blustealer | d0b801a4ea3be10c3cf2dfff06e2437c9d96e4cbe5be96483c00a4c10b27d2c5

General

Target

470621f5aef9787e21b629735c1a5f9f.exe
Size

1.3MB
MD5

470621f5aef9787e21b629735c1a5f9f
SHA1

be32079fc5d6662582685689c644322642073778
SHA256

d0b801a4ea3be10c3cf2dfff06e2437c9d96e4cbe5be96483c00a4c10b27d2c5
SHA512

9e321a30ae8d88c13f96033fd63a7a5bb78a35c2bb1edbe02c30109df518c07c54a72f29c3f11c9573943483ac2fb5e273d8ad2054e30458396b5de6f78c534c
SSDEEP

24576:P4S/d3rKzksfks2y8jIGReCFlolhhNxuNeG5Gm+8MN6ZNBZ:TKqYGRzlWoejmcN6ZNB

Score

10^/10

blustealer collection spyware stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
mail.sabaint.me
Port:
587
Username:
[email protected]
Password:
regina1983-

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral2/memory/1904-7-0x0000000005D30000-0x0000000005D42000-memory.dmp	CustAttr

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	470621f5aef9787e21b629735c1a5f9f.exe

Executes dropped EXE 1 IoCs

pid	Process
3032	PASSWORDSNET4.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe
Key opened	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe
Key opened	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1904 set thread context of 1696	1904	470621f5aef9787e21b629735c1a5f9f.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	PASSWORDSNET4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	PASSWORDSNET4.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1904	470621f5aef9787e21b629735c1a5f9f.exe
1904	470621f5aef9787e21b629735c1a5f9f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1696	470621f5aef9787e21b629735c1a5f9f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1904	470621f5aef9787e21b629735c1a5f9f.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1696	470621f5aef9787e21b629735c1a5f9f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1696	470621f5aef9787e21b629735c1a5f9f.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 3408	1904	470621f5aef9787e21b629735c1a5f9f.exe	102
PID 1904 wrote to memory of 3408	1904	470621f5aef9787e21b629735c1a5f9f.exe	102
PID 1904 wrote to memory of 3408	1904	470621f5aef9787e21b629735c1a5f9f.exe	102
PID 1904 wrote to memory of 4612	1904	470621f5aef9787e21b629735c1a5f9f.exe	104
PID 1904 wrote to memory of 4612	1904	470621f5aef9787e21b629735c1a5f9f.exe	104
PID 1904 wrote to memory of 4612	1904	470621f5aef9787e21b629735c1a5f9f.exe	104
PID 1904 wrote to memory of 1696	1904	470621f5aef9787e21b629735c1a5f9f.exe	105
PID 1904 wrote to memory of 1696	1904	470621f5aef9787e21b629735c1a5f9f.exe	105
PID 1904 wrote to memory of 1696	1904	470621f5aef9787e21b629735c1a5f9f.exe	105
PID 1904 wrote to memory of 1696	1904	470621f5aef9787e21b629735c1a5f9f.exe	105
PID 1904 wrote to memory of 1696	1904	470621f5aef9787e21b629735c1a5f9f.exe	105
PID 1904 wrote to memory of 1696	1904	470621f5aef9787e21b629735c1a5f9f.exe	105
PID 1904 wrote to memory of 1696	1904	470621f5aef9787e21b629735c1a5f9f.exe	105
PID 1904 wrote to memory of 1696	1904	470621f5aef9787e21b629735c1a5f9f.exe	105
PID 1696 wrote to memory of 3032	1696	470621f5aef9787e21b629735c1a5f9f.exe	106
PID 1696 wrote to memory of 3032	1696	470621f5aef9787e21b629735c1a5f9f.exe	106

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PASSWORDSNET4.exe

C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe
"C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eVSwXOCV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC5FB.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3408
- C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe
  "C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe"
  2⤵
  PID:4612
- C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe
  "C:\Users\Admin\AppData\Local\Temp\470621f5aef9787e21b629735c1a5f9f.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - outlook_office_path
    - outlook_win_path
    PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC5FB.tmp

Filesize
1KB

MD5
e1d49eb6937b39086110d96861a23a68

SHA1
19cdff79626b0268f147f2fd853bb9592d2961a8

SHA256
678f6ab49ec5dc731e010d8377d2a68b2fbb6fc806017a74d432fd832e1f4494

SHA512
6171a218121956fd196bb357de3f520ab2cc097ce2f73e1f5f7a1929be0d9d4046e7d20af531937e009492afc9bcf5edcf8a6cb98ecc2d6df82f3952d2fa4db6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\3XZIN1L77K.zip

Filesize
122KB

MD5
37ac88bc53abcc353b3a93f68fb30871

SHA1
f5165c03b5de33db3704d502227bac35eae1c6c5

SHA256
7bc03158a3c0bcb001093d9d40eaf6b9a7adf14e685db68fbd9d0f135d447ebe

SHA512
01c65cbf90c2db90d0563d4a45650d4abd19e1a90bb8467f0e5a57ff1c6c377e3be8216f3324b81af58822b75a22b52f7317df985c11f3a7a45b72843134fc38

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\IMXSDNYJ_Admin.zip

Filesize
24B

MD5
98a833e15d18697e8e56cdafb0642647

SHA1
e5f94d969899646a3d4635f28a7cd9dd69705887

SHA256
ff006c86b5ec033fe3cafd759bf75be00e50c375c75157e99c0c5d39c96a2a6c

SHA512
c6f9a09d9707b770dbc10d47c4d9b949f4ebf5f030b5ef8c511b635c32d418ad25d72eee5d7ed02a96aeb8bf2c85491ca1aa0e4336d242793c886ed1bcdd910b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe

Filesize
156KB

MD5
0c3c728a9b4376e014bc97f7b1da74f0

SHA1
de2253d0c3e02ea9d27ae6f46082cec9d0164a02

SHA256
05f0ac30ce02bc3608d957b40896240ae750da01393f4e26a8951fc7987959ca

SHA512
f610ae81854bc99086f139833b7d16b7e7634f53ef1125dc97d01611ec46c262e1f87dde31aa47a19e17a81334c4f25b4096d8e255460e3446bf45d656f5f81c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\credentials.txt

Filesize
1KB

MD5
38f6dfadf6091c7c24ff3ad4845ad8fb

SHA1
ae319aec40873a8c6a4423e73515db426c620ecb

SHA256
7afcbd3937672ecb06e3b239cf402464c275af9a4bab8fc814f945c46c7bf061

SHA512
60c237583c6d7d650d81cd17bb84cf0aa109f79240a5f52b4659f445004a9249725475f2f1196acf5bbb807ebba3cd392f702b73286ec815301b1c0673edc067

Download Submit
memory/1696-107-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1696-20-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1696-17-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1904-6-0x0000000005D80000-0x0000000005E1C000-memory.dmp

Filesize
624KB

Download
memory/1904-4-0x0000000005E40000-0x0000000005E50000-memory.dmp

Filesize
64KB

Download
memory/1904-10-0x0000000006C10000-0x0000000006CB4000-memory.dmp

Filesize
656KB

Download
memory/1904-11-0x00000000068C0000-0x00000000068F8000-memory.dmp

Filesize
224KB

Download
memory/1904-8-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/1904-7-0x0000000005D30000-0x0000000005D42000-memory.dmp

Filesize
72KB

Download
memory/1904-0-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/1904-21-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/1904-5-0x0000000005CD0000-0x0000000005CDA000-memory.dmp

Filesize
40KB

Download
memory/1904-9-0x0000000005E40000-0x0000000005E50000-memory.dmp

Filesize
64KB

Download
memory/1904-1-0x0000000000FF0000-0x000000000113A000-memory.dmp

Filesize
1.3MB

Download
memory/1904-2-0x0000000006170000-0x0000000006714000-memory.dmp

Filesize
5.6MB

Download
memory/1904-3-0x0000000005BC0000-0x0000000005C52000-memory.dmp

Filesize
584KB

Download
memory/3032-106-0x00007FFE9ACE0000-0x00007FFE9B7A1000-memory.dmp

Filesize
10.8MB

Download
memory/3032-100-0x0000000002940000-0x0000000002950000-memory.dmp

Filesize
64KB

Download
memory/3032-96-0x00007FFE9ACE0000-0x00007FFE9B7A1000-memory.dmp

Filesize
10.8MB

Download
memory/3032-95-0x0000000000780000-0x00000000007AE000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads