blustealer | d0b801a4ea3be10c3cf2dfff06e2437c9d96e4cbe5be96483c00a4c10b27d2c5

General

Target

470621f5aef9787e21b629735c1a5f9f.exe
Size

1.3MB
MD5

470621f5aef9787e21b629735c1a5f9f
SHA1

be32079fc5d6662582685689c644322642073778
SHA256

d0b801a4ea3be10c3cf2dfff06e2437c9d96e4cbe5be96483c00a4c10b27d2c5
SHA512

9e321a30ae8d88c13f96033fd63a7a5bb78a35c2bb1edbe02c30109df518c07c54a72f29c3f11c9573943483ac2fb5e273d8ad2054e30458396b5de6f78c534c
SSDEEP

24576:P4S/d3rKzksfks2y8jIGReCFlolhhNxuNeG5Gm+8MN6ZNBZ:TKqYGRzlWoejmcN6ZNB

Score

10^/10

blustealer collection spyware stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
mail.sabaint.me
Port:
587
Username:
[email protected]
Password:
regina1983-

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral1/memory/2420-3-0x0000000000260000-0x0000000000272000-memory.dmp	CustAttr

Executes dropped EXE 1 IoCs

pid	Process
3024	PASSWORDSNET4.exe

Loads dropped DLL 1 IoCs

pid	Process
2764	470621f5aef9787e21b629735c1a5f9f.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe
Key opened	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe
Key opened	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2420 set thread context of 2764	2420	470621f5aef9787e21b629735c1a5f9f.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	PASSWORDSNET4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	PASSWORDSNET4.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2420	470621f5aef9787e21b629735c1a5f9f.exe
2420	470621f5aef9787e21b629735c1a5f9f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	470621f5aef9787e21b629735c1a5f9f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	470621f5aef9787e21b629735c1a5f9f.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2764	470621f5aef9787e21b629735c1a5f9f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2764	470621f5aef9787e21b629735c1a5f9f.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2612	2420	470621f5aef9787e21b629735c1a5f9f.exe	30
PID 2420 wrote to memory of 2612	2420	470621f5aef9787e21b629735c1a5f9f.exe	30
PID 2420 wrote to memory of 2612	2420	470621f5aef9787e21b629735c1a5f9f.exe	30
PID 2420 wrote to memory of 2612	2420	470621f5aef9787e21b629735c1a5f9f.exe	30
PID 2420 wrote to memory of 2508	2420	470621f5aef9787e21b629735c1a5f9f.exe	32
PID 2420 wrote to memory of 2508	2420	470621f5aef9787e21b629735c1a5f9f.exe	32
PID 2420 wrote to memory of 2508	2420	470621f5aef9787e21b629735c1a5f9f.exe	32
PID 2420 wrote to memory of 2508	2420	470621f5aef9787e21b629735c1a5f9f.exe	32
PID 2420 wrote to memory of 2764	2420	470621f5aef9787e21b629735c1a5f9f.exe	33
PID 2420 wrote to memory of 2764	2420	470621f5aef9787e21b629735c1a5f9f.exe	33
PID 2420 wrote to memory of 2764	2420	470621f5aef9787e21b629735c1a5f9f.exe	33
PID 2420 wrote to memory of 2764	2420	470621f5aef9787e21b629735c1a5f9f.exe	33
PID 2420 wrote to memory of 2764	2420	470621f5aef9787e21b629735c1a5f9f.exe	33
PID 2420 wrote to memory of 2764	2420	470621f5aef9787e21b629735c1a5f9f.exe	33
PID 2420 wrote to memory of 2764	2420	470621f5aef9787e21b629735c1a5f9f.exe	33
PID 2420 wrote to memory of 2764	2420	470621f5aef9787e21b629735c1a5f9f.exe	33
PID 2420 wrote to memory of 2764	2420	470621f5aef9787e21b629735c1a5f9f.exe	33
PID 2764 wrote to memory of 3024	2764	470621f5aef9787e21b629735c1a5f9f.exe	34
PID 2764 wrote to memory of 3024	2764	470621f5aef9787e21b629735c1a5f9f.exe	34
PID 2764 wrote to memory of 3024	2764	470621f5aef9787e21b629735c1a5f9f.exe	34
PID 2764 wrote to memory of 3024	2764	470621f5aef9787e21b629735c1a5f9f.exe	34

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe

C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe
"C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eVSwXOCV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEBA6.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe
  "C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe"
  2⤵
  PID:2508
- C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe
  "C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - outlook_office_path
    - outlook_win_path
    PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEBA6.tmp

Filesize
1KB

MD5
8ded816b9ca44395d733f5cfc60df1e8

SHA1
07e16a98959d8b2de3965d773f78cffe431468d7

SHA256
05f5728997bb596061f1676803309d442ae9189b624ff6af1bac67d2dbf9e59f

SHA512
ac4d192cef0f4d9b01552ea7eea74503e4609aa0b1c919b510e35eae6bc8c7b21b5826ee29cddd610ca6bf490e10e182412ba8c47885d83bd11d75d285346898

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\0QZF5S~1.ZIP

Filesize
122KB

MD5
37ac88bc53abcc353b3a93f68fb30871

SHA1
f5165c03b5de33db3704d502227bac35eae1c6c5

SHA256
7bc03158a3c0bcb001093d9d40eaf6b9a7adf14e685db68fbd9d0f135d447ebe

SHA512
01c65cbf90c2db90d0563d4a45650d4abd19e1a90bb8467f0e5a57ff1c6c377e3be8216f3324b81af58822b75a22b52f7317df985c11f3a7a45b72843134fc38

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\DJLAPDMX_Admin.zip

Filesize
400B

MD5
f4b697cdc931fedb91f40d77625780f2

SHA1
7e91abf4ca294fb80ee7d34ea6af569af4f8b91a

SHA256
2516ecbb5a7635442f0abfcd17480b943bdef9338970bd3989171fa635e0d441

SHA512
6a12939a691b1d648665f829823e85a6f96607300ba96a412a1693d84df79faa06fce34fb390807361ed0fc45e5dcf7ab229e8d7ff8ba0b9d506f952c87589ec

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\DJLAPDMX_Admin.zip

Filesize
24B

MD5
98a833e15d18697e8e56cdafb0642647

SHA1
e5f94d969899646a3d4635f28a7cd9dd69705887

SHA256
ff006c86b5ec033fe3cafd759bf75be00e50c375c75157e99c0c5d39c96a2a6c

SHA512
c6f9a09d9707b770dbc10d47c4d9b949f4ebf5f030b5ef8c511b635c32d418ad25d72eee5d7ed02a96aeb8bf2c85491ca1aa0e4336d242793c886ed1bcdd910b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\credentials.txt

Filesize
311B

MD5
db5700972f1118dc1a565288bc476977

SHA1
4fc84184de0220825efc72fccd000c99af8cc080

SHA256
86bfd9009f3e99eb1c6d64cda0758304f238acb54749ac8906a57f7e15dd580b

SHA512
28743ff261dc8012e5b11a242f81b70415bc8be543f4b62ece008455b9dfa4549dff3b1a8465ee1ea091087223e9415b2421fd69f82b700f9cd7b7382de9865c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe

Filesize
156KB

MD5
0c3c728a9b4376e014bc97f7b1da74f0

SHA1
de2253d0c3e02ea9d27ae6f46082cec9d0164a02

SHA256
05f0ac30ce02bc3608d957b40896240ae750da01393f4e26a8951fc7987959ca

SHA512
f610ae81854bc99086f139833b7d16b7e7634f53ef1125dc97d01611ec46c262e1f87dde31aa47a19e17a81334c4f25b4096d8e255460e3446bf45d656f5f81c

Download Submit
memory/2420-3-0x0000000000260000-0x0000000000272000-memory.dmp

Filesize
72KB

Download
memory/2420-6-0x0000000000500000-0x0000000000538000-memory.dmp

Filesize
224KB

Download
memory/2420-5-0x0000000005600000-0x00000000056A4000-memory.dmp

Filesize
656KB

Download
memory/2420-4-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/2420-22-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/2420-2-0x0000000004F00000-0x0000000004F40000-memory.dmp

Filesize
256KB

Download
memory/2420-1-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/2420-0-0x0000000000E20000-0x0000000000F6A000-memory.dmp

Filesize
1.3MB

Download
memory/2764-18-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2764-20-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2764-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2764-104-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2764-14-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2764-109-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/2764-13-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2764-12-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2764-129-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/3024-96-0x00000000001A0000-0x00000000001CE000-memory.dmp

Filesize
184KB

Download
memory/3024-97-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/3024-98-0x000000001B490000-0x000000001B510000-memory.dmp

Filesize
512KB

Download
memory/3024-103-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads