blustealer | a7cce7b44e791b44a67edeec0489858b4ba9d1a82464d4148a6f691a4e86e93c

General

Target

0a424c71b75fecfb42fb0e2b17f1c6bc.exe
Size

1.3MB
MD5

0a424c71b75fecfb42fb0e2b17f1c6bc
SHA1

672ef8db0788b4dad4d4fe2853573140448447f6
SHA256

a7cce7b44e791b44a67edeec0489858b4ba9d1a82464d4148a6f691a4e86e93c
SHA512

b744c61ff97d08c2112b1ac752fabd057efe2e5b7a70f2c65ed5e2c83960b763cf444f99e3f5a285578b31a10ee33c016e95e2d2979fd2bc09c69e941a2615dc

Score

10^/10

blustealer stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
mail.dm-teh.com
Port:
587
Username:
office@dm-teh.com
Password:
Vm@(O;CO.vEQ

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer
Executes dropped EXE 1 IoCs

Processes:

AddInProcess32.exe

pid process

1420 AddInProcess32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

0a424c71b75fecfb42fb0e2b17f1c6bc.exe

description pid process target process

PID 3596 set thread context of 1420 3596 0a424c71b75fecfb42fb0e2b17f1c6bc.exe AddInProcess32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

0a424c71b75fecfb42fb0e2b17f1c6bc.exe

pid process

3596 0a424c71b75fecfb42fb0e2b17f1c6bc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0a424c71b75fecfb42fb0e2b17f1c6bc.exe

description pid process

Token: SeDebugPrivilege 3596 0a424c71b75fecfb42fb0e2b17f1c6bc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

AddInProcess32.exe

pid process

1420 AddInProcess32.exe

pid	process
1420	AddInProcess32.exe

description	pid	process	target process
PID 3596 set thread context of 1420	3596	0a424c71b75fecfb42fb0e2b17f1c6bc.exe	AddInProcess32.exe

pid	process
3596	0a424c71b75fecfb42fb0e2b17f1c6bc.exe

description	pid	process
Token: SeDebugPrivilege	3596	0a424c71b75fecfb42fb0e2b17f1c6bc.exe

pid	process
1420	AddInProcess32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

0a424c71b75fecfb42fb0e2b17f1c6bc.exe

description	pid	process	target process
PID 3596 wrote to memory of 1420	3596	0a424c71b75fecfb42fb0e2b17f1c6bc.exe	AddInProcess32.exe
PID 3596 wrote to memory of 1420	3596	0a424c71b75fecfb42fb0e2b17f1c6bc.exe	AddInProcess32.exe
PID 3596 wrote to memory of 1420	3596	0a424c71b75fecfb42fb0e2b17f1c6bc.exe	AddInProcess32.exe
PID 3596 wrote to memory of 1420	3596	0a424c71b75fecfb42fb0e2b17f1c6bc.exe	AddInProcess32.exe
PID 3596 wrote to memory of 1420	3596	0a424c71b75fecfb42fb0e2b17f1c6bc.exe	AddInProcess32.exe
PID 3596 wrote to memory of 1420	3596	0a424c71b75fecfb42fb0e2b17f1c6bc.exe	AddInProcess32.exe
PID 3596 wrote to memory of 1420	3596	0a424c71b75fecfb42fb0e2b17f1c6bc.exe	AddInProcess32.exe
PID 3596 wrote to memory of 1420	3596	0a424c71b75fecfb42fb0e2b17f1c6bc.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\0a424c71b75fecfb42fb0e2b17f1c6bc.exe
"C:\Users\Admin\AppData\Local\Temp\0a424c71b75fecfb42fb0e2b17f1c6bc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
"C:\Users\Admin\AppData\Local\Temp\\AddInProcess32.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
memory/1420-124-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1420-129-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1420-128-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/1420-127-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/1420-125-0x0000000000402594-mapping.dmp

Download
memory/3596-119-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download
memory/3596-123-0x0000000006750000-0x000000000675A000-memory.dmp

Filesize
40KB

Download
memory/3596-122-0x0000000007EF0000-0x0000000007EF1000-memory.dmp

Filesize
4KB

Download
memory/3596-121-0x0000000001530000-0x0000000001554000-memory.dmp

Filesize
144KB

Download
memory/3596-120-0x00000000053C0000-0x00000000058BE000-memory.dmp

Filesize
5.0MB

Download
memory/3596-115-0x0000000000A40000-0x0000000000A41000-memory.dmp

Filesize
4KB

Download
memory/3596-118-0x0000000005460000-0x0000000005461000-memory.dmp

Filesize
4KB

Download
memory/3596-117-0x00000000058C0000-0x00000000058C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads