Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
18-05-2023 22:08
General
-
Target
Urgent-Order.exe
-
Size
1.4MB
-
MD5
1dab5e05ac3651db47b6f881dab8dd3e
-
SHA1
66c37ab30dc83b3519815b2406cc6dd332e4d91b
-
SHA256
b445018afa2dee3bda17e65e52a7a3c143b0ae31abd00d26f58a4fa3319dd523
-
SHA512
dd31a50b54385b3c1917e6eb17e7970c2fd97ec481c297865d7f37c7f2ea137ed8b60a131e7de5a7eee2278f5d26951c9da0be4e2babb00582993fb1cf8b4472
-
SSDEEP
24576:t9j0kMtM5Gcc59B40fuI3At9NzS1f8iGiEKjOWVQbHnERMJaICUQqi+4P8mHMC9i:7MOqu0fpAt9NzAEi7XxsERNB5PRsYo
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Urgent-Order.exe"C:\Users\Admin\AppData\Local\Temp\Urgent-Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Urgent-Order.exe"C:\Users\Admin\AppData\Local\Temp\Urgent-Order.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD51576972ad714be1fd6fb468ff91cc4e1
SHA1ef6d7c5a2eb7ae0191272e00c59c823a288f7727
SHA256f53e435c6fe25be2afc843f4afbc06145a3377716609095b7aae3ff060941283
SHA5121e55c2273dbcf3407449e061afc6022e0f20f0cf0860e277885485ee07c4e37b276e956ff4789c4abf93ba779d36a440bd02d3eb55e4c0d00c3e4d90d0ed15c5
-
Filesize
1.4MB
MD521dbfea2d1dc8d958dc711e360536da0
SHA1e1eaa5bd58e1327dd84b4c6a2015cd5e1c164de7
SHA25639147addb45f1cb9fa9240fcc0e04a9469be7f4898c2c19cdcf9bff90abe253b
SHA5123142395df98ff650c77a6928dcfdadd20148b17ee5e7563f465d9329127eb1d6f3b3491377df2a2e4a268b234e143467ff407e393b3dd6114d43c179271c3d27
-
Filesize
1.5MB
MD5db9b57163942dd3f390e3ace76db076e
SHA1df7781403031386bdf59db3b11c051e5bf167f02
SHA2561595d983eb47a71dc4d5e1abbecd5d0537bdc52b229350169b0f06b40b975108
SHA51212e40069e5eab62a4522542efd89147421e54d8c0d55628563dff9033b3243a99b51fad8cb80b344c8b543c8794ab94768f2dd6864849c49f318eb84b445eb62
-
Filesize
2.1MB
MD58233c1f838784e6c6a605be20b22000f
SHA1435bd38f375da70f424e0d7ea013a64f4bfff7b5
SHA25610b85fb4939b7a656849aa30229277bbc342b3c8c541b2f719a5dce8d53a7a92
SHA512e7cb9aa3e399911be3a09e9970ad8decc0c412a665e0040fe994a0c0ccb6b540280e97079bd841bd24e83775da1c1e951e42dcc854ccde73768bae3cd02aa8d5
-
Filesize
1.2MB
MD513d7bae297962a0258d29c3827e1aff0
SHA145481bfa4b334eed14d21387210e062bfc97c4ae
SHA25669ab6b04b40fa09655d6bf504a5a66e7dda39d62dfa52236d30a0996927cb065
SHA5120bda0dca5a5689a665312a3024cdeefbf8a5769758de09ff4d9f7fcd50b75062ef770a1492777c36ac14ff03655894eab89ae01bbd52bf7bbf0228c9210f7cb6
-
Filesize
1.7MB
MD5592fd73e9ee4eca5838d91debcf4f2bf
SHA1844d9abc4314f691a7297303fd2557e0b69da039
SHA2566927757a0e210925ef25bf24f88a38fa7b8054e6c16f56980f594086ede043e7
SHA512ef03e5354b70f8644a97a245b682aee1ef81fefead15008afeb6f0cc14681ea402c45cc80f7d67d7474bc0bf5bd05163bbb73d3d06397049df43d7dc6e7e5819
-
Filesize
1.3MB
MD5c269709fdc26298aab40de8b4ecac906
SHA1195b8809a284be6cef39ab24ac6b994d2fa54946
SHA256cd0885eafe656361eb25e98ae050f81da0a1334b510ab36800bae2379247fc98
SHA51223e5c0651f033a120300a8be9c7c701add1a612554b9aa567a9c06b11a4fc74d7647e5197f7f04210a8b286672de28635ebeab379b386819da0a53e2d9e4dbd1
-
Filesize
1.2MB
MD53b2621b0bc61634a1391a9d82659fd3a
SHA10ca7f167a4ccf2925fa99d37cd06984efb12dcae
SHA256c2597dd71e579b3598212e68148e7abc13c160fd46d21e379736f4768cb8cf36
SHA512afa33699e2e92d346d3863e2d67b430a5d65950bee3b40323bca7aa21cc994af20d72d3abe1a8e8ee42aa6e815e596f6ca5817bd6b4c39d41f7faa1335899045
-
Filesize
1.2MB
MD57f733cfb64273df8b8ab2cd1f512e585
SHA13bb60081c41347ac1b13bde49b571aca5ab4797a
SHA256cd5b4cd1bfa679d1640471a35f872597fb91c490b34cde0f8580a09791f013e4
SHA51246e47c09719d46562fee1a1884dc0ebd75cc95dfa77e30356099dda63a303d26819879e0a4f987c4f46561940f5cf03e185072cb9c7fa3c9475f1934906be0ee
-
Filesize
1.6MB
MD5ce6d86d847b48223666e7d04d096d77e
SHA17a54bfeff9c121674704660472ef79e1c9af158c
SHA2567feba68d710152888ad463cb260c5393c2c21ad6645a3cd9e542b21916da1983
SHA512ddfc04a1d52ad1efe1d7f6f75f84c9b4944b341298f4a27a1bacdf1fbe920ce1e1b4f6e10c85535a8bd452512de7bf34d93bf2326e9dda91972c7be10a04d1b7
-
Filesize
1.6MB
MD5ce6d86d847b48223666e7d04d096d77e
SHA17a54bfeff9c121674704660472ef79e1c9af158c
SHA2567feba68d710152888ad463cb260c5393c2c21ad6645a3cd9e542b21916da1983
SHA512ddfc04a1d52ad1efe1d7f6f75f84c9b4944b341298f4a27a1bacdf1fbe920ce1e1b4f6e10c85535a8bd452512de7bf34d93bf2326e9dda91972c7be10a04d1b7
-
Filesize
1.3MB
MD5e44789eb7b25f9690ab4f9afdbd23569
SHA1e7bb51fbe34d483781c8b58fdd523f9fbd470bfa
SHA25611544359f33359c5a1bc0407908184345ccb39819ecaefca421e95394e5e57b3
SHA51226a6de59321959133f918f4d8afca06b51cf9f57e54e772f71c3e55e024caa29a5667f3ca33d3c7e4c67c7e74f1e0ed9148f19565a91128f81f59d1315216cda
-
Filesize
1.4MB
MD5fffe51bb69f975b6be113b74320ef60e
SHA1ca297999877d27580327a5aad15923ffda91052f
SHA256f9d70d6dec709592878cb401f2c7e5d745eea09589fbd6f44b10e78fd7913117
SHA512c16c4071df8a480c859d97f6317745a21e23c128f52136609193f6b0c365cc68a468c1de8fa0938cf4a08748b2e39cc9a499f7535b0f3d4b7e5943a08fe4da26
-
Filesize
1.8MB
MD54db30445974ced188439a9652537a73f
SHA1dc89f005c64fba60fcce03dd707b98fbfdeb908c
SHA256d07dca6bfe7313a7a46a01b47f8668f3fd568afd91702762c68573b121971998
SHA5122a592baafd266354b8dd696958e0f40283d1633867a8dcad358fba8188727985f7adeb1478ae54cf9537dada9e75cda58adb57cffa851de1ca4b6e8410d31864
-
Filesize
1.4MB
MD5b719de5e1de96ba88ddd426ffcb82129
SHA170094a04e53698678ce7023b6b2d2bfe5a2b646c
SHA25672a502d61887b2a82a8d57761e110fd400a2d65a5fc276f2f00b1eb60e55cce6
SHA512aab9c65a2c1efeafe1cc229dffd23da9081db6237e403f5d923691e4ab177996dc4571e632ed82b066c42481bff845b868db4d152b092bf9b43ebe1eb055c894
-
Filesize
1.5MB
MD55fb61ffeb46a47f8a9025a43e9469581
SHA1a173cee45e7aff1fdcc1251c1ab218bdd78be01d
SHA256eccbd7770b4bc39e5356a21379b35e0ffab14eae766f64d919a46604b8e7322c
SHA512612028e127c9b9f5097ed45be42f08f39ea93c963b11f450e7718d88c61fcbbd84b12acc7e0b22b4576e0c7cca6e6f751579004d17c714c4c91703c6b7682c1d
-
Filesize
2.0MB
MD50d1a418c5b3515b11dc92400dcf12b8e
SHA134fefcde0945953a8257feb95789be9dc291bcc9
SHA2563b9811ac3333e80569cedde7a454d8cba6046945d7288d2975ea9851391f59e7
SHA512815ebb3a7dbd42d643f3c70e2e39f930cf42fee456017fa730f6592254d00a10023091d547e3f5dc0b64d841e16d5e9cee26ff1403393374237451aed68e2e57
-
Filesize
1.3MB
MD54f3f779a00c11670ed4f530aec84543d
SHA1a4e6b365df7d3b45d0cf354636f7e0945f53df0a
SHA2563581fabeb1131548432b35981d976a83d99fc9b288e6ea17073a6c8b55e5e5f5
SHA5123a824d631834ab476ebd4a9ad5b7b8cbce125fd9bacb1fc50f62c363b254c8e753e67fc398dbaf748e756c32a03f34516d5ca658fd97d20c349d07cb019170a8
-
Filesize
1.4MB
MD555e308aa3e35d085dd8da69eb640e435
SHA1c92e50b8d6831775c0d1e659458b8384f87fbe0c
SHA2569cac4a237c70233b2d5cea0536c1ac86638e07b13df6f271740ca7233c45d4ff
SHA512baa64aaab7336e8294ceb5a0ed05a3234c8e862dcef920b2b38619ea79deb0152783610e9ecce20b9cc7ef326fbdd174bf5f7fc9648f135036ce859612b00f8d
-
Filesize
1.2MB
MD56bcb99a5d2b18aca8cfa62a45ddad673
SHA1ef34824bbee53cd4c6a2d58c16fe414dedc8775b
SHA2566ccf4ffa2095ede415dc4cb5e7b0ec321dfd15668fc4ee23a8939bf9aedcf5d6
SHA512ab25351bd0201cae1722a4f3b959478d56e6f622e2e955e2240424556ccbee9fdd9406bfc9d26631137f753def5ccf1bc4ec4189b8bf0f6d65a536cc960d251c
-
Filesize
1.3MB
MD5f8f3e3e87d604a8f78ca813401d8e063
SHA1eb9ffce6fbc8f107e2b72cf62e1eeaeafcbff881
SHA2564cac1ca29110196bb0083701f5abffc1b2770fd200cc62cfbff1c9cd5f9c9f0b
SHA5125be7788e61d79a92d2e662fae9078c18bf0a61b4b51ba21eaf36c394b5185d0b26ad5188cb064f3d3f931545fefc65325798dc06aa449c79bbdc157b85c596da
-
Filesize
1.4MB
MD50e5fe48af1d217a14bbb26053dc1a0bb
SHA1f4d38537c57ffb06273956a5584fd0797fac10f4
SHA256ef257f55b0dad65c94ac8d3bad357e2371104763852c163ffac3a8e22f157f9d
SHA51227b20cbc88fed3a8fb7a945541c5b5aef4a74bbfe2f29f8f546d600ed6bc55359731f6f9a8156ad164e38f62de74b0ed3913ea5500135f7575c747f3d3b6dfe0
-
Filesize
2.1MB
MD5d85ca35c710e36cb3a423f546309ec37
SHA16b4c77ff2cc557912e7c442f25e6edc5f207f927
SHA256162fce2b2b011173a1ccfe4624fa33e0c4749ab3467e19e21522b3ed5128f88b
SHA512ca8c2cefdf2515d20c0867776b1783f73f1dc70a5609ae52ef22c579b570e95341da611f37f9a4f7c14e25ec0b6648e86b79d4fa76225f38ee97ef8a8e578061
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
408KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
5.6MB
-
Filesize
1.4MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
2.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.8MB