Analysis
-
max time kernel
12s -
max time network
29s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
06-03-2024 05:35
General
-
Target
3816-142-0x0000000000400000-0x0000000000654000-memory.exe
-
Size
2.3MB
-
MD5
28af75842a4a507ed1bc04782133c1cd
-
SHA1
c0198e76b972772adf04b9a37b575db0e2a1a65e
-
SHA256
5ab9feae38e3b0f409af2261cdddc44676b301ed4df03adec3bcae88d1fe58da
-
SHA512
15739906e7041e4fd7e65c90eb65513113bc7356863285a881a932c35223a56e269355a1e00e504f88d2c0dda1817e0850fb0340c855a9efd1b82e0384257590
-
SSDEEP
24576:wxgsRftD0C2nKGH0Djsf9nz4mloFQnpXUMPQDR6q79dA:waSftDnGUDYf5zaCpXxPuR6E9dA
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 17 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 19 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3816-142-0x0000000000400000-0x0000000000654000-memory.exe"C:\Users\Admin\AppData\Local\Temp\3816-142-0x0000000000400000-0x0000000000654000-memory.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe2⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5cc6c209cdd2197f972d1d84cc651cb80
SHA14a5c76c2b649f7d090b34fb78037e84eba621fdd
SHA25638708391a470b6c95d120c0bc3416c10125c7330ababd2080325d9be78e1f574
SHA5127143bd6bfd0c9e8f1083b4368fe7c4172a1b3f8b61c9273ae44d3319268110b9f3d774a9f5c568d014623dd6ef8e0e9a4d7f32c10eabc824b0b2c6d001e4ebea
-
Filesize
960KB
MD503602ccaa70930392422fec6c5cfd07d
SHA10d5cbadf785a737559fd60c3607fb87104e0b9c6
SHA256d85672070ef6e032bc012ea74ad4018b2f81c99ce0b7f74f2631cb05f74b2f66
SHA5125d83125a346ad8d853ec05437c865796e9d0b3338c454d23d8067df103e685b40099e1d5b57192ddc03121a7de2240a7ff72b9d3bfe8a21d393005df3fca08a9
-
Filesize
1.5MB
MD59141c10958232303bfe19a8c3d47a7f7
SHA13d4f6db48573c81ebb310f05053f7aa53e225b76
SHA2562fbc691be992aefedbfe18874f1485412bdceebfa4c24dd91311505c34d048da
SHA512d93491cfeed509e86172bfcf3c0ae07171025e6366b9a5a92bbfe371d290e0386c7eaafea987bd06bc12527acc3d10e669115aa858ef330d34f7a638fcded6f0
-
Filesize
2.1MB
MD5a63737c3b6e8d6835e999a1d91757e6d
SHA19370cac4085af626645d5aba9797d48d96315d7b
SHA2566e1e14d8804a3d1b0549f81f7efee1f3df2b4594fe95266a88fe09ef2115e3d1
SHA512c3a8084d78a29964856a73214b72dfada9fb917a1e2ca420d1c8e4ba53275e6631ab8a0281c9d194378bc4f3912ddfc6bb9f621b8cfd5176a181f6fc9d15d5d5
-
Filesize
1.2MB
MD5ead4ac8ed6342f18fea0f69567af2958
SHA192698ba90460def2b2df469af404748affcb6106
SHA256fddb515ceee04390174ed1e1b71f311f4e532905a4b7d0caf0d962fa3a306c76
SHA5127b9db2519211b407a7e78fde8f6c71c27605474f9e464f7619701a1b7b802693968c9187893333d52fd276a7c3733ea42d39cf83cac2e789d8cc1d570b2a9958
-
Filesize
1.7MB
MD55dda609ab94ea5749da8254a95df17e3
SHA1888ae00d020c8373ab217d07d2a0b4c0549c59b7
SHA256e6e4f34d7054e8faf4c321d0ed5f375e5fc3134aa375cd230a0a30c4c470a1b1
SHA512cf7f72be0899e28fa00d4163157b6f22ff179444c91abdfe464518a7046bc745a2c2d0dad9df477ca3f1e47a029ac0f34f4a2ca4c8cfc19b412d78940c1efd47
-
Filesize
1.3MB
MD58426972ca36e3783a4fdb2c7064e121f
SHA11e4a8a31e4052461a75b65a179a1387b735693a6
SHA256a4682b97b31a1f566becf5df4dda7ce217b615225d73ad3da465d990fc2c1773
SHA512e4e50ff1ec03864e34cfe7b401f945a3a397f1254f21f44bd1939829b63f078091df37336b3b8fc3452e2b5c53c1413060e2ee756f79d0a7fd48f8d2d75efd71
-
Filesize
1.2MB
MD59c5889c359bd1fc072fa7b882db09e4c
SHA18ce698bf9b216e864a607c4a8bc3a87f4638971f
SHA256dfed4d3d4b2002f8edcc3ae6e7aa9801814bbbf6d1c5f450fb6dd0df2a858ced
SHA51246d2e5faf40e6915314fd751958d3564f1bdab3f2793f9a125b8fa44797d4bb5d21cb482fc18ee2a1a30eb9c8cd38e72f1036bbb8928c30cc05be3ce95fd7e83
-
Filesize
1.2MB
MD55ab152c749e47da4b5fe45026ee77b77
SHA1547b7fcc21c36c8ca36ee2498effefdc85cfc362
SHA256832d929cf38f6373766d0c80f4a5ee135f712e3c6ddd34421e27ac229279796e
SHA51231380e11d3e42192b04febcb4a9a3f837e6c8a37512a7fe5267939cc1a0b399666915218c0f3c90a111e588cf5e9ebfd5df6071d43efafdbc17c6adaad9d8d88
-
Filesize
1.6MB
MD562ac2e29099010a6b9017c838e6b3b98
SHA1bde17653af7b834c715bd5111b91506ef687ea63
SHA256668ffd191e117d514c53ae71633584cf115d6dd46d4b96d3e80e652e47d59dcc
SHA512daaff4dfbf7de6559e7aa5e97027b9654e789fd9729a1f72d84a441c7228495071c855a04bc9d319ff829c0cc640e7f1304e3433e790eefcea7d2e864a9eef1a
-
Filesize
1.3MB
MD591d87e364f9ce3e726b0876f6f92c2e9
SHA177e789675e8c09439b0daa93ac178149ca30f1aa
SHA25603be9a205e405108e3ef6230389e628eb06bd5ad88e7d4ce31158b7ed6442dd9
SHA512499635e03830cf95a174afc3a2db7a3387a2c90ca975347e44c7cfc3ae21ed105bac9df911816491f66b1cbeb5b9387c13fc7c5a171e8b33400fcf79bfa7ad07
-
Filesize
1.8MB
MD5d0d892e50e6a2c535b8724bcab2f5b7c
SHA1ab00dcb74e6c142eab3aa829ef763581e7ffebf2
SHA256e12fb154cd6771774cad5028e6d92f1e47daa593563188aebecb18fd2488bbce
SHA5123e3ce52360ac941e9e757fd5d0c28ef58ee32666d90bd68aa1bf47f209009cec7f098a7a51ac7cdd1a9008171385c00f162726b56c1fafa6cc1b7c8687a3f33e
-
Filesize
1.4MB
MD56ea4cba9d5e3cc9081899593faed7ca4
SHA11e0f1fa82873e067345a711ab6dd26579e492729
SHA256e697f618f1b20dc8fc76ef04ba04793691198a39e106cd86d18bd1e113aeba46
SHA512d205b3065e69330aafa416dbc06643da752d20082803969d6a63b5a6bef5ec3c4ab0cf078ffd1bcc981f4f8162f9863cf7c26f8a659579a9fe9a5a4f804f0faa
-
Filesize
1.5MB
MD539544d87f3e01d1b1efdd3ee9b5011b1
SHA1eb81aaae7dae10cb6635282208491583042a26c7
SHA256600c8bcbb102578f364f3824efda097de5b656cc6f9669bdcd20ab2e59a43b96
SHA512bfe8f94a5da4f43e0184f873b62a5f19e4645a675a5f1ad8fc31208484b2646199c9a3eab4ac9da9a2ef12eb05dc332f41d416cbf952bcff1724d6420acc5da2
-
Filesize
1.3MB
MD59df4f411d4449c69e18e2d517a422d3b
SHA1945045331a81fa26f0ebdf762d39ba04aac448b6
SHA256efa96f5d620ee408e40947a0840b8c93c30ea6c4b7a4c8e87029732ed69e00ef
SHA512249034bb22c184d5dec02e58269e33619b02b7aa2eef890024bd74e87f6d40761e076636f49a409d4141196f5e64bbbb70a590e9aedb05730ce9554b3ea4969a
-
Filesize
1.4MB
MD55601dc6bbce6558904d884cce1aacb25
SHA14dd39f78d2d6717c0433ffddc5e1efd50de823f1
SHA2569cbdfa8e18f339125b39876ca1a31cbe752befc462bc2ea11b7e55e59cccf5f1
SHA5123618a63980a9631dfb7cd1629ec668175805e0755735d1c12cd16d5700420324ace29fd55f08e3e793faf8fabd8d547742ff08049ac9b7aab4e3a4446629e5ed
-
Filesize
704KB
MD58c39564ad6462de5b239c32c23eda430
SHA1230d0a77fb4132fc772ede915eb13bc3cd1580ce
SHA25634f7dac79257730ea55657cb959c8ff20da1baed7e554023446b6b0614ceb4cc
SHA5128c5865d1b261c2b26d7e5d0d025ccdf490d2dc91a5879ddba05975626bfd9dac20c62688bda068e18e4d3e5c0d67c4cf3899cbfd1e659111d8f9c26f02698fa7
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
752KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.3MB