blustealer | 163a4345462ed09ccbbe9ef4296be3c9b0edf17e252cb422f8f0303aeddb3bca

Analysis

max time kernel
82s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16-08-2022 07:10

Target

Payment Slip.pdf.exe
Size

1.3MB
MD5

4c28e87b21490b34da1df162640c2ac0
SHA1

3dbf77540367aedf4a04e95d6c68b59db4401a15
SHA256

163a4345462ed09ccbbe9ef4296be3c9b0edf17e252cb422f8f0303aeddb3bca
SHA512

a665c259fb83e9b8451a316c6b914bce77328b1a00c6bf0a988f30512e7fda43105a1bb9ae81e3e4287d6cc04bdec8f7f366a3e5d69e0bad95463a7c824aff1c

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1856 set thread context of 1820	1856	Payment Slip.pdf.exe	80

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1856	Payment Slip.pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	Payment Slip.pdf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1820	Payment Slip.pdf.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1820	1856	Payment Slip.pdf.exe	80
PID 1856 wrote to memory of 1820	1856	Payment Slip.pdf.exe	80
PID 1856 wrote to memory of 1820	1856	Payment Slip.pdf.exe	80
PID 1856 wrote to memory of 1820	1856	Payment Slip.pdf.exe	80
PID 1856 wrote to memory of 1820	1856	Payment Slip.pdf.exe	80
PID 1856 wrote to memory of 1820	1856	Payment Slip.pdf.exe	80
PID 1856 wrote to memory of 1820	1856	Payment Slip.pdf.exe	80
PID 1856 wrote to memory of 1820	1856	Payment Slip.pdf.exe	80

C:\Users\Admin\AppData\Local\Temp\Payment Slip.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Slip.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\Payment Slip.pdf.exe
  "{path}"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1820

memory/1820-138-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1820-140-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1820-143-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1820-144-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1856-132-0x00000000002D0000-0x000000000042A000-memory.dmp

Filesize
1.4MB

Download
memory/1856-133-0x0000000005360000-0x0000000005904000-memory.dmp

Filesize
5.6MB

Download
memory/1856-134-0x0000000004C70000-0x0000000004D02000-memory.dmp

Filesize
584KB

Download
memory/1856-135-0x0000000004E50000-0x0000000004EEC000-memory.dmp

Filesize
624KB

Download
memory/1856-136-0x0000000004D30000-0x0000000004D3A000-memory.dmp

Filesize
40KB

Download