Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
17-05-2023 01:49
General
-
Target
Request for Quotation.exe
-
Size
1.5MB
-
MD5
67683d83541b578498d12ddc5828260e
-
SHA1
679904b6c6101f399811885b42e98c4c8c564e6e
-
SHA256
9a3e3d21954d44054b67a726ecc1c6e54a231f4accc013fa91d0830ccf134680
-
SHA512
fb3080919598e0bedaa3b429e86f498bbbfcfb257a9c92dc9f6c197e2da9bd17328cc762bd97e7cbb770f0d6f1e8c8c05107a59f6204ce8ebc5ad4996e8e709b
-
SSDEEP
24576:sLOOmjfJ7uGyhgAzbOQ31ubRVTkK09CDg2bCaUwFDyfCTdNuuVIF/gwqb+:sG17uGmPOQ3oNVTkhC/bCaUwpy2wuV32
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 37 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD55ee234bad032e7f8e6b17859d215887b
SHA13d94e7e6f3aedbdc1af0798977ab4fc2d786b690
SHA2563d46771af3c7e2377b23961ae1bb53c8e8e831ef417f4028c51be469b1cd3cbe
SHA5125760796bb636dee817bfd940163afde3a778352a065b68b7571b4d9d442427d5d6f23627bf896ecd3e5d495fad829ada14d2a80d52edf509d64dd6ec7d0411be
-
Filesize
1.4MB
MD5a0fa31162b9e9c36ae12bf025dfd4107
SHA1a36e5b1f42b0d55e3f9894341b39cff8b339c596
SHA25650b80d6d93e01ff0c7c6bd9af269f1a0a87a81a9e74380813d5630a952da0c30
SHA5121b057e64ea9753b473a85464e090ab9b7da9c1de3b1af06cb1cbc87a047cdcabb6bdb53cdf82b2ef8b7581a3d375231a0d234e0a302e15a293168da568e001cb
-
Filesize
1.5MB
MD5833349f50a638c6c7ae7f0e546950c95
SHA10f902b3e6bfd11efbd6fc857bbfd268955abadb8
SHA256165139ebf1fcef1dd3d7d694abc7c79431b64c0f529a0ec3499a56c7a806df08
SHA5123bc2faa8bb65230870cc83424bafe74c10f7929d4675068943368ba62ebe4eaabe153eab9c719cc5952d7ab84b67cb4ce4e1c5b068477438b8d9c8c19c1fe017
-
Filesize
2.1MB
MD53f271f840310ac3ae75e11afef2d64ae
SHA1ba5779ec6fb2691cd941dad83c92db0bcd80b1ce
SHA256f114b671bde60225d8a33a6ecc7497d73c11e92a7e287c14d8ac73e74d144756
SHA512aecf5d499dccb8ece0d1f2bfd36a3b4b46ce6d7c80214a5b5757dd00102e2168b4cf90632bb78a7d3de121c640238fe6476e11b661a27fc0aa2355276966eae6
-
Filesize
1.2MB
MD55dc34f3a5ef5adf6889482ae45cf7329
SHA177d9c1f668ee74e588066e56d4cd32d1d43438b0
SHA2562c6439adc6f1f0936a9e97e64b79661dbf0d610bc27542b457185ffb7e30664d
SHA51242d6e2655807634348081f679d0e01a989f60a3b1bdce2f92cfc6d86ffed02e793de9718f66b72fbe2450d949076b07265b2001eac9949d417efa9dffd819f2c
-
Filesize
1.7MB
MD5f784cfb9c62c365c6fb161220dfb6f8b
SHA1eb52d1747508a7fdc8d683d57d77c5c066788ee0
SHA256ac12c5b616c1e8b31008aa887b1e522de531f486bb6d47a4670578ca3687d97f
SHA512abb70a94449e2dc047bf3dbbe4271109614d0e38492e71f46fe6a497e689f78e2960fe0563c552d9f9f8b1091fdb7cf64f64a99c39fe407b2586809bce5e13d2
-
Filesize
1.3MB
MD5243ff80e794b6dcc61e1d5780183b55c
SHA182266b9e7b0f98fecac79f77687ccb63610745ae
SHA256aacf5aff151cdffeaf3fac5b039c796f5160908fb49b08cc6aa5c1c751420ec2
SHA512d76d1ba86b8d05e826fc1e45ddd32ffee47c287dba7901cb0fe6c284f0aad372fd2eb41701f2bb86f7d22bf9e3178af52d138cbe2947ad34f6ef89e6075e6ba6
-
Filesize
1.2MB
MD51fcaebcd34fe0842e3aad9c540fb9b21
SHA116d098d3f49fa20743d8bdb0e235e023890807fa
SHA256d504f5c12af2c610fe4222dafe9dac7a2e28ab57d37c578f0e8c94e794536566
SHA5122a6138c9c3895e0cfb59d9ec91a278fa4144a67676e1386704149cd7b34d425944a110fffe27081684f57cd37d5766913a691046258c6a0430ec74d4dcde9396
-
Filesize
1.2MB
MD5b1f0c8b64b1b32a9067e5b82b426457c
SHA1cc78b14c5b8bb4bda0dd6a7a1d8ede2c3b962a4f
SHA256f28619338e90c6b2e40423e34a168e4521291d5bb657624824428b56a6cbfdb6
SHA512a8f9c3c99f979900d931676384b3b831f6b1ca00b9a0a30eacdec329ec067d154d74f708648e56fd24cd4be41b6e0c3c0a6275c1dba6d6d2dee5846aff5c1473
-
Filesize
1.6MB
MD587cbf7c34eb45fd9533f119c38583183
SHA1eeb37ba0abb332fed97c7574ced6a123fa267268
SHA2563e67aa5380193a9e99c608dc221e0ecd5340965d86ce993d3842c5342cc3a17c
SHA51244790a22a9c2256c1630007ddd2e9c22cd3ac5bb344859b39394542806355a931af62e22953f5b28108a1977c86d03d2739bc74a8bddf2e4184af8ae9f796498
-
Filesize
1.6MB
MD587cbf7c34eb45fd9533f119c38583183
SHA1eeb37ba0abb332fed97c7574ced6a123fa267268
SHA2563e67aa5380193a9e99c608dc221e0ecd5340965d86ce993d3842c5342cc3a17c
SHA51244790a22a9c2256c1630007ddd2e9c22cd3ac5bb344859b39394542806355a931af62e22953f5b28108a1977c86d03d2739bc74a8bddf2e4184af8ae9f796498
-
Filesize
1.3MB
MD5bb6ab40cb26d0b41e1f54e2472abdfdc
SHA1d1620bb2d3bad72abb9d662372e03f31709df857
SHA2568029cc1090b7eabcf7be83936e34fdc8f46d677904b6bcc47b4a0a4f2aa1e792
SHA512f86e8e4b7e00542aa5f5c55526e8641164c0c3974ce51bb938bc9365e249fa1ac1c2d0295d7dc4125c254dc99d7823a3b3eb8343a4162fe706fbe49dffa73ed3
-
Filesize
1.4MB
MD5b3bc59b267a1c65f78379f4fbcb07458
SHA13c8f7530019a983daaf97240f061f3dcc0a259b1
SHA25682bda3ff06f31fe792e82875cf902a05e4aad5ff42c02ee5fc55ab3da86b5821
SHA5123c0bdaeeb5b7f69d359b405674a5bafe1305a2ad4958d8868183ec1196ee0e4e84b73eb4b99f38e93003b4ec823e85814e41762b601dfc5a909bb36e7b9c3e86
-
Filesize
1.8MB
MD5f6348d53839035e9908b9ede7842682c
SHA1364834a9c2e7e6b535ee1cb1579f00c569aea5fd
SHA256978b427ad26833865f20b4eca49978fc95b14baadff675fc820e93f63609cd20
SHA512505ab1fc5c03857c341133995ba1b871f07728da327d848c82eb323034f3df27270511c5ad57db3e2520edfa63d32eb046d5e2352b7bfd251e5d21c5bc32f4d3
-
Filesize
1.4MB
MD5bced5f87c52bbc4787bc402a006e0659
SHA1b9cab60324485e7b7c7536e03aa97291a2cc6693
SHA2568c0136ca4ca07371a9318a354c48b529660bdf1bba912e0019b4ee071cedd998
SHA512f981a3496c33acbe171c04bca5eec46bf21061286e2b760a07d0b84af056437c067d87e755daaba08f38452c51b788ea56a860bcfbabb5011e859e42d213105e
-
Filesize
1.5MB
MD59be69674d3f9cd55aa216032e62c8141
SHA1389ba373f8e8a549fc67601e79b77ca062ef1dfb
SHA256b7763d7c509dbc80c5419d5d679622183d31d7a3174890894c30b4d791fd5562
SHA512b46dcb4fb51cdfdde867adf248fc394e41b64bd456de3f88063b3b0593a438841ea7cd1a1e08e1850bada48ba4a34fbb0505e819926dd8417808069a14c56f8b
-
Filesize
2.0MB
MD5adb7771417f373d1f9947766484c7417
SHA175d8593648f4b439f2774c3ab4508bf1badf671b
SHA2563305708b939511dd1a444acde352ab733014d3552b1294e6a82cd0977b78671c
SHA51235defb708c5b2b3efd7b37cfea297a9d19a303f7941cfab6ff1d52665a715633d7ce52e4c19d75ca987321e4868465113ea51153182538da32a7bb02ddebaba9
-
Filesize
1.3MB
MD583ce3d760b861c7b18619807e234e65e
SHA169d2fbcb0d3b98b1efda4ec4610ce51649e50e85
SHA256d29b48394f83a0c67f299d5990d151415899aefe68f811d5f4e75e748e1e8724
SHA512dfd6c64f43f48a74c817cb82be0385a6277e14b207b34fa972e8c238e8ad52f1eb694d2cc9f79a201fcc1f5487d89056c9ada142df5f423f29aada4c804cf974
-
Filesize
1.4MB
MD557dbe477c0e38ae5492ec086d612b94d
SHA1bf164f1c9b02a6948e2d79cdf08f413787546b45
SHA25682fe50d90a77fd99606bee5b3d93711d0190dc38ca1316621730e2037ccb882a
SHA5128357b58f9ac351f80c5efb149356a21c926bf9832bec32751ac4c6d4c7b8dd7966a925a654d6a107375a603cd71b93667d4fbee4c47b991f50aa4d41a00beecc
-
Filesize
1.2MB
MD581035bb21f6fa9b44227e7ca5a01a1e0
SHA11b60ba2b154fe383b4b5445630a73ce4541efc77
SHA25667cdce6e9ff5e8bbe05acdb1318790c9339dd47250ea18ee14783fcbeb574f2b
SHA512c590b49ed5c12f06950bc5320baa3142677013ffebf521319ac56b45af3523d0da45bb518eeb692eb8d1c70b39ffe19d208ee100d3007b0f63909a63cef0e484
-
Filesize
1.3MB
MD57b874e8eb3209e243e3701bb690e01b9
SHA1b9a016368987afe1b60fccb56ebaab2b334b6a17
SHA2560d53bd59537daca284922f0610520c790bca0a4ebfee1abea02643a19b725038
SHA51276be30408db99ef447c01a655b43786efea09e827620bab3d54d1d183b32eab15187e542343003f183b9a4e3e4fe8a7d850aa109a25f543d0d8a2edac969c73b
-
Filesize
1.4MB
MD5ed0a29fac353a3d78aae72fede8b9b45
SHA1ba92b2647d04d3f94502b68d8925c14ed3d6ffba
SHA256b8057dbcd92276803a7077fe5982f487f42d0f41feb30d31272e953789bf9613
SHA512f2fb35f8d69e9b616e9249f2046671353fc454eb24abe39e711e0cd9f081479569729931ed30752cc111aaee97cb0839fd2c98e9dc3df7fd62aec344fed153ec
-
Filesize
2.1MB
MD5be2b3a5d29f8b085c2a858f59292d866
SHA1c242d63fa8da9a49c9ab121f4d66ebfc7987c3c4
SHA256651bd036e6ddd9194087281c4c4cff84b8ac746dcc4b0242eeeb439527bc1b79
SHA5124f325abc7dafc7625797191b0c760fcfb26aea226c4c95641af66bf8727c0cdfdb53f83769f70e359a94728f46e73b432fb991240788aa07b75641d19a9e6fbb
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
1.5MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
408KB
-
Filesize
2.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.3MB
-
Filesize
1.9MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.4MB
-
Filesize
1.4MB