Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
17-05-2023 09:07
General
-
Target
Order-688930021178.exe
-
Size
1.4MB
-
MD5
539273fcc95bb7f4c80a9f2f606d74ec
-
SHA1
48e3f1b32bd1ea099bdfea58e00c25202a99633c
-
SHA256
12e44eb4bc1b8ddd19bb13f6794cfed8721e58ac3065d04c2ccb6a8a3ed30f49
-
SHA512
0994942133fc9dbbe7cbe2f21fe5dfc427508e3985ca8537b2b25104073e38040d7e632e4df0a7d285ef61893a3846123fa60179104d64dbd4cf22968ca99a6f
-
SSDEEP
24576:UhtPtftOfNmMvnYJJeT9zZm2ifn9fvt6quQyFyyHC2bP6nD:EtPVtymM/eeTFZm28xtxZabP6nD
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 37 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order-688930021178.exe"C:\Users\Admin\AppData\Local\Temp\Order-688930021178.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order-688930021178.exe"C:\Users\Admin\AppData\Local\Temp\Order-688930021178.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Order-688930021178.exe"C:\Users\Admin\AppData\Local\Temp\Order-688930021178.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 9002⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5825198bec33d3454ba7fdc68d92fde8a
SHA125c978b7c19d5d8782288e0b5478c6d4c0dcbabc
SHA256239cc9e1392678e230a49514ea60bad41da3189d8cdf3cdd346df04cfa969a1c
SHA51235f096637415886d9ebb9da0269faa224605e8e2950af4d6cac484954ecb5e8c433e1b547acec96bd18772fe536c7c12a349a6d50b71c99952df8d8034cce0ea
-
Filesize
1.4MB
MD5602ff2bb6db92bd63a8e1f2608ad15ec
SHA1c08dbd511938df231e78843fc6d399df44463399
SHA256ba60a906f44883f076bc25350d5d9c6887a24f2593168b55d68df69e406eec6c
SHA512accbc9e7de2a50ccf4b67635785ccb30aa076bcc9a1505a02ef127c5d88cd977083482e49b6f733eb5363d5544aeed7d8d5ecf4973bd2ff81b9a1e341cc1b8b7
-
Filesize
1.5MB
MD57b9c5c73c096c31180b8a9b2954d77f8
SHA17880b1731bbf634f6a3a0d5b777e192310cfbca3
SHA25666c2d24aab3857d361ca113977957304838beaf7966527163fda8cfc4c22453e
SHA5128b50c6c507e28bedd96b4d0b5155806198a867f8df4b6a1698ab351600e83c7c125f51b008b9846aaae2dc68c831d1018fa39d1650bccaa5ffef6910f84e4142
-
Filesize
2.1MB
MD549bbcd8ed06842c426298957ed7e7d7f
SHA1910fcedf1da091fd70f5ae902fe46ec66a70b25e
SHA2569128cc5b3d73614c5236ee7eaaf540e972987e35b72b9468f8e470c3d9b03b49
SHA5120a2c5c32ce00dd37a5def77f60bc39d998ea7f01bfea8559ad85709273303bbb91970b073985b1d40026bfedb89fbdb3b657a710df9ab985dd6a6af98098a386
-
Filesize
1.2MB
MD509564145836b3561d4b4513c9e60967a
SHA1515cafe345ddf862855036c78147bf73f8ee2866
SHA2564bf18962e6c5ca296793c2efe65300c0ab1864e0f079b579fd34bfd1a5205f09
SHA51219cbce492b11188797ca7ad68f9eb91199a2764668f68a92fb8d17a61713583e8738e2c75b56bea0f724f9710c23e0941516371660a1d5141005cf1ebf3f83b7
-
Filesize
1.7MB
MD5954e8d3e00eb667e03e6f709bd95888a
SHA15e1f31bedc474dec6fa34e2d4da0fae745a14ebd
SHA25697ccaa65cae4ffc29c8bb5d562a8c9b3df6f0d5c2fe72f820eeb803a35e11a26
SHA51277f2c5b9fcd620625e3cd0e7cf2789620f39b005551e8212c31611c1bfd56a7d93a767fda09bcc34d049249a7e2374dcfdde6ac4979ebb191fb4515b11dcf72e
-
Filesize
1.3MB
MD5ae5bd01712487424a40f3301db180093
SHA1c8fbbf1b68826a55e294c5a7d1814bf2b484d423
SHA256bc7dda4785fd21fd838ca510146ce2b2c44fb093cc9d00914f109c51f7315f56
SHA512fdd3b4c6aaaa62dc783593dcbc9190998c74782226ae174d308e5b325f4f706bc812c3e8d07eb59453e821f1a7806f5d91f6248401894b849b86866fb0c5730d
-
Filesize
1.2MB
MD530342d5f276e8b73d55754b2b0190dbe
SHA18842daf88b0ac000c2993e32d8ab967413ca4d51
SHA256029c1e3c46aa787d83107969baf089fa433f26346255c42cf444fbbe8d483914
SHA512c1ca70bdc8c1626321863b0ba9377cd9a1375bed10cbc358d081db76ff7613d2b9940177d3aa0b7a98a766fe005ae9f5534a1eab38f1475f56d2ac56a67be583
-
Filesize
1.2MB
MD592d5d1ebe531856827a55622b2b42a40
SHA160427e95f8d93963c1d8a606b911f8c7b33574a7
SHA25663a6254c27b4e3c46cc31dc9fac9e192c0f837cb94b72239788d838960baaac7
SHA51257142aae08cf209fb9ed0179d447e3cd3c875948a9cec7212f9ac23f2ac3a72ef55a7ef9de26b27ef6ff9e0f0e56c919c8673906a57066e32c34a9d6a63713d1
-
Filesize
1.6MB
MD5f556d11b1bbd0725ef0fe133b84b8b66
SHA1b1fdaec8d3cc28512b38a94400b54bf69a265bd6
SHA256ef64480535293358e91f77f1fcb9cbf34e76f6a5167bd44ebf0b061ec4843d29
SHA51294596ac4e64c5fe698182a9b66b8350be58e2a7f82d85537b488c5515c347aaf78188b90d25370325125167447f8471d31db0d1cafaebafd2bc47b450bec1936
-
Filesize
1.6MB
MD5f556d11b1bbd0725ef0fe133b84b8b66
SHA1b1fdaec8d3cc28512b38a94400b54bf69a265bd6
SHA256ef64480535293358e91f77f1fcb9cbf34e76f6a5167bd44ebf0b061ec4843d29
SHA51294596ac4e64c5fe698182a9b66b8350be58e2a7f82d85537b488c5515c347aaf78188b90d25370325125167447f8471d31db0d1cafaebafd2bc47b450bec1936
-
Filesize
1.3MB
MD50f1fc07b163eb28b1a63f8a2d24c03d0
SHA19a271bdd5d6653bcc302eac8676cbc9fc544bbd3
SHA256802672f1a9aa2f7943e93ca0c3dee919eb958dcd612a48bbbe42c18baa3a1caf
SHA5129711fb93e1347997d014c88541966ce804e8f127725ccd8b17c0c34eb115fe26c43f74bc97407e546c9d9e48f3fe671c6593d4276ce8e2d6cd1c3263b00a17a6
-
Filesize
1.4MB
MD55e30a0d9201f93af384ba167b39f02b9
SHA1e0728cdb4ab47470dc08e83f227c233efeafe4b9
SHA25652a1dbb3c8febb32165c607507f29c7143fb136d435cba557d50457c01d04ba2
SHA512db7f46b02251f0162a39fa0ebb7bae8c6a65b5212366c3467f898cb2c50be237f5f44ce791dbcc5adc66ac451ce4b0fd135db53f1b84441a9d6ab2ac483efd68
-
Filesize
1.8MB
MD53e208beeb1b8033060b9272f977ca434
SHA170183b9111b849e2b87f239043e9b067eea5db43
SHA256e45b9e84bdb71b326c11fa063e1a06173923144c5b7c358db99d937b9d3df779
SHA51235edf6b54147907883f83ad39f0b724dbd3b0fd20bb899989c33d44f08ace851c4fb4ceba409840aeb2a06dccec5acd54de7c21156e5d7a57343123c4f831f4b
-
Filesize
1.4MB
MD558c6771c6ada1e68dad74481011f9af3
SHA1ae58a74be7f2048d386c77e1a7fd419015e7cc04
SHA25631e08fd8cda010e3ff0886c00f003081de32594cb0d94d459505e053eb5d1ad5
SHA512683200349eafad9ec632cf6af8b8645215138e7deb1cf3eac9b0a4b76438e3336acaf1a5b68389cfa1153d40047f5dc83397628685928593ed90593fd9094133
-
Filesize
1.5MB
MD5ca3c159764c733c2ae415d34425a5170
SHA1baab395204e90821e13bc3d04d510749aed8464c
SHA2560fb4f0df6561c221cd86cc2fa042c141e66867f9945f3f9d6a3f340162c14b07
SHA5124252384d3eb3bd88bf90b68f8276c311dc573dda964ca52951131f3f61c40be350d84bd979ad3f14bb5c3423467bda153f5a7d4d023022111ccc443d598ffc0f
-
Filesize
2.0MB
MD5643f26a9fa9f8f509b94f9cf652bcea6
SHA15f5c7d2acbfd7b2a231f1258b187e9c93d6ea2bb
SHA2569edfa574c95750334d30427e1d2ae8e105d8d19cb8e8893f68e6162f46c5bfc0
SHA5120c7a51078282357dade34b58dec537dcf5452d26edee60fba9761cbdad836cb12f08ccb271425569a110f03e5d71c93a3a839a40740b02f80142219328348b4b
-
Filesize
1.3MB
MD57453bae7df09e58bf2b603af5c514656
SHA18600143c297bc3defc70b461187e696d4b626ed1
SHA256d332d87f8fe69ff0b6f23384cd9514225a4b13b739e61335e363a3024c2f88ba
SHA51275ecdf1bc426847384a559a672cdcc2faae3cae9267259be189c895358fa8140b9b7dfeac8d2bfe8daa74734474e96164f3e2657d217f15c30e67fe363d71fbb
-
Filesize
1.4MB
MD5b62411463457db0841cb3d93485da184
SHA1c6f0349255042132e9032c5c6b21818d6fdf4d00
SHA25626759a523f76980d13b512f10d362f39431ace3799b111da73593a7db7a925ac
SHA51243cb32f61e1f39f4c584f4313720ad156269ceec432c1a11f8310eb2ba05cecffb7d114472dec7bef9111aa93036f19d49182263df61b6b10fa1c0b95b14a604
-
Filesize
1.2MB
MD566b3b21b6071d416db8002623132f6b7
SHA14d477cf0e091b2a1400127b3833e6bd821a88b6a
SHA2565bc8178b59d2eef646316eb5175c6eadcdeecdaa8751f9b6b12204f44606fbbe
SHA512c7d83bb10d9f62e93c11ce54f000c4ea057991185af816b1f2c02cecb8e796900806d81b939c8cec5770dd6eff92848b0c2bd691f7e63a77fb818dcc08af0c4d
-
Filesize
1.3MB
MD5931fd5dd7ef20024e4b13212dd226e66
SHA1bb042c3764c48cb5e5baacf37fe47c05d2d52c66
SHA25663872cbe11c4e06da686c1b4791c711198c8c13763f46fc7fd31349d7850b43c
SHA5123e721cab3e6b510bae08bfa81d956ae3ac6b455cdb4a43b1aad2ba81f5860057d9b4b16ec9b646dc1c7f9c891f429c87945f19615350e41eec91c2bbef00651c
-
Filesize
1.4MB
MD5f60b6f54453a1a20a35a1a742157bf8e
SHA179d600c06288533b53269206f914c9a65be70ee8
SHA256a3901a4b088777eac1eda74b9d27772b6c1af450afa829cd096e5482f180d978
SHA512a7c8555cf5caa47298e39ce559bd31785770cc39443aa7c3349ade708ad08d08a8e8046837fdfc8c257c82f962a1e5fb2307547df9adbc39f3e5d51acaeabf82
-
Filesize
2.1MB
MD58905617185ae45bddd582a75603b8904
SHA195203d79fa04ef46832e2f01f18187d5b16f197e
SHA256aab51b060bd35ec87e707f50bdc4f69fe8322d002c9037869396dbe94d746ddd
SHA512dbccf89122c2f5be613312bac014bd8594ffe8e141c2c4af432e1944185d525a44addb07a0ab8c67e4ee588ac5fa4ff85d6870d449f58cde07b47326b1abe8fd
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.1MB
-
Filesize
408KB
-
Filesize
1.9MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.8MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
196KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.1MB
-
Filesize
2.3MB