blustealer | d0b801a4ea3be10c3cf2dfff06e2437c9d96e4cbe5be96483c00a4c10b27d2c5

General

Target

470621f5aef9787e21b629735c1a5f9f.exe
Size

1.3MB
MD5

470621f5aef9787e21b629735c1a5f9f
SHA1

be32079fc5d6662582685689c644322642073778
SHA256

d0b801a4ea3be10c3cf2dfff06e2437c9d96e4cbe5be96483c00a4c10b27d2c5
SHA512

9e321a30ae8d88c13f96033fd63a7a5bb78a35c2bb1edbe02c30109df518c07c54a72f29c3f11c9573943483ac2fb5e273d8ad2054e30458396b5de6f78c534c
SSDEEP

24576:P4S/d3rKzksfks2y8jIGReCFlolhhNxuNeG5Gm+8MN6ZNBZ:TKqYGRzlWoejmcN6ZNB

Score

10^/10

blustealer collection spyware stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
mail.sabaint.me
Port:
587
Username:
[email protected]
Password:
regina1983-

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral1/memory/2496-3-0x00000000002A0000-0x00000000002B2000-memory.dmp	CustAttr

Executes dropped EXE 1 IoCs

pid	Process
2068	PASSWORDSNET4.exe

Loads dropped DLL 1 IoCs

pid	Process
2544	470621f5aef9787e21b629735c1a5f9f.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe
Key opened	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe
Key opened	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2496 set thread context of 2544	2496	470621f5aef9787e21b629735c1a5f9f.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	PASSWORDSNET4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	PASSWORDSNET4.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2624	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2544	470621f5aef9787e21b629735c1a5f9f.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2544	470621f5aef9787e21b629735c1a5f9f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2544	470621f5aef9787e21b629735c1a5f9f.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2624	2496	470621f5aef9787e21b629735c1a5f9f.exe	30
PID 2496 wrote to memory of 2624	2496	470621f5aef9787e21b629735c1a5f9f.exe	30
PID 2496 wrote to memory of 2624	2496	470621f5aef9787e21b629735c1a5f9f.exe	30
PID 2496 wrote to memory of 2624	2496	470621f5aef9787e21b629735c1a5f9f.exe	30
PID 2496 wrote to memory of 2544	2496	470621f5aef9787e21b629735c1a5f9f.exe	32
PID 2496 wrote to memory of 2544	2496	470621f5aef9787e21b629735c1a5f9f.exe	32
PID 2496 wrote to memory of 2544	2496	470621f5aef9787e21b629735c1a5f9f.exe	32
PID 2496 wrote to memory of 2544	2496	470621f5aef9787e21b629735c1a5f9f.exe	32
PID 2496 wrote to memory of 2544	2496	470621f5aef9787e21b629735c1a5f9f.exe	32
PID 2496 wrote to memory of 2544	2496	470621f5aef9787e21b629735c1a5f9f.exe	32
PID 2496 wrote to memory of 2544	2496	470621f5aef9787e21b629735c1a5f9f.exe	32
PID 2496 wrote to memory of 2544	2496	470621f5aef9787e21b629735c1a5f9f.exe	32
PID 2496 wrote to memory of 2544	2496	470621f5aef9787e21b629735c1a5f9f.exe	32
PID 2544 wrote to memory of 2068	2544	470621f5aef9787e21b629735c1a5f9f.exe	33
PID 2544 wrote to memory of 2068	2544	470621f5aef9787e21b629735c1a5f9f.exe	33
PID 2544 wrote to memory of 2068	2544	470621f5aef9787e21b629735c1a5f9f.exe	33
PID 2544 wrote to memory of 2068	2544	470621f5aef9787e21b629735c1a5f9f.exe	33

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe

C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe
"C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eVSwXOCV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp43C4.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2624
- C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe
  "C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - outlook_office_path
    - outlook_win_path
    PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp43C4.tmp

Filesize
1KB

MD5
27cd6dd2774c61145bc47bf100511eb3

SHA1
6a3147342057831e5786868712964788f5d8c544

SHA256
c74a08ac5905290222faafb85483b1eb0357d121d811d0fae149378f404378d7

SHA512
204c54c6fa9e9c54eac5a96b2eddbab56b0d71a7e865ee5b521b5ae57b6b85e458abffc13f3fcfc5521785e846bc845f17e9697d4e71146b07e956ab6898df27

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\RVFOTH~1.ZIP

Filesize
122KB

MD5
37ac88bc53abcc353b3a93f68fb30871

SHA1
f5165c03b5de33db3704d502227bac35eae1c6c5

SHA256
7bc03158a3c0bcb001093d9d40eaf6b9a7adf14e685db68fbd9d0f135d447ebe

SHA512
01c65cbf90c2db90d0563d4a45650d4abd19e1a90bb8467f0e5a57ff1c6c377e3be8216f3324b81af58822b75a22b52f7317df985c11f3a7a45b72843134fc38

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\XBTLDBHN_Admin.zip

Filesize
24B

MD5
98a833e15d18697e8e56cdafb0642647

SHA1
e5f94d969899646a3d4635f28a7cd9dd69705887

SHA256
ff006c86b5ec033fe3cafd759bf75be00e50c375c75157e99c0c5d39c96a2a6c

SHA512
c6f9a09d9707b770dbc10d47c4d9b949f4ebf5f030b5ef8c511b635c32d418ad25d72eee5d7ed02a96aeb8bf2c85491ca1aa0e4336d242793c886ed1bcdd910b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\XBTLDBHN_Admin.zip

Filesize
400B

MD5
cf83adadb80c0fa48e7321f062ef29c2

SHA1
9af91cad5ab4260df5b8ce45e325114f24e60013

SHA256
e8dffd6f2733e2b52f7481813e6895a52f8b71f3c06cfe418b5921f9aec7a23a

SHA512
01678998dbc1e2a06c8889dc17d31d1889b6b3eb8844d54b94adc19a76f12a31548749ee0795e3aa0d6ef5e4fcb046ecb8739c6c99c70fd84760b50529cee51c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\credentials.txt

Filesize
311B

MD5
32e589919b578140eea73c8eaaec14aa

SHA1
6429707470e578f6ea1234baac1088a22b5c9eeb

SHA256
1e3132e3d75bd1d2a801bab4eb88fed283739e7cd654ad9256bde26ba2f891e6

SHA512
b4c04cca92cfb59c736c10f13c8bbb83c46d50216ab268a0c6a80c8d4e642a7d7fc8b9b17d5791d45901faa84f20e1b00d1c72b9cca7620b8df772c1f8b6a375

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe

Filesize
156KB

MD5
0c3c728a9b4376e014bc97f7b1da74f0

SHA1
de2253d0c3e02ea9d27ae6f46082cec9d0164a02

SHA256
05f0ac30ce02bc3608d957b40896240ae750da01393f4e26a8951fc7987959ca

SHA512
f610ae81854bc99086f139833b7d16b7e7634f53ef1125dc97d01611ec46c262e1f87dde31aa47a19e17a81334c4f25b4096d8e255460e3446bf45d656f5f81c

Download Submit
memory/2068-109-0x000007FEF5600000-0x000007FEF5FEC000-memory.dmp

Filesize
9.9MB

Download
memory/2068-104-0x000000001BA10000-0x000000001BA90000-memory.dmp

Filesize
512KB

Download
memory/2068-103-0x000007FEF5600000-0x000007FEF5FEC000-memory.dmp

Filesize
9.9MB

Download
memory/2068-102-0x0000000000AB0000-0x0000000000ADE000-memory.dmp

Filesize
184KB

Download
memory/2496-7-0x0000000000B20000-0x0000000000B58000-memory.dmp

Filesize
224KB

Download
memory/2496-1-0x0000000001380000-0x00000000014CA000-memory.dmp

Filesize
1.3MB

Download
memory/2496-0-0x0000000074130000-0x000000007481E000-memory.dmp

Filesize
6.9MB

Download
memory/2496-2-0x0000000005100000-0x0000000005140000-memory.dmp

Filesize
256KB

Download
memory/2496-3-0x00000000002A0000-0x00000000002B2000-memory.dmp

Filesize
72KB

Download
memory/2496-26-0x0000000074130000-0x000000007481E000-memory.dmp

Filesize
6.9MB

Download
memory/2496-4-0x0000000074130000-0x000000007481E000-memory.dmp

Filesize
6.9MB

Download
memory/2496-5-0x0000000005100000-0x0000000005140000-memory.dmp

Filesize
256KB

Download
memory/2496-6-0x0000000005600000-0x00000000056A4000-memory.dmp

Filesize
656KB

Download
memory/2544-17-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2544-13-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2544-15-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2544-29-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2544-110-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2544-25-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2544-115-0x0000000001330000-0x0000000001331000-memory.dmp

Filesize
4KB

Download
memory/2544-23-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2544-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2544-135-0x0000000001330000-0x0000000001331000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads