blustealer | 65bcb96689030a956d477cd74e7c8ab7639e36240c1330de4b29e0c78029ce45

General

Target

RFQ# 6000263267.exe
Size

526KB
MD5

56c8f58ad43f6d3ceedcb459c984cbb0
SHA1

941132c99e72829e3d1447caaa938dc69599c00c
SHA256

71d546589ef99e38123b2fb807bb3e9b2ae88341c1d384e7603a6f867d57b87b
SHA512

a3673469158800abf217751360e39feed141623218275e049f8a3fe152497840f9e423f21e6a91e03e521afe5a8f11c8fb28a7daed38d9ff9273e8cb16d27532
SSDEEP

12288:PYZDn64onVzlCkdx0vbwvbzWLvdUuRvb7E1RBdDWCibbQ+:PYZAZXT0jyPCvb5HEJdKfbc+

Score

10^/10

blustealer collection stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Executes dropped EXE 2 IoCs

pid	Process
4540	qlcdh.exe
4720	qlcdh.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4540 set thread context of 4720	4540	qlcdh.exe	83
PID 4720 set thread context of 1092	4720	qlcdh.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4540	qlcdh.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4720	qlcdh.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 4540	1000	RFQ# 6000263267.exe	82
PID 1000 wrote to memory of 4540	1000	RFQ# 6000263267.exe	82
PID 1000 wrote to memory of 4540	1000	RFQ# 6000263267.exe	82
PID 4540 wrote to memory of 4720	4540	qlcdh.exe	83
PID 4540 wrote to memory of 4720	4540	qlcdh.exe	83
PID 4540 wrote to memory of 4720	4540	qlcdh.exe	83
PID 4540 wrote to memory of 4720	4540	qlcdh.exe	83
PID 4720 wrote to memory of 1092	4720	qlcdh.exe	84
PID 4720 wrote to memory of 1092	4720	qlcdh.exe	84
PID 4720 wrote to memory of 1092	4720	qlcdh.exe	84
PID 4720 wrote to memory of 1092	4720	qlcdh.exe	84
PID 4720 wrote to memory of 1092	4720	qlcdh.exe	84

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\RFQ# 6000263267.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ# 6000263267.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Users\Admin\AppData\Local\Temp\qlcdh.exe
  "C:\Users\Admin\AppData\Local\Temp\qlcdh.exe" C:\Users\Admin\AppData\Local\Temp\uyxiqi.gse
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Users\Admin\AppData\Local\Temp\qlcdh.exe
    "C:\Users\Admin\AppData\Local\Temp\qlcdh.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      4⤵
      Accesses Microsoft Outlook profiles
      outlook_office_path
      outlook_win_path
      PID:1092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qlcdh.exe

Filesize
103KB

MD5
297c0dbdbd58367b70427c8a97a2c7f8

SHA1
64f11000bed769c1d7caef3fb977a7f2a8c61a60

SHA256
6ee7360992738ffecd0dd2ee66489e435f56ad3ee8d4a0c752281302fa7d685b

SHA512
8218558fc9d317f14d05099a4fe409770c4d7c9d2c88bce7c30a546dd7f0b8f24fb46258fa945b0dca105196babb89106279a3454fc815d4e52de572332e82f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\qlcdh.exe

Filesize
103KB

MD5
297c0dbdbd58367b70427c8a97a2c7f8

SHA1
64f11000bed769c1d7caef3fb977a7f2a8c61a60

SHA256
6ee7360992738ffecd0dd2ee66489e435f56ad3ee8d4a0c752281302fa7d685b

SHA512
8218558fc9d317f14d05099a4fe409770c4d7c9d2c88bce7c30a546dd7f0b8f24fb46258fa945b0dca105196babb89106279a3454fc815d4e52de572332e82f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\qlcdh.exe

Filesize
103KB

MD5
297c0dbdbd58367b70427c8a97a2c7f8

SHA1
64f11000bed769c1d7caef3fb977a7f2a8c61a60

SHA256
6ee7360992738ffecd0dd2ee66489e435f56ad3ee8d4a0c752281302fa7d685b

SHA512
8218558fc9d317f14d05099a4fe409770c4d7c9d2c88bce7c30a546dd7f0b8f24fb46258fa945b0dca105196babb89106279a3454fc815d4e52de572332e82f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\qmzec.ato

Filesize
460KB

MD5
a80267a8e74cfccd1a993f037b00cee8

SHA1
f4c77c885a176803da22b740730e92255fc5ccf8

SHA256
2841683a44b448e25b19d510f53725c9c643b8e2964616d7a79aeeaa11b4f210

SHA512
26037aa4a5f623463c9c95f4fec92332c3fcdffc33516ff41011c04bd9d8264d1e4817c1a4a3aa6f45b71047dd554cd97aad728d1710865fba89d2df8c8d3b91

Download Submit
C:\Users\Admin\AppData\Local\Temp\uyxiqi.gse

Filesize
5KB

MD5
f4efe05c3bc2b0414148642570fdfdd0

SHA1
981f8baa739364dacf10876b7727a4fceaccea57

SHA256
9a4f93f219d672ed41564c7b9bc6c8218ee2f38de3e9cc1bc61b72e2bfb45b73

SHA512
1572d52452fc7643072bbbbfcde260860f6d8bdc31c6ea4ff710c19920a2dbd2ef3e6d266afe0244e275856cb85483e03d85e021800dfe036291d0d522ca55c9

Download Submit
memory/1092-149-0x0000000001100000-0x0000000001166000-memory.dmp

Filesize
408KB

Download
memory/1092-151-0x0000000005860000-0x00000000058FC000-memory.dmp

Filesize
624KB

Download
memory/1092-150-0x00000000030A0000-0x00000000030B0000-memory.dmp

Filesize
64KB

Download
memory/4720-154-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-168-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-145-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-153-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-141-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-164-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-165-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-166-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-167-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-148-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-169-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-170-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-171-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-172-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-173-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-174-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-175-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4720-176-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing