536-55-0x0000000004E00000-0x0000000004E40000-memory.dmp

    Filesize

    256KB

  • memory/1536-56-0x00000000002D0000-0x00000000002E2000-memory.dmp

    Filesize

    72KB

  • memory/1536-57-0x0000000004E00000-0x0000000004E40000-memory.dmp

    Filesize

    256KB

  • memory/1536-58-0x00000000002F0000-0x00000000002FA000-memory.dmp

    Filesize

    40KB

  • memory/1536-59-0x00000000048D0000-0x000000000497A000-memory.dmp

    Filesize

    680KB

  • memory/1536-60-0x00000000051E0000-0x0000000005256000-memory.dmp

    Filesize

    472KB

  • memory/1852-72-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/1852-77-0x00000000000D0000-0x0000000000136000-memory.dmp

    Filesize

    408KB

  • memory/1852-80-0x00000000008A0000-0x00000000008E0000-memory.dmp

    Filesize

    256KB

  • memory/1852-78-0x0000000000F90000-0x000000000104C000-memory.dmp

    Filesize

    752KB

  • memory/1852-75-0x00000000000D0000-0x0000000000136000-memory.dmp

    Filesize

    408KB

  • memory/1852-73-0x00000000000D0000-0x0000000000136000-memory.dmp

    Filesize

    408KB

  • memory/1852-71-0x00000000000D0000-0x0000000000136000-memory.dmp

    Filesize

    408KB

  • memory/1908-68-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/1908-61-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/1908-66-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/1908-62-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/1908-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1908-79-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/1908-63-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/1908-81-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB