blustealer | 0e1a62a6d3c082384e1fe0957ac7fa8734c5a52e47c20717ca19c46681ed7c04

General

Target

3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe
Size

1.0MB
MD5

962b447996d774bd6b11a221ab39bd8f
SHA1

aae4d7117ce9f6c493ed6f7c4d41cbc7c4f805f6
SHA256

3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4
SHA512

23fbaf09f2e267883ed3e7db9c5f6f1512d2d2ca1ac097b23c3fb7183c7991e7c6b1397448ea996a1d24be6b16b3cc2a4b2d70fdb7c23249918d48923535df8e
SSDEEP

24576:8GFKCcW9RoTHfzW/ZOaXxLvppk/suw0kIrhDhq12N3nCAIQ9:8G8CcW9RoT/a/YahLR2/9Yeh220A

Score

10^/10

blustealer collection stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot6120911772:AAEvnEDbWRlbIuD1NP8MtmiY3tQ46T9SQyo/sendMessage?chat_id=6082430866

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2624 set thread context of 2728	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	34
PID 2728 set thread context of 1492	2728	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2528	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2312	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2728	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2312	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	30
PID 2624 wrote to memory of 2312	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	30
PID 2624 wrote to memory of 2312	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	30
PID 2624 wrote to memory of 2312	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	30
PID 2624 wrote to memory of 2528	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	32
PID 2624 wrote to memory of 2528	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	32
PID 2624 wrote to memory of 2528	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	32
PID 2624 wrote to memory of 2528	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	32
PID 2624 wrote to memory of 2728	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	34
PID 2624 wrote to memory of 2728	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	34
PID 2624 wrote to memory of 2728	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	34
PID 2624 wrote to memory of 2728	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	34
PID 2624 wrote to memory of 2728	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	34
PID 2624 wrote to memory of 2728	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	34
PID 2624 wrote to memory of 2728	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	34
PID 2624 wrote to memory of 2728	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	34
PID 2624 wrote to memory of 2728	2624	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	34
PID 2728 wrote to memory of 1492	2728	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	35
PID 2728 wrote to memory of 1492	2728	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	35
PID 2728 wrote to memory of 1492	2728	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	35
PID 2728 wrote to memory of 1492	2728	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	35
PID 2728 wrote to memory of 1492	2728	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	35
PID 2728 wrote to memory of 1492	2728	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	35
PID 2728 wrote to memory of 1492	2728	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	35
PID 2728 wrote to memory of 1492	2728	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	35
PID 2728 wrote to memory of 1492	2728	3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe	35

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe
"C:\Users\Admin\AppData\Local\Temp\3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RnylxoqUaifuRI.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RnylxoqUaifuRI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCBD.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe
  "C:\Users\Admin\AppData\Local\Temp\3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCBD.tmp

Filesize
1KB

MD5
c8686bf996da167533bc11f149dbc87a

SHA1
b53a8cbcf719c8eb0e02e5a80c7d7fe2e71f8e3e

SHA256
84bc4c2ea38f7d5eee15da1401f204ed32aa5109e148fc7c63d8f83a035c132e

SHA512
7d60f071b49c8a7f806a964daaeaf84fcf618c27731c7a7bf17126135c5905bae895112b04e619274e7b5a5893b46c33dac38365095591ca672c8a1c6befa13d

Download Submit
memory/1492-92-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1492-98-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/1492-96-0x0000000004FB0000-0x0000000004FF0000-memory.dmp

Filesize
256KB

Download
memory/1492-95-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/1492-94-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1492-88-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1492-90-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1492-97-0x0000000004390000-0x000000000444C000-memory.dmp

Filesize
752KB

Download
memory/1492-89-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2312-83-0x000000006EF90000-0x000000006F53B000-memory.dmp

Filesize
5.7MB

Download
memory/2312-87-0x000000006EF90000-0x000000006F53B000-memory.dmp

Filesize
5.7MB

Download
memory/2312-86-0x0000000002550000-0x0000000002590000-memory.dmp

Filesize
256KB

Download
memory/2312-85-0x0000000002550000-0x0000000002590000-memory.dmp

Filesize
256KB

Download
memory/2312-84-0x000000006EF90000-0x000000006F53B000-memory.dmp

Filesize
5.7MB

Download
memory/2624-61-0x0000000005780000-0x000000000582E000-memory.dmp

Filesize
696KB

Download
memory/2624-60-0x00000000004D0000-0x00000000004DA000-memory.dmp

Filesize
40KB

Download
memory/2624-78-0x0000000074920000-0x000000007500E000-memory.dmp

Filesize
6.9MB

Download
memory/2624-55-0x0000000074920000-0x000000007500E000-memory.dmp

Filesize
6.9MB

Download
memory/2624-56-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

Filesize
256KB

Download
memory/2624-57-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/2624-58-0x0000000074920000-0x000000007500E000-memory.dmp

Filesize
6.9MB

Download
memory/2624-59-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

Filesize
256KB

Download
memory/2624-54-0x0000000001080000-0x0000000001192000-memory.dmp

Filesize
1.1MB

Download
memory/2728-73-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2728-67-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2728-68-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2728-69-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2728-77-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2728-75-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2728-99-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads