blustealer | 1eacc69459d960cc11c10fcdd8e4dcdf96d5c413fa741eb61d8dc465af018fea

Analysis

max time kernel
48s
max time network
56s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
08-08-2022 16:37

Target

SecuriteInfo.com.Trojan.DownloaderNET.345.23320.exe
Size

724KB
MD5

0f150fb1582b1a8917a0c70c8be24586
SHA1

4f11085573f5bb60cfbdd3acaa83930bb77f1ee0
SHA256

1eacc69459d960cc11c10fcdd8e4dcdf96d5c413fa741eb61d8dc465af018fea
SHA512

a7f40fdaf59d30c332ea2f8321e45aeabdb2490901b4cdd54c31c6055ef330d6ad63312e91b15bf27e7f9df3ac356b09136b233c332ec4de3b3cd66f477167f8

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1164 set thread context of 1720	1164	SecuriteInfo.com.Trojan.DownloaderNET.345.23320.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1720	cvtres.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1720	1164	SecuriteInfo.com.Trojan.DownloaderNET.345.23320.exe	27
PID 1164 wrote to memory of 1720	1164	SecuriteInfo.com.Trojan.DownloaderNET.345.23320.exe	27
PID 1164 wrote to memory of 1720	1164	SecuriteInfo.com.Trojan.DownloaderNET.345.23320.exe	27
PID 1164 wrote to memory of 1720	1164	SecuriteInfo.com.Trojan.DownloaderNET.345.23320.exe	27
PID 1164 wrote to memory of 1720	1164	SecuriteInfo.com.Trojan.DownloaderNET.345.23320.exe	27
PID 1164 wrote to memory of 1720	1164	SecuriteInfo.com.Trojan.DownloaderNET.345.23320.exe	27
PID 1164 wrote to memory of 1720	1164	SecuriteInfo.com.Trojan.DownloaderNET.345.23320.exe	27
PID 1164 wrote to memory of 1720	1164	SecuriteInfo.com.Trojan.DownloaderNET.345.23320.exe	27
PID 1164 wrote to memory of 1720	1164	SecuriteInfo.com.Trojan.DownloaderNET.345.23320.exe	27

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownloaderNET.345.23320.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownloaderNET.345.23320.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1720

memory/1164-54-0x0000000000EC0000-0x0000000000F78000-memory.dmp

Filesize
736KB

Download
memory/1164-55-0x0000000004960000-0x0000000004A04000-memory.dmp

Filesize
656KB

Download
memory/1164-56-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/1720-57-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1720-58-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1720-60-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1720-62-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1720-65-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1720-68-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1720-69-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download