blustealer | 163a4345462ed09ccbbe9ef4296be3c9b0edf17e252cb422f8f0303aeddb3bca

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16-08-2022 07:10

Target

Payment Slip.pdf.exe
Size

1.3MB
MD5

4c28e87b21490b34da1df162640c2ac0
SHA1

3dbf77540367aedf4a04e95d6c68b59db4401a15
SHA256

163a4345462ed09ccbbe9ef4296be3c9b0edf17e252cb422f8f0303aeddb3bca
SHA512

a665c259fb83e9b8451a316c6b914bce77328b1a00c6bf0a988f30512e7fda43105a1bb9ae81e3e4287d6cc04bdec8f7f366a3e5d69e0bad95463a7c824aff1c

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1048 set thread context of 1356	1048	Payment Slip.pdf.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1048	Payment Slip.pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1048	Payment Slip.pdf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1356	Payment Slip.pdf.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1356	1048	Payment Slip.pdf.exe	27
PID 1048 wrote to memory of 1356	1048	Payment Slip.pdf.exe	27
PID 1048 wrote to memory of 1356	1048	Payment Slip.pdf.exe	27
PID 1048 wrote to memory of 1356	1048	Payment Slip.pdf.exe	27
PID 1048 wrote to memory of 1356	1048	Payment Slip.pdf.exe	27
PID 1048 wrote to memory of 1356	1048	Payment Slip.pdf.exe	27
PID 1048 wrote to memory of 1356	1048	Payment Slip.pdf.exe	27
PID 1048 wrote to memory of 1356	1048	Payment Slip.pdf.exe	27
PID 1048 wrote to memory of 1356	1048	Payment Slip.pdf.exe	27

C:\Users\Admin\AppData\Local\Temp\Payment Slip.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Slip.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\Payment Slip.pdf.exe
  "{path}"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1356

memory/1048-54-0x0000000000FC0000-0x000000000111A000-memory.dmp

Filesize
1.4MB

Download
memory/1048-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1048-56-0x00000000002D0000-0x00000000002DA000-memory.dmp

Filesize
40KB

Download
memory/1048-57-0x0000000005E80000-0x0000000005F50000-memory.dmp

Filesize
832KB

Download
memory/1048-58-0x00000000001C0000-0x0000000000260000-memory.dmp

Filesize
640KB

Download
memory/1356-59-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1356-60-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1356-62-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1356-64-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1356-67-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1356-70-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download