Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
16-05-2023 08:29
General
-
Target
Order-688930021178.exe
-
Size
1.4MB
-
MD5
bd064f5b67dcb30de45b19e11d424f53
-
SHA1
cfe03d52e6af08c9ad2d7c7f3b7afbd4d7e5794d
-
SHA256
9d603074042f5d594bc2710ed1545ce7648f35ea0ad789ed1ffbfa2d294faf55
-
SHA512
20a2b6c6bcddaa77f5a5b7dee4d1a6bc14eeae093cdd5b20cdf2567606f3253d48cf60463f6aa380bf43d541733cbb06543fd21ce271821311057e250c886cb8
-
SSDEEP
24576:+JDy73Le60VNu1ZtGYNitrP7DVvIiK7vog0soXrmiSyqDG2whTfrO:+U7q60VNu1ZtZ4tr7DVGog0sovnq2zO
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order-688930021178.exe"C:\Users\Admin\AppData\Local\Temp\Order-688930021178.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order-688930021178.exe"C:\Users\Admin\AppData\Local\Temp\Order-688930021178.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD52b6506a0a8365729f6efec1d3ec25467
SHA1aac2980f8c9593836bfd07c9f96d5852cd30e7cc
SHA25672e87e79a9a6ee1caee6fdf3d78adeb6ecb28916f24714f4cacb795b10aeb2de
SHA512f398ab334068b50fd14109f892f73229317eb99ca7ff38c68cd45c32925f58a98fe3d824fac8784d2469746167aa24f5487a6ddbcff35afc0bdfca7e39e2fe60
-
Filesize
1.4MB
MD5422d76f25968d1420e47c42dd1ddebbc
SHA1c914f1b622b50218d8227dfe9429eb0bace0b668
SHA2562a4d39bc3d6ef798cb6f8f541ba6e6edf1d3963f438b6608132043d885e0a80e
SHA512c35dd71c7294044f4e24c30e1ab3c3643cd8e2595a8323381df4fc38de085a5f2efb096fadf0178c55cdf846584a2d17003a4c5f3cd25e7ab0b9233b01ebb0ea
-
Filesize
1.5MB
MD52fe82d413c1a967de5106f6aad00c7a2
SHA1b5a190c19063905d20d62120e67c717059ae334b
SHA2566fe7238195017b316c85f7936ce51dc2a0471398d9cf5817ab45def6aa1ed181
SHA5124cd0c65c775d772dcfaa46d60a601394e390a66b7e513c9f5b3a71c03e6b42f2b5a0d6f0f2ae2fd949b8e37131aa3e29bb745d5b5cf5c05ace296548e86f4856
-
Filesize
2.1MB
MD5cabf09a10c492cb8217f31be58ac2c3f
SHA169e05d854581097c27795ea9505ca3c4eb665867
SHA256d007553b54baf1c992dea590be7999079acbe3bb87de34964c3a4bf091fee3dc
SHA512613e6e136ef385b9636a0cc2a2ca2097a3caf2db6996579cb694d382c891c734847661f891508551d4e62f3d866d1e282518ed1f933c95f8dcbe57dcfe92a3ea
-
Filesize
1.2MB
MD53ea582fe2f868fa0faa3bd6ee5adbec2
SHA1f9f8e4d4a7e0729fe66699e4bb06e73609601e08
SHA2567c08f77598070ad0478f9032671c09f55d7d05b8d6c46798df8d50680c5204c6
SHA5127ca3f7fb6cb383f36d4b2b2b908c2ca2f52c6abca57beb6432521c67d439abec44ab99c68b2d70d01e7c1a637722f15f453e8cbde3718abcf1f97f3844b1013a
-
Filesize
1.7MB
MD59d6673604c59da287f1cd3ec32b17270
SHA14a797cce8c19dabc04544741151346b0197be689
SHA256b36fb21c480fa6e044f1360c948999e3d1069e80e73a742a26adc59fc33c8779
SHA5128e43cfa44087c80944c829e13b0a3ef68b6d0305c81bcdb27200ddd67eb9b8d9b1068e59047ea3f353bbca10ea811d4254eb8f847eac96b56c16daa2936da92b
-
Filesize
1.3MB
MD5c1a73a766e16e3b572bc9a461a5fbe18
SHA1a7fb505577249c8b7f4ada3ce688c9e61640830c
SHA2568e09b597f38dd1e360427c0bebee3d75ac4c96c427015f9cda52eb9f2a65f652
SHA51269f46e302348cfe5f6ded3013c274a1aab91fdaa0f8cc5acb08d12392ca792bdcf9540268473f798c305c7dd809528f3e9fd2898275b2d044178985292af16d8
-
Filesize
1.2MB
MD581266f39fcacfd60bf7c4a4af48037cd
SHA11319b6ce493b736eb9f2e19f0b313124f5a1d427
SHA2564bd39101c391ce0a534eb2c3aa023d5d148421dc8bf8c591186634a1042f0ec6
SHA5125e091cb9631d333c35d52410e66eb6b23e24e3b36662c215eb1c844c824f6d43798a20dd1c5d35b64a8267c20f431df6f53ad376b2689a7dc00c23727f896796
-
Filesize
1.2MB
MD5c620256c8c1c58b5ccc914387cb137d3
SHA19030599e9abe3641a4ffe09bfd23b27282fc37d1
SHA2565e47d00b00d9f449dc96357c36354c7adadf18cac7caf44c2b09f8ebf65cbd42
SHA5124455d9f5c21dce4d485da37664cbde0a5ddcca38ceedff4bc23f79e480c10c9dae406c62600847f8d6ccff7e07f56ca06577e6d23558eadc9a09aceed61b2d77
-
Filesize
1.6MB
MD584fd21d0a1fd2f2f809d53d2db7880df
SHA1afddf2b51f7befb71268cc04e1b448948e1165f2
SHA2561e193d08a7950178329ca0a9cc153b393ef64daf87573e411fc4ac6142e1ba7f
SHA512efe3b9068510bae5fc5a5ec4544431290bc8841c5910e7967dd369bb218566210bf43b56758778dc18df9174533767661148c68317255f6e0ac8c3632f92d9ca
-
Filesize
1.6MB
MD584fd21d0a1fd2f2f809d53d2db7880df
SHA1afddf2b51f7befb71268cc04e1b448948e1165f2
SHA2561e193d08a7950178329ca0a9cc153b393ef64daf87573e411fc4ac6142e1ba7f
SHA512efe3b9068510bae5fc5a5ec4544431290bc8841c5910e7967dd369bb218566210bf43b56758778dc18df9174533767661148c68317255f6e0ac8c3632f92d9ca
-
Filesize
1.3MB
MD52d125bd4738cc542d8da5fbb3c34b166
SHA14b43ef72dc2682501ae5953d4407515add843dcd
SHA256ab4013ea6301bfe18b13fb2c6d59b2b21a203777bb743dd1ab5bbe231c1007f2
SHA512370549b61563616fb53ceb59ac09852af4ae8d2cce532dea2cc3899bc6d54f49df7202df4906fd1a4ced3f3ae0eb98ed06ed6b8a6181244626dd675fbd1aa639
-
Filesize
1.4MB
MD5607d8ee801c7983caa0b68d7d4bb9c45
SHA10c97a2ec79a9f2da98ae20920f84410a6de4f454
SHA256d151146a842b230af672f51b87c7c48ff2b1d23a3f06d5167d40aae7c2c8a060
SHA51294c67c182d86027c051827040ead462f4da7a1d46af95e8935c5e2d00b8335c76375e637697afd29c4c1044cfc4016b5962e1a6c8d5c36673b0ef641f6e770fc
-
Filesize
1.8MB
MD560eb0263342bad442bdf986d0a26c639
SHA148fc963ab16c9786d528f8d6848149e154d58113
SHA2561fde861e1a3c0c7a691eac49d6a48ba7e14232be8eb6ed60cfe0d0a0187c8d5d
SHA51241757a49ac64b41a1a3ad1ed4153a0f9c3dcff70139a19dc32168bf73c9e57fbec2e9c3364b116368a115f012872dcb88b3ffb8b7cd429af7c23caaa4e14372c
-
Filesize
1.4MB
MD5a5c03e832a0be2c5e3d15ef37f065385
SHA1a36a61721f60af4cc3935af92fd33bbe4ca17301
SHA256cbbe2aef793bcacced6babf2138a2827a7cf03799b7503193c90c5ad877ca3cc
SHA512906f1a87c9db6d61198db21bead74ed7c1aee6fe44399f004392f37918ffb38fe3d98beb58a0afd0ce856a91e4c665aa67d9e1c23521192617fb824b0ca13b6a
-
Filesize
1.5MB
MD571f7e0c7fcfb92db546edd0b2b517823
SHA1605a6ee2cbaf698c8cade5aa10fc619d21a4ce0e
SHA256a21b0bc964f090c5fd1b14cd05efa947223f0813a8708dccc1ecccb6fc417dee
SHA512fb89f36bd1111554549c0c74e1bf2b3b46f05efd433257b68225ac1eca2663e87c17889b1dd5698be7ec3a96eb0bf4af0ae5d8196179f4f22d8d3c169066e562
-
Filesize
2.0MB
MD59ac06a0f72f468184cf74e08c3674534
SHA113fe9d4c2c1d4eab9d05855864c84daceec78207
SHA256f6c05d4f81d98846bbb30357d057e739a0f87d9fb5c7b6cedd082c91590d8bfd
SHA512977dfd9413e3101296a76b74f15883da5383eb05457ed468dbd24b4b55228e9d673c1b8bbd37c9679e4e53acdf5d1a5ab74ecf7f24de0f6d74810e2c86559729
-
Filesize
1.3MB
MD54ad44ea237054eee966f66d3b98f15e7
SHA1450923d7321ac59fcbe631f6f3d0c0358f255b0c
SHA2564f49cd43a1375fa20a08a098420747baadc190042c4746f8ba5603e0dd658be4
SHA5127f2bef393950348bde451f075330a010cfb160b23a024bda1f63a53288f5f9b03c66b572d828ab87fbba16a3679d92a4e88123ec4f853d17f448959c8eaa9aa1
-
Filesize
1.4MB
MD55352f18c8787eef494b81236f0d65d91
SHA19ca90dffcdaacaaca2857ad993cef43b9ce4e9c5
SHA256ad160cd31cead132c18234952f2cdd446d8bbe85ca5fb21797bd41ad42307433
SHA512c4de302239698a34dd93a3003fe1f67d3f39dc8a02ca2ed474cf8100034a4fff4529621e9c1e6249f9ba243fed64fa93131a9176b463fbddc3eb1f6ee7c4a9ac
-
Filesize
1.2MB
MD561ed98fe9478afd8c7baca13497d4f3e
SHA13ac5a754c739d4a51c0ab1228301cf4de2117ff4
SHA256c6c0a51748db8d61e0be2cada68182079ae47683138f2d70ef85677ca06f8ce4
SHA512d99cfe7e65d01431be0cc81f5f974f0bba0c596cdcdd3485c0d05c481a08b8f5e58a01fa298c9a643243aa6e47ae2a85201ef97826bfaae6a190148466bece28
-
Filesize
1.3MB
MD53b916c831415b514b304ac677ed91a72
SHA1f8f5c540a835939f4c9cd12090eab421fbd5501f
SHA25633440faf869597f39516663afa1e197e15fb3167047491b5022b20d382c912e2
SHA512fb784187738119648d9e1950f50f87d21490978faaafa95d100e425304ad34df0119f55f1d6e1fc606da650a57f85804580f3da01814901749726095f5b605ab
-
Filesize
1.4MB
MD58173e265b58d52e01d6da16bb7676eab
SHA12581b5e079d5ec31d4e3cd0b7c6a69af5f188a2f
SHA256e624460cfc98be3d6d7236a7da59ca68cc999dde9196749b677d88146922052d
SHA5122049577099d00acd6f7689c0223666bed873095cf491a355d3fe9de86b92e0a8915bdbae4eeecc46ad396290357e5b040352c48d1c4fec4dc8c394db5a117c86
-
Filesize
2.1MB
MD5b9952d33135e3f4af9d0fafe418d9359
SHA163ca3d95dc37ba9f45bda822d0686e60aaf7c69f
SHA256b96d5fedba69c627389516299bb1a2e0c234dbd67a3c82a000199376d2ae96de
SHA5120603dfc64af14f8ba09d66ea82da8c3de453c5eddef0641a27127b768e07f682d16721784644bae129e786b5b0fc84ba8cb8da7124ac609b60540b3e47f51d2f
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
408KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.8MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
5.6MB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.3MB
-
Filesize
1.4MB
-
Filesize
1.4MB