Analysis
-
max time kernel
50s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 02:29
General
-
Target
0bb1c29f4a8c046e798cd9781cc127a7.exe
-
Size
876KB
-
MD5
0bb1c29f4a8c046e798cd9781cc127a7
-
SHA1
bbad89c8d04b20f63d36014f00ded3818e595a53
-
SHA256
139b8756b01add9dcac07d3a0137b0ea49a932fc4804ad0eca63ffc2958eda72
-
SHA512
4b439bd85c725f104be24956525a6ae1a16dba28fe254695cbd667933d0cce2225e9a0f934ef17e1f5ef65ac033aa6ed72d016e3bed0bf270dd3d1eef12de63f
-
SSDEEP
12288:+nkguFRskuUAlWC/44toU73kJiIWK4vV9BrFZsk1q1/1Yah2UKbnltqvTmDcN:0kEkuUAlV46zbk6K6VVZsuSYgF+qvH
Malware Config
Extracted
blustealer
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
[email protected] - Password:
@@@@@@
Signatures
-
A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
BluStealer
A Modular information stealer written in Visual Basic.
-
A310logger Executable 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bb1c29f4a8c046e798cd9781cc127a7.exe"C:\Users\Admin\AppData\Local\Temp\0bb1c29f4a8c046e798cd9781cc127a7.exe"1⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JacGDBJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2584.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\0bb1c29f4a8c046e798cd9781cc127a7.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24B
MD598a833e15d18697e8e56cdafb0642647
SHA1e5f94d969899646a3d4635f28a7cd9dd69705887
SHA256ff006c86b5ec033fe3cafd759bf75be00e50c375c75157e99c0c5d39c96a2a6c
SHA512c6f9a09d9707b770dbc10d47c4d9b949f4ebf5f030b5ef8c511b635c32d418ad25d72eee5d7ed02a96aeb8bf2c85491ca1aa0e4336d242793c886ed1bcdd910b
-
Filesize
3.7MB
MD558c176860e5fd80830f83e1327aedf6e
SHA1db73217a964c27a3cb6b60cf950b19a7c8ca4199
SHA256734be1e3625b6795aa0125996dda01264ba09b8cfe81bcf8ee58587ea16e4f57
SHA512b46f6cc81fca0992e9e3e99d7ae220dc01193073be3bd9d0b15ebe176379da54fc0dfdc7c7b2da76d5d5ae053d4568fe56ca96416c4bcbef2d26ee0ac8deaff3
-
Filesize
18KB
MD515f28d2da355b46aac95f16968b9d26a
SHA15382e5ab1e2baf6ec8ca4231cd78b5acc8b124f7
SHA256fcfa6468cff03836d2aabc43bd17efa7dbcdd276fafbbbca92b32672fe86c9ec
SHA512fbdcd157c3d731979abbb352bcda590b66036b688ae171a1e8e11d1b2aad71612beff2505b22b4dce4fc85bd358bdf70f2953beb2c9a719fe93b9afbe175eb60
-
Filesize
11KB
MD54a8fbd593a733fc669169d614021185b
SHA1166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA256714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
SHA5126b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b
-
Filesize
46KB
MD5c5d81c4d42dbb3fa076f803cb2e629e5
SHA1b9785c3dd1c74a384abf0546d4711ea50dbd48d2
SHA256e4c0931304ead1184d1a04e0898b9e2d50716f3130578be0e37bbabdbb3ad9b1
SHA512667a16cf83e996fd61835986f2d3494f6778f15a60c0cfaa641090a697c449440ee7457946639089af168ef04462cf6679a09a9c18133cd84439099f6aef1b5d
-
Filesize
11KB
MD5bfbc1a403197ac8cfc95638c2da2cf0e
SHA1634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA256272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
SHA512b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1
-
Filesize
13KB
MD591300b76ee60c9f235d90e95fadac3d5
SHA12f7040a435560b6cffb2120d2f6ee4a19f9cf275
SHA256e2933e1b7e5c268393a6d2752637a3f9aa694b37d6d0ce94490e18d0a5dced1f
SHA5128df6e18585d8f9bafd81f47777036cbe338729cad0e264200f831ee296a44b9bfac33800503fefbe6aede81a91ca00ecc6a557d1ede3abd653f7dc31e9701be0
-
Filesize
11KB
MD53b068f508d40eb8258ff0b0592ca1f9c
SHA159ac025c3256e9c6c86165082974fe791ff9833a
SHA25607db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
SHA512e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32
-
Filesize
11KB
MD587cbab2a743fb7e0625cc332c9aac537
SHA150f858caa7f4ac3a93cf141a5d15b4edeb447ee7
SHA25657e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023
SHA5126b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa
-
Filesize
15KB
MD56e0f56005f4b540bcbc1e062326c5b12
SHA1f6af0da73d8659cff8468e30dfbe3b345b2b25a2
SHA256a4b91781bc28fe99832fe17ebd67e720225c7ee5fd8f789593ef34c5b3eed846
SHA512328e99f174adb5346de400d3e581b26d0aaf5e042dc75dc048b389df049920e637aa3ecd545f5a267562508e6cf303ce585ec2336709796752824cafe77aff50
-
Filesize
53KB
MD58e247ee4a5ad26e808ad76a8f65ea1c9
SHA14bcd3462dd28b4703ca078be8dc63151e3b235bb
SHA256bf226e2098d459e5158507c6c1b9fe45e4882331f2fc06221842ce0292c2e3c9
SHA512919a9f794534c663f801abad4df0256b697f8f9727e29677e0563fb0de1956903a91e1e372811a133b607e7f9afc79ea36899b0fcb446dbccc42ab74359d2a34
-
Filesize
691B
MD5055c857272026583a61e1b5821c69a24
SHA1ec39d34f16487682801dd2b319554cbed57feca4
SHA256190db16bb64995e3bdea04b9e6fc1994dacfea3253a7559732205b1d41362b84
SHA512d7833c4651683e95959107e05b07b60d2e963b9fbecd0106b329e2087d1dfc9aedb962b334e22b6b462699cbce86097d4d50ce5d1310ad098e3531efaa4e204b
-
Filesize
712KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
760KB
-
Filesize
7.7MB
-
Filesize
904KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
456KB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB