Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
19-05-2023 10:36
General
-
Target
PI-12042023-02.exe
-
Size
1.4MB
-
MD5
00ec65f5667134941484ca7ef40ef167
-
SHA1
e2aa6f59e21c3d69fe09e036a0db32249739874a
-
SHA256
e0e677d03d49bc27c8575e7f2a4816aaf10cea4d624671292cce7e2eeec67497
-
SHA512
d4f09ab5aa9fe5f5ea4429c6dba4e45d3021ffd512148df900bfdcfb3d91c28ce9cf7638f18e857fe913bffac573db70586d6261474813b4baadf4831bf949f9
-
SSDEEP
24576:X4Ze+gp1yI/aLxE5HY9qzZyQ9HHgefs+LbeFgEC/fGKhQ8mI5EKq:7G1E5HGqzMCg3geEXGk+K
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 37 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PI-12042023-02.exe"C:\Users\Admin\AppData\Local\Temp\PI-12042023-02.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PI-12042023-02.exe"C:\Users\Admin\AppData\Local\Temp\PI-12042023-02.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PI-12042023-02.exe"C:\Users\Admin\AppData\Local\Temp\PI-12042023-02.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD595d5aca1a0291e172e53ae1a2c1fe16e
SHA116e1bc38f5c0d86d7f782b3ad46843df3b99fe9f
SHA256c25928ee83dc09f7aaea6dd16e1d09892570b4eb5820e4984e7acd5779829b9a
SHA51281f7c8f2c10a75410335e7630ddb418791d5758fba51f3e93edd9c0f80017d26288b077542b1996b63d2b08e582141e0b475176e2f826451e5f155aa47776279
-
Filesize
1.4MB
MD5047a3cc16d05c04aa30f2322f4262076
SHA1e1e61675063b0244cb1b601d9be72627c6d1e30e
SHA256ffc91435f11a9591691db2345cbd06326f312071ec29dd34c99e3238fc57bb83
SHA51231bb27abf514bb90b3dadf74117535cbc1cdd9e3b27855f211d71d4f3f9ba2d03e00af4a07bf093b0128436a161f582bd7752bbff4c37b622b4c03384b77cae1
-
Filesize
1.5MB
MD592bfa33a7505d141f074e67786506547
SHA15990c1312f2df0c787cc41e35ff6bca5492fe804
SHA256a609b9cb54417dcf9ff72c480fed56fb8ddadfcf1a495888a895a5a02c8d4318
SHA512eacea3c77477cdb707a41a789eefd83d86c150858126286843bbdc0f8264502863bb7e9ac266303103fedad1a97aad7ede9b072c3fad17f918cc41484187d3ab
-
Filesize
2.1MB
MD579000d010c4086721c4eb952d4439ad3
SHA147fd371d631c53aefdeb10f1f06076773577f649
SHA256e0150ba98a9d5c5d4f91a646cb28da2eae72e21c0da86f9547c73c141391acfb
SHA512cd8d3bc78f55802e294d46f18dac64da6086c4711dff7990876c2882d3ad05d1ee0fa362d4871c9bc36df0c701c3eaa1fa6103a2466f8839259dd1af616992cc
-
Filesize
1.2MB
MD5dc8def472623c7fff78a9dc2e633b461
SHA17686dd4e16493f148c41ddbdf52f1161d434269a
SHA25609f6a65f91840619153b9d84dc421c1fa606f10b8807d2eb93c89ebb4164d19a
SHA51233e8574c48de6dc9ff32eafad177d5a72c9b573d0f41cd76950a0a357496008cd1f3a43b1ed99c5d765be5a212f08fdd99c42a41c046cf5ee6cedf7e7f6bd37a
-
Filesize
1.7MB
MD54428e282a2876b1d99d61772e7c60c94
SHA1a3aac7f705bbef11a3b21dd3897147d74af9572d
SHA25622048e7cf61f3c6d050427f3dfb7bf8c0da709cb28b8a8d0f395863be29265aa
SHA51296650d7299106a537f7cfd1b648da4269f5615b81f42a5d493a6dceac5e723978a8ee2323b642ce8c139ff604d62107e6cb73c3f93f1a42a59741840d0e87463
-
Filesize
1.3MB
MD51b22cf6a5d3ee6c420053e10336f4a48
SHA1eab3d71ccd8fa6f14d1b22055d5cbf0ae69b2d58
SHA256febb88756ae3c668c501ce2a1d10e22febc4b65209e40dcf5feaf130caa3b7e9
SHA512811e4aa5d33e06ffa9077f28850e79a72c05eac9583952316709c4bf02c6e5abe471acc9f81beb16d01f7db711441ae5bb537d46139681910221ae8da821c162
-
Filesize
1.2MB
MD56dc04ef294154ca791ea0920f786ce1c
SHA11368d93df91e36fe1d5d5bb18b6ccbf8488ca01c
SHA2561a178aa53a0d5849034f180c847f6cbdc3f6cda42ea3a8d950af80a08b3e9a24
SHA5123329c3bb138054cb17e24433d441612ed9355cb889dc782dda45ed25151d965159d2947041e2e0cb3fb0ed4a72875091aa6ac4a23c08906f2234cfa63c42a2f1
-
Filesize
1.2MB
MD5560fef8978bc25a15996c4123d7cfee0
SHA12232b9a7853b294188062839b3b8533af0d24303
SHA2562981b8599eb564aebcfd9927b8b50adbea6b62df3b2f3b4ed668c742fedcee7d
SHA5128df5079fed1f8f44ea38135048fb6b62728869e85a0ac186ac5a0ae91b612700c6b909f07d41bf863ad130c483680380bf35d23b04b901f73642ed7168eb1947
-
Filesize
1.6MB
MD5e5ec4752066823eb2d1d631438acc0ea
SHA102dd36bf7b407686ab21a1fe32f66ee9ed86a2a7
SHA25619d41586b0522bc28c778c44863c57c93a15ef9fabeef47004920f1db401fdd5
SHA512cf7c0508c96e582d2c592e9049323bb70f91bf42a2477e7f0b91f051c15d489374d27f74384790f5f5679fee3bac90b3c7c5d0d4820ac367373b27fad47d4619
-
Filesize
1.6MB
MD5e5ec4752066823eb2d1d631438acc0ea
SHA102dd36bf7b407686ab21a1fe32f66ee9ed86a2a7
SHA25619d41586b0522bc28c778c44863c57c93a15ef9fabeef47004920f1db401fdd5
SHA512cf7c0508c96e582d2c592e9049323bb70f91bf42a2477e7f0b91f051c15d489374d27f74384790f5f5679fee3bac90b3c7c5d0d4820ac367373b27fad47d4619
-
Filesize
1.3MB
MD5764e0e95806e4a4ee0723f845b070c19
SHA14ab808ff3d7d167db299ae7d95576e27d1be70fc
SHA2568a5439ad0d0a72aa807100b403a2976563647c3680e6048ab2ba74911c074b3e
SHA512e29f2309a4ed7ce9438f7fbae6345dfbf80f88c49f46145f74a69f1a1253d5559a79cdc4ec9908a2e33cf4340b813b657de15d784b5802758a08e8d53a26c3df
-
Filesize
1.4MB
MD5b5b9c3f739faafb3028be79b9b4cfa42
SHA137ae9f54ded45b1d01d22688f0cdcc0ed1091613
SHA256e0857d1d6c7377222bf4b551d8dc5c60a28df5a7dde08bb2fdd808d750872672
SHA512b3e3cb771a036cd1e5a4a4736cb0aa5a37360157b4a72bf6cf542f7d7cdc9e36e6fd579befc108ed81a8bc3f415f2958da8e496e17c127d138ab487a20995611
-
Filesize
1.8MB
MD59b79d4c1fe1df0f29db33c4b74604ad8
SHA134915fcf98e43580f8ea37e10956dc1c18f8d6af
SHA256f30d4e7392f54f61a9d1e601230f7f6c516010604d081dbf85201a439eaeaea6
SHA51204054aaba1532a62e1d077e77d305bf27487af27bb083c713c85b5cf89d05f6aac0551d4b45ec7fe995385df55c58621c5aa7177114c2ee5b599e5f0b6bd01d0
-
Filesize
1.4MB
MD55e2bd65d3405fdb9d641948beb79eea2
SHA181ec9bb33fdebe6da7af26545e4e9ee54fe221d1
SHA2564e7486ed7463eccc7d791bf02ccf5d321e35d8527c560064471eddfe911a5ae4
SHA5120a13b9cf5540a066595ba580b65bc5e7f7d0765fd7d7f824e55fe7772f8896f3d68d93ccdca9a6420b9805a8e98badfd868f787a431a0c1690502697277be3ef
-
Filesize
1.5MB
MD526c8223e3d1fda1213249c3c9ce68c49
SHA132244be384b5ef536c711f532e34ed847861924b
SHA2566bd61eb5d641db9915866eb08b6644041b9250749834984c4ccc41526bc9dab2
SHA512ec905b1d1f1b41ca8cd7948a43bbfdab8d317ee96f889b9ef563b0f251a9c4af72d438023104b95fcd3e8990cc3ada569db0e7a97384a66a992d57890e790b05
-
Filesize
2.0MB
MD53bd9bbf551281a6878c9a2be64e7c6a0
SHA1cbd6829e2fc4a15ba7666c28f11c7cae149b9fe2
SHA256b0bdc804d4320abdf59f2cd54fb917dba500bb4f53564a10dfae7ae9034a80e9
SHA512e79e3ce18bf37be9caade4e6cce04610eccb9a580b4b4a54b6034a946b18b34504fb83b4bcc69c6bce5857c0f8e92520fe9091b0de275fc76184a396bc084a37
-
Filesize
1.3MB
MD5c6f3d79d331366b6d7a51bcf4f71abe3
SHA1b3c0f8fe7bab394bbb39bce41046a101055e472b
SHA25664ac8529b0dbd130690213a76853658ccedc49a5bd234b884a6c7f525af1cc54
SHA512459781576049f65f5e9fcc2463dc67132b5801c1d71aa952e54e07cafad1cc4e9683cbe43241e3e01a9e1b36e9da27e1b5d68a0f94fe81dd453ce34234d3c284
-
Filesize
1.4MB
MD560ec672dbc613fb5bbe48b08ddc7476d
SHA10738d85264d5daa3366003058da4a115c8195e2f
SHA2561ee2ddf8adba617ba2049466006271ab4a51bc9f7332bcfece888d2856c6ba89
SHA51270c3b92c7b75307672578f4aaee61e33eeefb52accddec56f92df4e740557256e72fdb7e476467dd721763664faf28d317983bdd01dd05f81edcc4844f693ab9
-
Filesize
1.2MB
MD569d899f23da693070632f4f2d3859900
SHA1a992a817ac73969f92242de688712f1cecb098df
SHA256ea57e700637804632f301d20dbac9767b241ca9ddebfcd1164d67d2a5121daed
SHA512d807da3c23d85f297c24d7c48d74770146ee3ca92de462676236972a1bdef96b7ef6ef84669e16e4791e880d2bdac9a63ec11bcde6f1044a8635cff0d491e9e8
-
Filesize
1.3MB
MD54de0ceb4a382834fca659180ef9b3caa
SHA116fd4d7d0ffcfc657683b77d267610eb033c55ca
SHA2566a5968c64f8286cfe37c14f49d45912f8e1e5b8c3a6434519f83b02137d1a2f4
SHA51239c1796eea828df7e38e9b10fc0e5318a7dd5a087176091269045888a2bf61a44dbfa0eacc720edeaa5db363d0d7591d8ecdfefac0996e69f33a76f172177a83
-
Filesize
1.4MB
MD5cc22490bd66c7c6495a4daec9cf51ac5
SHA109518a01c4b8981ee7fb8187805d03540d389ce4
SHA2568c3c30fcf5364d15555b6c3dd2e2ce4f81a3e294e34e3f7cd755d2b953a1d1fe
SHA51271c471fa51ac10fbd5f3850bae0c5d741e68b35b2ea8b428cc53aaf2c12b53afdfea51e3763df965ef0ba26d6fc62207ceda0c3d7df45016a3a51f80588d845e
-
Filesize
2.1MB
MD5208eaa03ff7eec5f2c666ef81e489801
SHA10d7e6070bfc38a7d24f9cb24c4273fbb5ab665bc
SHA2565c1125486c152f4f7a9acf8c4a629a9bb60d620d45d366f6c7c3c4df745a518b
SHA51287a4c909158c2d4fd9853169e30bc6001db8418a6fb8b5d7e45dc7d74656635373915684cd72efcfad9bc0107f4703526ea19ddc91ea5ab6b8650d7d29bfa5fe
-
Filesize
2.0MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.9MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB