blustealer | f24f8be855ccf6648a5c947f3710e652d083bf1ed86d73367e805556586cf6bf

Analysis

max time kernel
131s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2022 08:14

Target

SWIFT USD50000.exe
Size

1.1MB
MD5

e016090750d7ba7f0ea23beee330da11
SHA1

946fce67103c7a16711d9ba61e1b2f62236693b2
SHA256

8615bc30555f0ccd60466d99d1fe9e20fba142a3141ddd13f8354f564c47135a
SHA512

06f2f99e27a09ced989c49b7aa2c94f12d6d8d88467da9c7acadaba03856162d80b89b35d5e3f77410f4d4e4be882e6383221e047a35a1e6bdb48f20b11ab0ee

Score

10^/10

Family

blustealer

Credentials

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1700 set thread context of 1644	1700	SWIFT USD50000.exe	85

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	SWIFT USD50000.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1644	SWIFT USD50000.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 3152	1700	SWIFT USD50000.exe	84
PID 1700 wrote to memory of 3152	1700	SWIFT USD50000.exe	84
PID 1700 wrote to memory of 3152	1700	SWIFT USD50000.exe	84
PID 1700 wrote to memory of 1644	1700	SWIFT USD50000.exe	85
PID 1700 wrote to memory of 1644	1700	SWIFT USD50000.exe	85
PID 1700 wrote to memory of 1644	1700	SWIFT USD50000.exe	85
PID 1700 wrote to memory of 1644	1700	SWIFT USD50000.exe	85
PID 1700 wrote to memory of 1644	1700	SWIFT USD50000.exe	85
PID 1700 wrote to memory of 1644	1700	SWIFT USD50000.exe	85
PID 1700 wrote to memory of 1644	1700	SWIFT USD50000.exe	85
PID 1700 wrote to memory of 1644	1700	SWIFT USD50000.exe	85

C:\Users\Admin\AppData\Local\Temp\SWIFT USD50000.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT USD50000.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\SWIFT USD50000.exe
  "{path}"
  2⤵
  PID:3152
- C:\Users\Admin\AppData\Local\Temp\SWIFT USD50000.exe
  "{path}"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1644

memory/1644-139-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/1644-141-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/1644-144-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/1644-145-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/1700-132-0x0000000000780000-0x0000000000896000-memory.dmp

Filesize
1.1MB

Download
memory/1700-133-0x00000000058F0000-0x0000000005E94000-memory.dmp

Filesize
5.6MB

Download
memory/1700-134-0x0000000005250000-0x00000000052E2000-memory.dmp

Filesize
584KB

Download
memory/1700-135-0x0000000005340000-0x00000000053DC000-memory.dmp

Filesize
624KB

Download
memory/1700-136-0x0000000002CE0000-0x0000000002CEA000-memory.dmp

Filesize
40KB

Download