8614abe7235f3750a5014e381149c51f0dce2b58aea794cfd4aaef91370ace08

Analysis

max time kernel
1561s
max time network
1566s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BlueStacksMicroInstaller_4.280.1.1002_native_e8c808cb017c46f465f6562b28124796.exe
Size

1.2MB
MD5

b9aad0362d8ed8316b0ecc1cedb7fafd
SHA1

bec1947281d9f39a6bdf33c46fe1514214ec37fe
SHA256

8614abe7235f3750a5014e381149c51f0dce2b58aea794cfd4aaef91370ace08
SHA512

36eff8621ea91c081ed08116dc3dcfd19bfd970de0277790530e8807c8b5113a2df62693629d355b01a6bfb91a11ae28ca5295143072b8ac0d7d007a4360505f
SSDEEP

24576:UcVkKS/WtWrnngnnnKnanxNpDcexw6kPEmEi90YAVk8B1MxWl+2w0NNx29sWD9k9:UcB6WErnngnnnKnanzSexoNfv8B1Mk+K

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

BlueStacksInstaller.exeBlueStacksInstaller.exe

pid process

2452 BlueStacksInstaller.exe
1976 BlueStacksInstaller.exe

Loads dropped DLL 6 IoCs

Processes:

BlueStacksMicroInstaller_4.280.1.1002_native_e8c808cb017c46f465f6562b28124796.exeBlueStacksInstaller.exeBlueStacksInstaller.exe

pid	process
612	BlueStacksMicroInstaller_4.280.1.1002_native_e8c808cb017c46f465f6562b28124796.exe
612	BlueStacksMicroInstaller_4.280.1.1002_native_e8c808cb017c46f465f6562b28124796.exe
612	BlueStacksMicroInstaller_4.280.1.1002_native_e8c808cb017c46f465f6562b28124796.exe
612	BlueStacksMicroInstaller_4.280.1.1002_native_e8c808cb017c46f465f6562b28124796.exe
2452	BlueStacksInstaller.exe
1976	BlueStacksInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

BlueStacksInstaller.exeBlueStacksInstaller.exe

pid	process
2452	BlueStacksInstaller.exe
2452	BlueStacksInstaller.exe
2452	BlueStacksInstaller.exe
2452	BlueStacksInstaller.exe
2452	BlueStacksInstaller.exe
2452	BlueStacksInstaller.exe
2452	BlueStacksInstaller.exe
2452	BlueStacksInstaller.exe
1976	BlueStacksInstaller.exe
1976	BlueStacksInstaller.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

BlueStacksInstaller.exeBlueStacksInstaller.exe

description pid process

Token: SeDebugPrivilege 2452 BlueStacksInstaller.exe
Token: SeDebugPrivilege 1976 BlueStacksInstaller.exe

description	pid	process
Token: SeDebugPrivilege	2452	BlueStacksInstaller.exe
Token: SeDebugPrivilege	1976	BlueStacksInstaller.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

BlueStacksMicroInstaller_4.280.1.1002_native_e8c808cb017c46f465f6562b28124796.exeBlueStacksInstaller.exe

description	pid	process	target process
PID 612 wrote to memory of 2452	612	BlueStacksMicroInstaller_4.280.1.1002_native_e8c808cb017c46f465f6562b28124796.exe	BlueStacksInstaller.exe
PID 612 wrote to memory of 2452	612	BlueStacksMicroInstaller_4.280.1.1002_native_e8c808cb017c46f465f6562b28124796.exe	BlueStacksInstaller.exe
PID 612 wrote to memory of 2452	612	BlueStacksMicroInstaller_4.280.1.1002_native_e8c808cb017c46f465f6562b28124796.exe	BlueStacksInstaller.exe
PID 612 wrote to memory of 2452	612	BlueStacksMicroInstaller_4.280.1.1002_native_e8c808cb017c46f465f6562b28124796.exe	BlueStacksInstaller.exe
PID 2452 wrote to memory of 1976	2452	BlueStacksInstaller.exe	BlueStacksInstaller.exe
PID 2452 wrote to memory of 1976	2452	BlueStacksInstaller.exe	BlueStacksInstaller.exe
PID 2452 wrote to memory of 1976	2452	BlueStacksInstaller.exe	BlueStacksInstaller.exe

C:\Users\Admin\AppData\Local\Temp\BlueStacksMicroInstaller_4.280.1.1002_native_e8c808cb017c46f465f6562b28124796.exe
"C:\Users\Admin\AppData\Local\Temp\BlueStacksMicroInstaller_4.280.1.1002_native_e8c808cb017c46f465f6562b28124796.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:612

C:\Users\Admin\AppData\Local\Temp\7zS462F7566\BlueStacksInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\7zS462F7566\BlueStacksInstaller.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452

C:\Users\Admin\AppData\Local\Temp\7zS462F7566\BlueStacksInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\7zS462F7566\BlueStacksInstaller.exe" "install" "BlueStacksMicroInstaller_4.280.1.1002_native_e8c808cb017c46f465f6562b28124796.exe" "e8c808cb017c46f465f6562b28124796" "admin" "650eecbf-78dd-43b0-a2d8-69b07d0130c2" "a02eeee8-7227-401a-b3d3-7a5b2339a605"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
76b001b446b1851e20ed24274f486726

SHA1
666d70209a60b61204cb4961f2b7aa72147c8b29

SHA256
eb1a4a66c5e62a9f125e7c06b942a7a0ccb4e0963339e1233c8aad3a38386657

SHA512
b15c7a691ee1988312c4d019b76f6947a2159b8c8e423c86010e1810de7048fbdde3ad91fd3969534615eab752f9cea13c193db132db749edc4cc4c3f93e3de7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c2373d25217f0a30c38924d6fc800224

SHA1
5a0d1ed28109c646092c7d74f7a07f6984cff262

SHA256
18f68af308194e4aa6241bf8e780cb54dec82a29c800a9c27c38885404cbf34c

SHA512
f194d5501a2fc8bf145f6949591b6b38a136cc7cecaca499e6837691a8f426d73c2a2f2b6992c74142c205cefcb5e8f0014eca2977677e1b46d35fc6c4195d61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c08aaefadf755c00055ac3bdf0cca537

SHA1
f8a7da409780427aaba9555d0326dbeee3ae8081

SHA256
bdf566d1c6ca98c1078185b18670e9560f6f79a07e59cf7661c2f1a58f530cd7

SHA512
9c290297b05aba8520124e06827cfc320f6b6a0a17da3220231429269cd03626e9ef7cfc32620678b26d5d5ba3dc950e36876b9c52450c1d0079912732b26ad7

Download Submit
C:\Users\Admin\AppData\Local\BlueStacks\BlueStacksMicroInstaller_4.280.1.1002.log
Filesize
2KB

MD5
8a5cde2a073d54ce30c58ebbeea51f09

SHA1
1aaeb86375d66730fc1a76e96232eb8b9e7e0771

SHA256
80e5d964c20d0a76306e5fef1cadd2f1c6ff77a50e9b34a0b0f2b68f2fa1bcbc

SHA512
c27bac7d39546ce2fde299d5854bdab642f9312df4416a9965d945269ab4719a7718407a541d3ca2ae73891613a8a0f7bb9f2cd753fc8a0454a88b95284e32bc

Download Submit
C:\Users\Admin\AppData\Local\Bluestacks\Logs.log
Filesize
105B

MD5
c5818eb663214f5ca0ff2c2df0e92eff

SHA1
0851ba6e92e9d5474ba0cee43ecd10a3fd949daf

SHA256
570fd7bd93268c82664633e73746942aaee78704c80c2f5a6ad2b635ef2ac778

SHA512
e31af29d2f043553a46b9584731662608c7e6dbc60e411fbf77cc1912e42a510c275dff6df84b5d92bb47c92eea6eabce119096b18e45e0f0e52e6b2af279f4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS462F7566\Assets\backicon.png
Filesize
15KB

MD5
7ff5dc8270b5fa7ef6c4a1420bd67a7f

SHA1
b224300372feaa97d882ca2552b227c0f2ef4e3e

SHA256
fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1

SHA512
f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS462F7566\Assets\checked_gray.png
Filesize
538B

MD5
ce144d2aab3bf213af693d4e18f87a59

SHA1
df59dc3dbba88bdc5ffc25f2e5e7b73ac3de5afa

SHA256
d8e502fab00b0c6f06ba6abede6922ab3b423fe6f2d2f56941dabc887b229ad3

SHA512
0f930edd485a0d49ef157f6cc8856609c087c91b77845adeb5cc8c8a80ebc7ec5416df351ffa1af780caad884dbb49dcc778b0b30de6fb7c85ffef22d7220ebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS462F7566\Assets\close_red.png
Filesize
15KB

MD5
93216b2f9d66d423b3e1311c0573332d

SHA1
5efaebec5f20f91f164f80d1e36f98c9ddaff805

SHA256
d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb

SHA512
922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS462F7566\Assets\custom.png
Filesize
17KB

MD5
03b17f0b1c067826b0fcc6746cced2cb

SHA1
e07e4434e10df4d6c81b55fceb6eca2281362477

SHA256
fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b

SHA512
67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS462F7566\Assets\installer_flash_background.jpg
Filesize
34KB

MD5
08d091faf58df0ea8218d7e08140bbeb

SHA1
38ebf2763bd2082635a5971c4302021ecaddc0d1

SHA256
7e5f6998d34d56aeca87f676c12a42c6c4362ae16a753dc567aae00e253b0817

SHA512
5cfede2ea2ade7bbc4b63475af5eb52f78af567fa7096a2ead396056271b8745df4dc6e11e4328151ce59ab74c6c48fd49cd13e30f7f4b86c566757e310fd5e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS462F7566\Assets\installer_logo.png
Filesize
6KB

MD5
4cc6586c249ae201501c07fe5354b23b

SHA1
8fda8ef400f0bc25fd19cf4aa13469141befa3d8

SHA256
06f6630b150cca4ab3a00b663bfb6b0fe0c53309d434036c5ef16b3fe01304ed

SHA512
65ce7392ad4519ca51edafb5e25d60f0b0d2d37f7f8afe0394aa0594e63c38d331cd3c63aea149419dedabdc836f10cb1e9cc468c2d40afbb9e94a344a20fa83

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS462F7566\Assets\installer_minimize.png
Filesize
113B

MD5
38b539a1e4229738e5c196eedb4eb225

SHA1
f027b08dce77c47aaed75a28a2fce218ff8c936c

SHA256
a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2

SHA512
2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS462F7566\Assets\setpath.png
Filesize
15KB

MD5
b2e7f40179744c74fded932e829cb12a

SHA1
a0059ab8158a497d2cf583a292b13f87326ec3f0

SHA256
5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b

SHA512
b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS462F7566\Assets\unchecked_gray.png
Filesize
192B

MD5
e50df2a0768f7fc4c3fe8d784564fea3

SHA1
d1fc4db50fe8e534019eb7ce70a61fd4c954621a

SHA256
671f26795b12008fbea1943143f660095f3dca5d925f67d765e2352fd7ee2396

SHA512
c87a8308a73b17cbdd179737631fb1ba7fdaeb65e82263f6617727519b70a81266bb695867b9e599c1306ee2cf0de525452f77ce367ca89bf870ea3ae7189998

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS462F7566\BlueStacksInstaller.exe.config
Filesize
324B

MD5
1b456d88546e29f4f007cd0bf1025703

SHA1
e5c444fcfe5baf2ef71c1813afc3f2c1100cab86

SHA256
d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb

SHA512
c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS462F7566\HD-Common-Native.dll
Filesize
548KB

MD5
b128d6061906bb3c22294048158562e1

SHA1
c5d1f5d9b76e4356eb30e29e83defd959a360376

SHA256
a485f14aae7dc9dc9b70d5e294bcc117c257cd90f21b4bb93b50ac535d093db0

SHA512
866d50610c8b9564bf53711d6dcedf82ddf0daa663612eaa64bd4601c20de5490e0130d769537e4fac4f6fb148e4982e259af051e646ccb308667e2f08db26d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS462F7566\JSON.dll
Filesize
411KB

MD5
f5fd966e29f5c359f78cb61a571d1be4

SHA1
a55e7ed593b4bc7a77586da0f1223cfd9d51a233

SHA256
d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156

SHA512
d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS462F7566\Locales\i18n.en-US.txt
Filesize
117KB

MD5
bc06cc543480420460bbff56657f4bd2

SHA1
1348e68db07101fad6541b0a680076ea9fc152c6

SHA256
b542578fd373773958d24733c979eeafd057db6fa23e9ef571c4c95a5229a96d

SHA512
e85f6b40b7d51b997d7c65b9a5e8152cde6c940e6f271c73c7424650ad3185da944c3f45a25a2be85feb014454d2c3949bb8eedc6dba785ff27e5b38f6c62895

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS462F7566\ThemeFile
Filesize
76KB

MD5
4567f7dc395c544d0e6903a1ba678fc6

SHA1
d09275c52f6ffaa83962f07854bc5f7cbaae5953

SHA256
3777668daf5c0da4e4938dc95feb4535ef8493e809081703304587e1056e9fbf

SHA512
9509e99a1cb69749f883f701f88cec6ec6ca61a877f92418990f1536cdd766266ad2a31c5248e95e3df3b15fea994c73de451861f7d362275faa5184835e9236

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar93AF.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Public\BlueStacks\MachineID
Filesize
36B

MD5
c53379e763854cc3ffe5792619e38dd9

SHA1
b3a9c1b4b70298e8b27445707d2effbd012e1bdf

SHA256
9fbcccc05b0a84b8e9df53a7936c1501a4b8d50d419d9ab701bf06f015fb7160

SHA512
3e901c1189eb02294f3f31d424cb44ab734338281e65cb7802d600aabec4b4a2a46e2d8f1c84e183ae66033fbbd064bad6a5ed153a730d3dac6e6806ff5d7808

Download Submit
C:\Users\Public\BlueStacks\VersionMachineId_4.280.1.1002
Filesize
36B

MD5
849f1f71a186584056f2d143ab0980ec

SHA1
53154ca4b31d68e9dbeee899a98ef292fb1c4926

SHA256
b21bf59be856c16df139463f346500321e43e1d98ab284a6bcf0eacfce6b81bf

SHA512
51d190afe93a903e0ed553a7fd2ea66a4584c6983b5aca636e34e7f1ea2c3c920ea5f6424e6d2a48ae611c044ae749fd2bf62c198f2e21f83dddfab262d7cf3b

Download Submit
\Users\Admin\AppData\Local\Temp\7zS462F7566\BlueStacksInstaller.exe
Filesize
522KB

MD5
201a0f5f9a7c14c7bec7cc08dd971e49

SHA1
a14e69e7bdd551d86d13e4d6a48364680ae396ed

SHA256
75cba8246de01c32b263d693b6c2fb6afb755b58547fc0519c8be4176673d0d4

SHA512
122d0b0c902761bbaebd31b32784258199a61b7453e36a3bff2de05cefaae2eb02df278bebb02c2d5f0cbd9b80da663f92860ad551fe823d885b87b682455762

Download Submit
memory/1976-200-0x000000001A870000-0x000000001A8D8000-memory.dmp

Filesize
416KB

Download
memory/1976-202-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/1976-185-0x000000001AE40000-0x000000001AEC0000-memory.dmp

Filesize
512KB

Download
memory/1976-311-0x0000000000150000-0x000000000015A000-memory.dmp

Filesize
40KB

Download
memory/1976-188-0x0000000000150000-0x000000000015A000-memory.dmp

Filesize
40KB

Download
memory/1976-187-0x0000000000150000-0x000000000015A000-memory.dmp

Filesize
40KB

Download
memory/1976-201-0x000000001AE40000-0x000000001AEC0000-memory.dmp

Filesize
512KB

Download
memory/1976-184-0x000000001AE40000-0x000000001AEC0000-memory.dmp

Filesize
512KB

Download
memory/1976-310-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/1976-180-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2452-112-0x0000000001300000-0x0000000001386000-memory.dmp

Filesize
536KB

Download
memory/2452-309-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2452-113-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2452-119-0x000000001B560000-0x000000001B5E0000-memory.dmp

Filesize
512KB

Download