a310logger | fdb6b5f3b83553b83111bd61152a4c4bd29996d778d6c118f52f01abd9435fe5

General

Target

b44f95c332073b28fe95157f470f8f2a.exe
Size

1.0MB
MD5

b44f95c332073b28fe95157f470f8f2a
SHA1

ab9265412559d4992d540aa11f05d73e4f544374
SHA256

fdb6b5f3b83553b83111bd61152a4c4bd29996d778d6c118f52f01abd9435fe5
SHA512

25bd35d5bd9d233d9f0bc21afa1af51c2326a252d3afe16f65a22f17ec85bd7a73529b24f4408d20aa0aec84dc79339574f4e57f1876f480bbb6b23cc5aa8f4d
SSDEEP

24576:TqLcMNjfhbU37ea2y1c+ExsjMW/GpsPzKnWjT9:QFhfhYa1yes4vqmnWv

Score

10^/10

a310logger blustealer collection spyware stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot1945669405:AAEo5Zfx9GfeIsr07vB55CuJD00-glDv8-w/sendMessage?chat_id=1890833638

Signatures

A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware a310logger
BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

A310logger Executable 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000015a2d-46.dat	a310logger
behavioral1/files/0x0007000000015a2d-48.dat	a310logger
behavioral1/files/0x0007000000015a2d-49.dat	a310logger
behavioral1/memory/1400-50-0x0000000000DC0000-0x0000000000E72000-memory.dmp	a310logger

Executes dropped EXE 1 IoCs

pid	Process
1400	Fox.exe

Loads dropped DLL 1 IoCs

pid	Process
2588	b44f95c332073b28fe95157f470f8f2a.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Fox.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Fox.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Fox.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1284 set thread context of 2588	1284	b44f95c332073b28fe95157f470f8f2a.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2588	b44f95c332073b28fe95157f470f8f2a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2588	b44f95c332073b28fe95157f470f8f2a.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 2588	1284	b44f95c332073b28fe95157f470f8f2a.exe	30
PID 1284 wrote to memory of 2588	1284	b44f95c332073b28fe95157f470f8f2a.exe	30
PID 1284 wrote to memory of 2588	1284	b44f95c332073b28fe95157f470f8f2a.exe	30
PID 1284 wrote to memory of 2588	1284	b44f95c332073b28fe95157f470f8f2a.exe	30
PID 1284 wrote to memory of 2588	1284	b44f95c332073b28fe95157f470f8f2a.exe	30
PID 1284 wrote to memory of 2588	1284	b44f95c332073b28fe95157f470f8f2a.exe	30
PID 1284 wrote to memory of 2588	1284	b44f95c332073b28fe95157f470f8f2a.exe	30
PID 1284 wrote to memory of 2588	1284	b44f95c332073b28fe95157f470f8f2a.exe	30
PID 1284 wrote to memory of 2588	1284	b44f95c332073b28fe95157f470f8f2a.exe	30
PID 2588 wrote to memory of 1400	2588	b44f95c332073b28fe95157f470f8f2a.exe	31
PID 2588 wrote to memory of 1400	2588	b44f95c332073b28fe95157f470f8f2a.exe	31
PID 2588 wrote to memory of 1400	2588	b44f95c332073b28fe95157f470f8f2a.exe	31
PID 2588 wrote to memory of 1400	2588	b44f95c332073b28fe95157f470f8f2a.exe	31

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Fox.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Fox.exe

C:\Users\Admin\AppData\Local\Temp\b44f95c332073b28fe95157f470f8f2a.exe
"C:\Users\Admin\AppData\Local\Temp\b44f95c332073b28fe95157f470f8f2a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\b44f95c332073b28fe95157f470f8f2a.exe
  "C:\Users\Admin\AppData\Local\Temp\b44f95c332073b28fe95157f470f8f2a.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\RDHO5F~1.ZIP

Filesize
285KB

MD5
40a9752d59f2883e40d928f85a749008

SHA1
c60fb58eff64a7969b46f3934766f991352eeb47

SHA256
ef95540ec8dae3d255439fb847d26397c265b5cccda5ed0d6b9ed3dda14a2820

SHA512
ce33985f91103315accb1039635488d7e144df264bab8e164c1f9844ce6923e1c9c76349f14542901887ffcbbbca40b92cf474126f0b94893e8af1f608464b3c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe

Filesize
635KB

MD5
fa82b59412305c409ba19792ef769aea

SHA1
f32cf54bf72573f190747900884862e05ce40cf6

SHA256
fb807a0e29f66f04f0a1cc6afdee37dcef8a62d2820169b6bfa4d8972d87b59f

SHA512
d51df6fd2196c0afbaad2afc9ed77ea93d88a6d8b6583efb9fc21dc64115e355e7be06c2719adf335410b38aa86967c05b5fe4d8a7ad2e44e45afdb5cacc8ee8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe

Filesize
315KB

MD5
315cd4fbfd543c95401451858d712c85

SHA1
597eeb57f3f318d93cc6b48a7dfa913f0bf824de

SHA256
938edefcb393f5cc1470941dbfdbf1bad3b59e61fd98aef59c1e8d97183f088d

SHA512
36ff78791cf5f4e25a76c4354b2fde4d9a323a717e084c77846be11660fc464030c627c4b626f4c0240a2c613e0b198fae57f695d2bf15259131af75f657b244

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe

Filesize
619KB

MD5
50ced13f0ce84982d8c58e592a5de3c3

SHA1
5b4b47c29987a9a47951432c6fc58a1a6e454b97

SHA256
097caa31d3bfded00cf17c3835350b00e5b7934d4b614e9a2269632c0f6fcbe7

SHA512
8b7438b91b1fad48b50e5ab1268b610aed3b50f6e08fe56d94deaf732709d1e81b5808b8e9e0e12017c4da867a476c2b4d75003d55f558efc0978d8b06678f1e

Download Submit
memory/1284-6-0x0000000005730000-0x0000000005800000-memory.dmp

Filesize
832KB

Download
memory/1284-2-0x0000000000F00000-0x0000000000F40000-memory.dmp

Filesize
256KB

Download
memory/1284-0-0x0000000001070000-0x0000000001178000-memory.dmp

Filesize
1.0MB

Download
memory/1284-7-0x0000000004DD0000-0x0000000004E36000-memory.dmp

Filesize
408KB

Download
memory/1284-1-0x0000000073DE0000-0x00000000744CE000-memory.dmp

Filesize
6.9MB

Download
memory/1284-5-0x0000000000F00000-0x0000000000F40000-memory.dmp

Filesize
256KB

Download
memory/1284-3-0x0000000000480000-0x000000000049A000-memory.dmp

Filesize
104KB

Download
memory/1284-4-0x0000000073DE0000-0x00000000744CE000-memory.dmp

Filesize
6.9MB

Download
memory/1284-17-0x0000000073DE0000-0x00000000744CE000-memory.dmp

Filesize
6.9MB

Download
memory/1400-50-0x0000000000DC0000-0x0000000000E72000-memory.dmp

Filesize
712KB

Download
memory/1400-51-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

Filesize
9.9MB

Download
memory/1400-52-0x0000000000BF0000-0x0000000000C70000-memory.dmp

Filesize
512KB

Download
memory/1400-54-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

Filesize
9.9MB

Download
memory/2588-14-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2588-16-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2588-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2588-10-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2588-9-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2588-8-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2588-55-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download

Analysis

Sharing