Analysis

  • max time kernel
    63s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    15-05-2023 12:49

General

  • Target

    Technical specification_Mexico quote.exe

  • Size

    855KB

  • MD5

    2616d8fe5d13f7a2c5f35428c4e76f0f

  • SHA1

    58ebeeb5b7dd11a8fd372e647c766eb294e2c802

  • SHA256

    36dcb265b7a10f3e1ccf2f51e28b7c086675ac2729e19075cf34cb59ba17105f

  • SHA512

    f5a88e15ec32392095c620b5e765ccb3ff9bac896146f6b226e3a012ab8d7c08e263fa4d3c3b55d1d8f4532cef849af1a9f32b3d492245c787e99cf53c953a4c

  • SSDEEP

    12288:j8ysS5ZKeMMOZ/g2cUOjoYIh5V0wmf2MhDHVb0V5fPTMXtg0mpEpo+g9cK8CD:5jKpejo1b0phDHVePj0mpEpo+4cOD

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Technical specification_Mexico quote.exe
    "C:\Users\Admin\AppData\Local\Temp\Technical specification_Mexico quote.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:816
    • C:\Users\Admin\AppData\Local\Temp\Technical specification_Mexico quote.exe
      "C:\Users\Admin\AppData\Local\Temp\Technical specification_Mexico quote.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:292
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        3⤵
        • Accesses Microsoft Outlook profiles
        • outlook_office_path
        • outlook_win_path
        PID:1740

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/292-62-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/292-80-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/292-71-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/292-68-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/292-66-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/292-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/292-63-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/292-61-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/816-59-0x00000000051E0000-0x000000000528A000-memory.dmp

    Filesize

    680KB

  • memory/816-60-0x0000000005670000-0x00000000056E6000-memory.dmp

    Filesize

    472KB

  • memory/816-54-0x00000000009F0000-0x0000000000ACC000-memory.dmp

    Filesize

    880KB

  • memory/816-58-0x00000000004B0000-0x00000000004BA000-memory.dmp

    Filesize

    40KB

  • memory/816-57-0x0000000004990000-0x00000000049D0000-memory.dmp

    Filesize

    256KB

  • memory/816-56-0x0000000000390000-0x00000000003A2000-memory.dmp

    Filesize

    72KB

  • memory/816-55-0x0000000004990000-0x00000000049D0000-memory.dmp

    Filesize

    256KB

  • memory/1740-72-0x0000000000090000-0x00000000000F6000-memory.dmp

    Filesize

    408KB

  • memory/1740-73-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/1740-74-0x0000000000090000-0x00000000000F6000-memory.dmp

    Filesize

    408KB

  • memory/1740-76-0x0000000000090000-0x00000000000F6000-memory.dmp

    Filesize

    408KB

  • memory/1740-78-0x0000000000090000-0x00000000000F6000-memory.dmp

    Filesize

    408KB

  • memory/1740-79-0x0000000000710000-0x00000000007CC000-memory.dmp

    Filesize

    752KB