Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
02-08-2022 22:30
Static task
static1
Behavioral task
behavioral1
Sample
NVCXNVCXHGDFH.exe
Resource
win7-20220718-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
NVCXNVCXHGDFH.exe
Resource
win10v2004-20220721-en
5 signatures
150 seconds
General
-
Target
NVCXNVCXHGDFH.exe
-
Size
73KB
-
MD5
07089baf80cbe2f4a1aab33f87aaf393
-
SHA1
75de538fd5df876510ba512322e8aec0a63818b1
-
SHA256
c54563d40991a77fb85520052ba60e4061dd4880b3a72c57b09533327cc76d03
-
SHA512
f4c44074ea202ece5e02415b7ab0407e99e9d359b17dca3bdd0ec73cb48e56fd9e200925c05f08f92f985780c8eac12cb613b6da46f15e55e9fd4c0b5fa8aedf
Score
10/10
Malware Config
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1988 set thread context of 632 1988 NVCXNVCXHGDFH.exe 28 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1988 NVCXNVCXHGDFH.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 632 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1988 wrote to memory of 632 1988 NVCXNVCXHGDFH.exe 28 PID 1988 wrote to memory of 632 1988 NVCXNVCXHGDFH.exe 28 PID 1988 wrote to memory of 632 1988 NVCXNVCXHGDFH.exe 28 PID 1988 wrote to memory of 632 1988 NVCXNVCXHGDFH.exe 28 PID 1988 wrote to memory of 632 1988 NVCXNVCXHGDFH.exe 28 PID 1988 wrote to memory of 632 1988 NVCXNVCXHGDFH.exe 28 PID 1988 wrote to memory of 632 1988 NVCXNVCXHGDFH.exe 28 PID 1988 wrote to memory of 632 1988 NVCXNVCXHGDFH.exe 28 PID 1988 wrote to memory of 632 1988 NVCXNVCXHGDFH.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NVCXNVCXHGDFH.exe"C:\Users\Admin\AppData\Local\Temp\NVCXNVCXHGDFH.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:632
-